validation update

detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml

@@ -26,10 +26,11 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/impacket/windows-security.log
   kill_chain_phases:
-  - Intrusion
+  - Exploitation
   mitre_attack_id:
   - T1550
   product:
@@ -54,4 +55,4 @@ tags:
   - name: Client_Address
     type: Endpoint
     role:
-    - Victim
+    - Victim

detections/endpoint/kerberos_user_enumeration.yml

@@ -61,4 +61,5 @@ tags:
   - name: Client_Address
     type: Endpoint
     role:
-    - Victim
+    - Victim
+  asset_type: Endpoint

detections/endpoint/unknown_process_using_the_kerberos_protocol.yml

@@ -31,8 +31,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log
   kill_chain_phases:
-  - Privilege Escalation
-  - Lateral Movement
+  - Reconnaissance
   mitre_attack_id:
   - T1550
   product:
@@ -58,7 +57,7 @@ tags:
   - Source:Endpoint
   - Stage:Privilege Escalation
   - Stage:Lateral Movement
-  message: 
+  message: ''
   observable:
   - name: src_ip
     type: IP Address
@@ -67,4 +66,5 @@ tags:
   - name: dest_ip
     type: IP Address
     role:
-    - Victim
+    - Victim
+  asset_type: Endpoint