diff --git a/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetAlertsAction.java b/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetAlertsAction.java
index 0d6bcb52d..19322d0cd 100644
--- a/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetAlertsAction.java
+++ b/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetAlertsAction.java
@@ -38,7 +38,7 @@ protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient cli
         String severityLevel = request.param("severityLevel", "ALL");
         String alertState = request.param("alertState", "ALL");
         // Table params
-        String sortString = request.param("sortString", "id");
+        String sortString = request.param("sortString", "start_time");
         String sortOrder = request.param("sortOrder", "asc");
         String missing = request.param("missing");
         int size = request.paramAsInt("size", 20);
diff --git a/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetFindingsAction.java b/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetFindingsAction.java
index b0c966732..00ce9ec6a 100644
--- a/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetFindingsAction.java
+++ b/src/main/java/org/opensearch/securityanalytics/resthandler/RestGetFindingsAction.java
@@ -38,7 +38,7 @@ protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient cli
         String detectorId = request.param("detector_id", null);
         String detectorType = request.param("detectorType", null);
         // Table params
-        String sortString = request.param("sortString", "id");
+        String sortString = request.param("sortString", "timestamp");
         String sortOrder = request.param("sortOrder", "asc");
         String missing = request.param("missing");
         int size = request.paramAsInt("size", 20);