diff --git a/docs/attributes-registry/tls.md b/docs/attributes-registry/tls.md
index e17de0dc0a..1e030397e3 100644
--- a/docs/attributes-registry/tls.md
+++ b/docs/attributes-registry/tls.md
@@ -6,8 +6,8 @@
 
 # TLS
 
-- [Tls](#tls-attributes)
-- [Tls Deprecated](#tls-deprecated-attributes)
+- [TLS Attributes](#tls-attributes)
+- [TLS Deprecated Attributes](#tls-deprecated-attributes)
 
 ## TLS Attributes
 
diff --git a/model/registry/process.yaml b/model/registry/process.yaml
index dadf0e63f6..43dabaa1a3 100644
--- a/model/registry/process.yaml
+++ b/model/registry/process.yaml
@@ -94,6 +94,8 @@ groups:
           This field can be useful for querying or performing bucket analysis on how many
           arguments were provided to start a process. More arguments may be an indication
           of suspicious activity.
+        requirement_level:
+          recommended: if `process.command_args` is populated.
         examples: [4]
       - id: owner
         type: string