diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 49be076c0..ff8b240ec 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -474,19 +474,6 @@ soc:
         - event.dataset
         - process.executable
         - user.name
-      ':ossec:':
-        - soc_timestamp
-        - source.ip
-        - source.port
-        - destination.ip
-        - destination.port
-        - rule.name
-        - rule.level
-        - rule.category
-        - process.name
-        - user.name
-        - user.escalated
-        - location
       ':strelka:file':
         - soc_timestamp
         - file.name
@@ -523,28 +510,6 @@ soc:
         - message
         - kibana.log.meta.req.headers.x-real-ip
         - event.dataset
-      '::rootcheck':
-        - soc_timestamp
-        - host.name
-        - metadata.ip_address
-        - log.full
-        - event.dataset
-        - event.module
-      '::ossec':
-        - soc_timestamp
-        - host.name
-        - metadata.ip_address
-        - log.full
-        - event.dataset
-        - event.module
-      '::syscollector':
-        - soc_timestamp
-        - host.name
-        - metadata.ip_address
-        - wazuh.data.type
-        - log.full
-        - event.dataset
-        - event.module
       ':syslog:syslog':
         - soc_timestamp
         - host.name
@@ -1621,21 +1586,15 @@ soc:
               - rule.uuid
               - rule.category
               - rule.rev
-            ':ossec:':
+            ':playbook:':
               - soc_timestamp
               - rule.name
               - event.severity_label
-              - source.ip
-              - source.port
-              - destination.ip
-              - destination.port
-              - rule.level
-              - rule.category
-              - process.name
-              - user.name
-              - user.escalated
-              - location
-              - process.name
+              - event_data.event.module
+              - event_data.event.category
+              - event_data.process.executable
+              - event_data.process.pid
+              - event_data.winlog.computer_name
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged