diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json
index c5938aa200cd40..5986c326ea80f4 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json
@@ -7,7 +7,7 @@
   "query": {
     "bool": {
       "filter": [
-        {"term": {"event.dataset": "dns"}},
+        {"term": {"event.dataset": "http"}},
         {"term": {"agent.type": "packetbeat"}}
       ],
       "must_not": [