diff --git a/docs/content/services/networking/virtual-networks/code/vnet-2/vnet-2.kql b/docs/content/services/networking/virtual-networks/code/vnet-2/vnet-2.kql
index 9b3403079..19d653e1b 100644
--- a/docs/content/services/networking/virtual-networks/code/vnet-2/vnet-2.kql
+++ b/docs/content/services/networking/virtual-networks/code/vnet-2/vnet-2.kql
@@ -1,4 +1,4 @@
 resources
 | where type =~ 'Microsoft.Network/virtualNetworks'
-| where isnotnull(properties.enableDdosProtection)
+| where tostring(properties.enableDdosProtection) contains "false"
 | project recommendationId = "vnet-2", name, id, properties.enableDdosProtection