diff --git a/src/middlewared/middlewared/plugins/audit/audit.py b/src/middlewared/middlewared/plugins/audit/audit.py
index 463e84cd3dc69..3a04493f4d5e2 100644
--- a/src/middlewared/middlewared/plugins/audit/audit.py
+++ b/src/middlewared/middlewared/plugins/audit/audit.py
@@ -129,7 +129,7 @@ async def compress(self, data):
 
     @accepts(Dict(
         'audit_query',
-        List('services', items=[Str('db_name', enum=ALL_AUDITED)], default=ALL_AUDITED),
+        List('services', items=[Str('db_name', enum=ALL_AUDITED)], default=['MIDDLEWARE', 'SUDO']),
         Ref('query-filters'),
         Ref('query-options'),
         register=True
diff --git a/src/middlewared/middlewared/plugins/audit/utils.py b/src/middlewared/middlewared/plugins/audit/utils.py
index 8ecfccff94580..7c6ebd4ff6fbe 100644
--- a/src/middlewared/middlewared/plugins/audit/utils.py
+++ b/src/middlewared/middlewared/plugins/audit/utils.py
@@ -122,7 +122,7 @@ def parse_query_filters(
 
             match f[1]:
                 case '=' | 'in':
-                    services_to_check = services_to_check & svcs
+                    services_to_check = svcs
                 case '!=' | 'nin':
                     services_to_check = services_to_check - svcs
                 case _: