diff --git a/x-pack/filebeat/module/threatintel/anomali/config/config.yml b/x-pack/filebeat/module/threatintel/anomali/config/config.yml
index fb4384a3b01c..19e58b4bc12d 100644
--- a/x-pack/filebeat/module/threatintel/anomali/config/config.yml
+++ b/x-pack/filebeat/module/threatintel/anomali/config/config.yml
@@ -35,7 +35,7 @@ request.transforms:
     default: '[[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05.999Z" ]]'
 
 response.split:
-  target: body.results
+  target: body.objects
 
 cursor:
   timestamp: