diff --git a/src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java b/src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java
index 68caae157..3414dfd39 100644
--- a/src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java
+++ b/src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java
@@ -154,13 +154,14 @@ protected Map<String, Object> searchWorkflow(String workflowId) throws IOExcepti
             "      }\n" +
             "   }\n" +
             "}";
-        List<SearchHit> hits = executeSearch(ScheduledJob.SCHEDULED_JOBS_INDEX, workflowRequest);
+        List<SearchHit> hits = executeWorkflowSearch("/_plugins/_alerting/monitors", workflowRequest);
+
         if (hits.size() == 0) {
             return new HashMap<>();
         }
 
         SearchHit hit = hits.get(0);
-        return (Map<String, Object>) hit.getSourceAsMap().get("workflow");
+        return (Map<String, Object>) hit.getSourceAsMap();
     }
 
 
@@ -412,6 +413,16 @@ protected List<SearchHit> executeSearch(String index, String request, Boolean re
         return Arrays.asList(searchResponse.getHits().getHits());
     }
 
+    protected List<SearchHit> executeWorkflowSearch(String url, String request) throws IOException {
+
+        Response response = makeRequest(client(), "POST", String.format(Locale.getDefault(), "%s/_search", url), Collections.emptyMap(), new StringEntity(request), new BasicHeader("Content-Type", "application/json"));
+        Assert.assertEquals("Workflow search failed", RestStatus.OK, restStatus(response));
+
+        SearchResponse searchResponse = SearchResponse.fromXContent(createParser(JsonXContent.jsonXContent, response.getEntity().getContent()));
+
+        return Arrays.asList(searchResponse.getHits().getHits());
+    }
+
     protected SearchResponse executeSearchAndGetResponse(String index, String request, Boolean refresh) throws IOException {
         if (refresh) {
             refreshIndex(index);