diff --git a/splunk_alert.md b/splunk_alert.md
index ab3f70c..125b89c 100644
--- a/splunk_alert.md
+++ b/splunk_alert.md
@@ -43,5 +43,11 @@ priority=""
 
 ## Network Whitelist
 ```
-table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name mitre_category mitre_technique mitre_technique_id hunting_trigger
+table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name
+```
+
+
+## WMI Whitelist
+```
+| table _time indextime host_fqdn user_name wmi_consumer_name wmi_consumer_destination
 ```
\ No newline at end of file