diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
index 022695bcf5a7d9..af8bd86005dd92 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
@@ -21,7 +21,7 @@
     "influencers": [
       "host.name",
       "user.name",
-      "file.Path"
+      "file.path"
     ]
   },
   "allow_lazy_open": true,