diff --git a/thehive/app/org/thp/thehive/controllers/v0/DescribeCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/DescribeCtrl.scala
index 1aec31a7a1..77db1bb1c9 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/DescribeCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/DescribeCtrl.scala
@@ -80,9 +80,9 @@ class DescribeCtrl @Inject() (
     EntityDescription("case_task", "/case/task", taskCtrl.publicData.publicProperties.list.flatMap(propertyToJson("case_task", _))),
     EntityDescription("alert", "/alert", alertCtrl.publicData.publicProperties.list.flatMap(propertyToJson("alert", _))),
     EntityDescription("case_artifact", "/case/artifact", observableCtrl.publicData.publicProperties.list.flatMap(propertyToJson("case_artifact", _))),
-    EntityDescription("user", "user", userCtrl.publicData.publicProperties.list.flatMap(propertyToJson("user", _))),
+    EntityDescription("user", "/user", userCtrl.publicData.publicProperties.list.flatMap(propertyToJson("user", _))),
     EntityDescription("case_task_log", "/case/task/log", logCtrl.publicData.publicProperties.list.flatMap(propertyToJson("case_task_log", _))),
-    EntityDescription("audit", "audit", auditCtrl.publicData.publicProperties.list.flatMap(propertyToJson("audit", _)))
+    EntityDescription("audit", "/audit", auditCtrl.publicData.publicProperties.list.flatMap(propertyToJson("audit", _)))
   ) ++ describeCortexEntity("case_artifact_job", "/connector/cortex/job", "JobCtrl") ++
     describeCortexEntity("action", "/connector/cortex/action", "ActionCtrl")
 
diff --git a/thehive/app/org/thp/thehive/services/th3/Aggregation.scala b/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
index 00209b1289..0613df53a5 100644
--- a/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
+++ b/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
@@ -283,8 +283,8 @@ case class FieldAggregation(
         case order                                   => order      -> Order.asc
       }
       .foldLeft(groupedVertices) {
-        case (acc, (field, order)) if field == fieldName => acc.sort(_.by(_.selectKeys, order))
-        case (acc, (field, order)) if field == "count"   => acc.sort(_.by(_.selectValues.localCount, order))
+        case (acc, (field, order)) if field == fieldName                    => acc.sort(_.by(_.selectKeys, order))
+        case (acc, (field, order)) if field == "count" || field == "_count" => acc.sort(_.by(_.selectValues.localCount, order))
         case (acc, (field, _)) =>
           logger.warn(s"In field aggregation you can only sort by the field ($fieldName) or by count, not by $field")
           acc