diff --git a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
index cdf5bb40e0..e095104073 100644
--- a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
+++ b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - IcedID
   automated_detection_testing: passed
+  cis20: []
   confidence: 70
   context:
   - Source:Endpoint
@@ -47,6 +48,7 @@ tags:
   mitre_attack_id:
   - T1562.001
   - T1562
+  nist: []
   observable:
   - name: dest
     type: Hostname
diff --git a/detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml b/detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml
index a6889f6abe..dc4e181c39 100644
--- a/detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml
+++ b/detections/experimental/endpoint/ssa___excessive_number_of_office_files_copied.yml
@@ -27,6 +27,7 @@ references: []
 tags:
   analytic_story:
   - Insider Threat
+  cis20: []
   confidence: 80
   context:
   - Source:Endpoint
@@ -39,6 +40,7 @@ tags:
   message: High number of files copied
   mitre_attack_id:
   - T1048.003
+  nist: []
   observable:
   - name: dest_user_id
     type: User
diff --git a/detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml b/detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml
index 4e432359a4..23047ce93d 100644
--- a/detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml
+++ b/detections/experimental/endpoint/ssa___high_file_deletion_frequency.yml
@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Clop Ransomware
   - Insider Threat
+  cis20: []
   confidence: 80
   context:
   - Source:Endpoint
@@ -47,6 +48,7 @@ tags:
   message: High frequency file deletion activity detected on host $Computer$
   mitre_attack_id:
   - T1485
+  nist: []
   observable:
   - name: user
     type: User