diff --git a/salt/soc/files/soc/hunt.eventfields.json b/salt/soc/files/soc/hunt.eventfields.json
index a9709a6a6..2e77780d3 100644
--- a/salt/soc/files/soc/hunt.eventfields.json
+++ b/salt/soc/files/soc/hunt.eventfields.json
@@ -57,10 +57,10 @@
 	  "::registry_create_delete": ["soc_timestamp", "winlog.event_data.TargetObject", "process.executable", "process.pid", "winlog.computer_name"],
           "::dns_query": ["soc_timestamp", "dns.query.name", "dns.answers.name", "process.executable", "winlog.computer_name"],
           "::file_create_stream_hash": ["soc_timestamp", "file.target", "hash.md5", "hash.sha256", "process.executable", "process.pid", "winlog.computer_name"],
-          "::tds": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.command", "event.dataset" ],
-	  "::tds_rpc": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.procedure_name", "event.dataset" ],
-	  "::cip": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "cip.service", "cip.status_code", "event.dataset" ],
-	  "::tds_sql_batch": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.header_type", "event.dataset" ]
+          "::tds": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "tds.command", "log.id.uid", "event.dataset" ],
+	  "::tds_rpc": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "tds.procedure_name", "log.id.uid", "event.dataset" ],
+	  "::cip": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "cip.service", "cip.status_code", "log.id.uid", "event.dataset" ],
+	  "::tds_sql_batch": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "tds.header_type", "log.id.uid", "event.dataset" ]