diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml
index fbcbd02368..2170b2a707 100644
--- a/detections/endpoint/unusually_long_command_line.yml
+++ b/detections/endpoint/unusually_long_command_line.yml
@@ -32,13 +32,13 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 70
-  message: Unusually long command line $Processes.process_name$ on $dest$
+  message: Unusually long command line $process_name$ on $dest$
   observable:
   - name: dest
     type: Endpoint
     role:
     - Victim
-  - name: Processes.process_name
+  - name: process_name
     type: Process
     role:
     - Attacker