diff --git a/ecs/states-vulnerabilities/fields/template-settings.json b/ecs/states-vulnerabilities/fields/template-settings.json
index 66db0f6ad7377..901003b59b17f 100644
--- a/ecs/states-vulnerabilities/fields/template-settings.json
+++ b/ecs/states-vulnerabilities/fields/template-settings.json
@@ -9,7 +9,7 @@
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.id",
-          "agent.group",
+          "agent.groups",
           "host.os.full",
           "host.os.version",
           "package.name",