diff --git a/msticpy/data/drivers/cybereason_driver.py b/msticpy/data/drivers/cybereason_driver.py
index 7334e1c94..0b4d128c6 100644
--- a/msticpy/data/drivers/cybereason_driver.py
+++ b/msticpy/data/drivers/cybereason_driver.py
@@ -159,7 +159,7 @@ def query(
             )
         else:
             df_result = self._format_result_to_dataframe(result=response)
-
+        df_result["instance"] = self.instance
         return df_result
 
     def _exec_paginated_queries(
diff --git a/tests/data/drivers/test_cybereason_driver.py b/tests/data/drivers/test_cybereason_driver.py
index 317b91aad..10547e314 100644
--- a/tests/data/drivers/test_cybereason_driver.py
+++ b/tests/data/drivers/test_cybereason_driver.py
@@ -281,6 +281,7 @@ def test_query(driver):
         check.is_true(connect.called or driver.connected)
         check.is_true(query.called)
         check.is_instance(data, pd.DataFrame)
+        check.is_true("instance" in data.columns)
 
 @respx.mock
 def test_partial_success_query(driver):