diff --git a/rules/analyze/ANALYZE-ID-003.json b/rules/analyze/ANALYZE-ID-003.json
index b7625255..a694b89f 100644
--- a/rules/analyze/ANALYZE-ID-003.json
+++ b/rules/analyze/ANALYZE-ID-003.json
@@ -31,15 +31,7 @@
     }
   ],
   "confidenceFactors": [
-    {
-      "signal": "kev_confirmed",
-      "source": "event_data",
-      "eventType": "vulnerability_report",
-      "dataField": "scan_summary.kev_matches",
-      "operator": "gte",
-      "value": "1",
-      "weight": 10
-    }
+    { "signal": "kev_confirmed", "condition": "exists", "weight": 10 }
   ],
   "confidenceThreshold": 80,
   "explanation": "The device has installed software with critical vulnerabilities. Software with CVEs rated CRITICAL (CVSS >= 9.0) or listed in the CISA Known Exploited Vulnerabilities catalog was detected. These vulnerabilities are actively targeted by attackers and should be remediated immediately.",
diff --git a/rules/dist/analyze-rules.json b/rules/dist/analyze-rules.json
index 6964b9c5..08143abb 100644
--- a/rules/dist/analyze-rules.json
+++ b/rules/dist/analyze-rules.json
@@ -1143,15 +1143,7 @@
         }
       ],
       "confidenceFactors": [
-        {
-          "signal": "kev_confirmed",
-          "source": "event_data",
-          "eventType": "vulnerability_report",
-          "dataField": "scan_summary.kev_matches",
-          "operator": "gte",
-          "value": "1",
-          "weight": 10
-        }
+        { "signal": "kev_confirmed", "condition": "exists", "weight": 10 }
       ],
       "confidenceThreshold": 80,
       "explanation": "The device has installed software with critical vulnerabilities. Software with CVEs rated CRITICAL (CVSS >= 9.0) or listed in the CISA Known Exploited Vulnerabilities catalog was detected. These vulnerabilities are actively targeted by attackers and should be remediated immediately.",