diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 2e52e91435..6b9c3a6cd7 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments. It is unusual for searchprotocolhost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -14,11 +14,15 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
   and C:\Windows\syswow64.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(searchprotocolhost\.exe.{0,4}$)"  | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
@@ -59,11 +63,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path