diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/users/suggest_user_profiles_route.schema.yaml b/x-pack/plugins/security_solution/common/api/detection_engine/users/suggest_user_profiles_route.schema.yaml
index babaedf1486ff..c9e390da9fa17 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/users/suggest_user_profiles_route.schema.yaml
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/users/suggest_user_profiles_route.schema.yaml
@@ -3,7 +3,7 @@ info:
   title: Suggest user profiles API endpoint
   version: '2023-10-31'
 paths:
-  /api/detection_engine/signals/_find:
+  /internal/detection_engine/users/_find:
     summary: Suggests user profiles based on provided search term
     post:
       operationId: SuggestUserProfiles
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index f0f9e894cb787..52a2bcfc859b1 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -284,6 +284,8 @@ export const INTERNAL_TAGS_URL = `/internal/tags`;
 export const INTERNAL_DETECTION_ENGINE_URL = '/internal/detection_engine' as const;
 export const DETECTION_ENGINE_ALERTS_INDEX_URL =
   `${INTERNAL_DETECTION_ENGINE_URL}/signal/index` as const;
+export const DETECTION_ENGINE_ALERT_SUGGEST_USERS_URL =
+  `${INTERNAL_DETECTION_ENGINE_URL}/users/_find` as const;
 
 /**
  * Telemetry detection endpoint for any previews requested of what data we are
@@ -326,8 +328,6 @@ export const DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL =
 export const DETECTION_ENGINE_ALERT_TAGS_URL = `${DETECTION_ENGINE_SIGNALS_URL}/tags` as const;
 export const DETECTION_ENGINE_ALERT_ASSIGNEES_URL =
   `${DETECTION_ENGINE_SIGNALS_URL}/assignees` as const;
-export const DETECTION_ENGINE_ALERT_SUGGEST_USERS_URL =
-  `${DETECTION_ENGINE_SIGNALS_URL}/_find` as const;
 
 export const ALERTS_AS_DATA_URL = '/internal/rac/alerts' as const;
 export const ALERTS_AS_DATA_FIND_URL = `${ALERTS_AS_DATA_URL}/find` as const;