diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 1b455c62a..aa78ce3e2 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1396,19 +1396,19 @@ soc:
           - name: Sysmon Overview
             description: Overview of all Sysmon data types
             query: 'event.dataset:windows.sysmon_operational | groupby -sankey event.action host.name | groupby -sankey host.name user.name | groupby host.name | groupby event.category event.action  | groupby user.name | groupby dns.question.name | groupby process.executable | groupby winlog.event_data.TargetObject | groupby file.name | groupby source.ip | groupby destination.ip | groupby destination.port'
-          - name: Host Data - Registry Changes
+          - name: Host Registry Changes
             description: Windows Registry changes
             query: 'event.category: registry | groupby -sankey event.action host.name | groupby event.dataset event.action | groupby host.name | groupby process.executable | groupby registry.path | groupby process.executable registry.path'
-          - name: Host Data - DNS & Process Mappings 
+          - name: Host DNS & Process Mappings 
             description: DNS queries mapped to originating processes
             query: 'event.category: network AND _exists_:process.executable  AND (_exists_:dns.question.name OR _exists_:dns.answers.data)  | groupby -sankey host.name dns.question.name | groupby event.provider event.type | groupby host.name | groupby process.executable | groupby dns.question.name | groupby dns.answers.data'
-          - name: Host Data - Process
+          - name: Host Process Activity
             description: Process activity captured on an endpoint
             query: 'event.category:process | groupby -sankey host.name user.name*  | groupby event.dataset event.action | groupby host.name | groupby user.name | groupby process.working_directory | groupby process.executable | groupby process.command_line | groupby process.parent.executable | groupby process.parent.command_line | groupby -sankey process.parent.executable process.executable'
-          - name: Host Data - File
+          - name: Host File Activity
             description: File activity captured on an endpoint
             query: 'event.category: file AND _exists_:process.executable | groupby -sankey host.name process.executable | groupby host.name | groupby event.provider event.action event.type | groupby file.name | groupby process.executable'
-          - name: Host Data - Network & Process Mappings
+          - name: Host Network & Process Mappings
             description: Network activity mapped to originating processes
             query: 'event.category: network AND _exists_:process.executable | groupby -sankey event.action host.name | groupby -sankey host.name user.name | groupby event.provider* event.type* event.action* | groupby host.name | groupby user.name | groupby dns.question.name | groupby process.executable | groupby winlog.event_data.TargetObject | groupby process.name | groupby source.ip | groupby destination.ip | groupby destination.port'
           - name: Strelka