diff --git a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
index db8424f9aa..a64dfcb713 100644
--- a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
+++ b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
@@ -26,10 +26,11 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/impacket/windows-security.log
   kill_chain_phases:
-  - Intrusion
+  - Exploitation
   mitre_attack_id:
   - T1550
   product:
@@ -54,4 +55,4 @@ tags:
   - name: Client_Address
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
diff --git a/detections/endpoint/kerberos_user_enumeration.yml b/detections/endpoint/kerberos_user_enumeration.yml
index 96ac303ae7..7b0b57fe32 100644
--- a/detections/endpoint/kerberos_user_enumeration.yml
+++ b/detections/endpoint/kerberos_user_enumeration.yml
@@ -61,4 +61,5 @@ tags:
   - name: Client_Address
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  asset_type: Endpoint
\ No newline at end of file
diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
index 896d91227f..d22619538e 100644
--- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
@@ -31,8 +31,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log
   kill_chain_phases:
-  - Privilege Escalation
-  - Lateral Movement
+  - Reconnaissance
   mitre_attack_id:
   - T1550
   product:
@@ -58,7 +57,7 @@ tags:
   - Source:Endpoint
   - Stage:Privilege Escalation
   - Stage:Lateral Movement
-  message: 
+  message: ''
   observable:
   - name: src_ip
     type: IP Address
@@ -67,4 +66,5 @@ tags:
   - name: dest_ip
     type: IP Address
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  asset_type: Endpoint
\ No newline at end of file