diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml
index f5f14a64f9..1924d3d2b0 100644
--- a/detections/network/prohibited_network_traffic_allowed.yml
+++ b/detections/network/prohibited_network_traffic_allowed.yml
@@ -15,13 +15,18 @@ description: The following analytic detects instances where network traffic, ide
   compromising the organization's security posture.
 data_source:
 - Cisco Secure Firewall Threat Defense Connection Event
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Network_Traffic where All_Traffic.action IN ("allowed", "allow") by
-  All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
-  All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product  All_Traffic.rule | lookup update=true
-  interesting_ports_lookup dest_port as All_Traffic.dest_port OUTPUT app is_prohibited
-  note transport | search is_prohibited=true | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+  from datamodel=Network_Traffic 
+  where All_Traffic.action IN ("allowed", "allow") 
+  [| inputlookup interesting_ports_lookup where is_prohibited="true" 
+  | table dest_port transport | dedup dest_port transport 
+  | rename dest_port as All_Traffic.dest_port | rename transport as All_Traffic.transport]
+  by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule 
+  | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name("All_Traffic")` 
+  | `prohibited_network_traffic_allowed_filter`'
 how_to_implement: In order to properly run this search, Splunk needs to ingest data
   from firewalls or other network control devices that mediate the traffic allowed
   into an environment. This is necessary so that the search can identify an 'action'