From 4d91df0427b82e7967f56af328e99f5fba5466f1 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 11 Mar 2022 11:54:41 -0800
Subject: [PATCH] Reverted enrichment commit.

---
 ...mber_of_cloud_infrastructure_api_calls.yml |  6 ++--
 ...mber_of_cloud_security_group_api_calls.yml | 32 +++++++++----------
 ..._policy_version_to_allow_all_resources.yml |  3 +-
 detections/cloud/aws_createaccesskey.yml      |  3 +-
 detections/cloud/aws_createloginprofile.yml   |  3 +-
 ...ctivity_from_previously_unseen_account.yml | 12 +++----
 ...g_keys_with_encrypt_policy_without_mfa.yml |  6 ++--
 ...with_kms_keys_performing_encryption_s3.yml |  6 +++-
 ...s_ecr_container_scanning_findings_high.yml |  9 ++++--
 ...ing_findings_low_informational_unknown.yml |  9 ++++--
 ...ecr_container_scanning_findings_medium.yml |  9 ++++--
 ...ontainer_upload_outside_business_hours.yml |  9 ++++--
 .../aws_ecr_container_upload_unknown_user.yml |  9 ++++--
 .../cloud/aws_excessive_security_scanning.yml |  3 +-
 .../aws_iam_accessdenied_discovery_events.yml |  3 +-
 ...aws_iam_assume_role_policy_brute_force.yml |  3 +-
 detections/cloud/aws_iam_delete_policy.yml    |  3 +-
 .../cloud/aws_iam_failure_group_deletion.yml  |  3 +-
 .../aws_iam_successful_group_deletion.yml     |  3 +-
 .../cloud/aws_lambda_updatefunctioncode.yml   |  3 +-
 ...ntrol_list_created_with_all_open_ports.yml |  9 +++++-
 ...ws_network_access_control_list_deleted.yml |  4 ++-
 ..._access_by_provider_user_and_principal.yml |  4 +++
 .../aws_saml_update_identity_provider.yml     |  4 +++
 .../cloud/aws_setdefaultpolicyversion.yml     |  5 +--
 detections/cloud/aws_updateloginprofile.yml   |  3 +-
 .../cloud/circle_ci_disable_security_job.yml  |  3 +-
 .../cloud/circle_ci_disable_security_step.yml |  3 +-
 ...alls_from_previously_unseen_user_roles.yml | 12 +++----
 ...ance_created_by_previously_unseen_user.yml | 10 +++---
 ...ce_created_in_previously_unused_region.yml | 24 +++++++-------
 ...e_created_with_previously_unseen_image.yml |  7 +++-
 ...d_with_previously_unseen_instance_type.yml |  7 +++-
 ...e_modified_with_previously_unseen_user.yml | 14 ++++----
 ...ovisioning_from_previously_unseen_city.yml | 14 ++++----
 ...sioning_from_previously_unseen_country.yml | 14 ++++----
 ...ning_from_previously_unseen_ip_address.yml | 20 ++++++------
 ...isioning_from_previously_unseen_region.yml | 14 ++++----
 .../detect_aws_console_login_by_new_user.yml  |  6 ++--
 ...ws_console_login_by_user_from_new_city.yml |  8 ++---
 ...console_login_by_user_from_new_country.yml |  8 ++---
 ..._console_login_by_user_from_new_region.yml |  8 ++---
 .../cloud/detect_new_open_s3_buckets.yml      | 10 +++---
 ...etect_new_open_s3_buckets_over_aws_cli.yml | 11 +++++--
 .../cloud/detect_shared_ec2_snapshot.yml      |  7 ++--
 ...s_security_hub_alerts_for_ec2_instance.yml |  7 ++--
 detections/cloud/github_dependabot_alert.yml  | 10 ++++++
 .../github_pull_request_from_unknown_user.yml | 14 +++++++-
 .../gsuite_drive_share_in_external_email.yml  |  6 +++-
 .../gsuite_email_suspicious_attachment.yml    |  5 +++
 .../gsuite_suspicious_shared_file_name.yml    |  5 +++
 .../kubernetes_scanner_image_pulling.yml      |  9 +++++-
 ...365_add_app_role_assignment_grant_user.yml | 10 +++---
 .../cloud/o365_added_service_principal.yml    |  9 ++++--
 .../cloud/o365_bypass_mfa_via_trusted_ip.yml  | 10 ++++--
 detections/cloud/o365_disable_mfa.yml         | 10 ++++--
 .../cloud/o365_new_federated_domain_added.yml |  7 ++--
 .../7zip_commandline_to_smb_share_path.yml    | 19 ++++++-----
 .../account_discovery_with_net_app.yml        | 20 +++++++-----
 .../active_setup_registry_autostart.yml       | 21 ++++--------
 ...d_defaultuser_and_password_in_registry.yml | 21 +++---------
 .../add_or_set_windows_defender_exclusion.yml | 22 +++++++------
 ..._file_and_printing_sharing_in_firewall.yml | 22 +++++++------
 ...ound_traffic_by_firewall_rule_registry.yml | 22 ++++---------
 ...allow_inbound_traffic_in_firewall_rule.yml |  3 +-
 .../allow_network_discovery_in_firewall.yml   | 22 +++++++------
 .../allow_operation_with_consent_admin.yml    | 21 +++---------
 .../endpoint/anomalous_usage_of_7zip.yml      | 19 +++++------
 .../endpoint/any_powershell_downloadfile.yml  | 21 ++++++------
 .../any_powershell_downloadstring.yml         | 21 ++++++------
 .../endpoint/attacker_tools_on_endpoint.yml   | 11 +++----
 ..._to_add_certificate_to_untrusted_store.yml | 17 +++++-----
 .../attempt_to_stop_security_service.yml      | 21 ++++++------
 ...dential_dump_from_registry_via_reg_exe.yml | 21 ++++++------
 .../auto_admin_logon_registry_entry.yml       | 21 +++---------
 .../endpoint/batch_file_write_to_system32.yml | 17 +++++-----
 ...dedit_command_back_to_normal_mode_boot.yml | 13 ++++----
 .../bcdedit_failure_recovery_modification.yml | 12 +++----
 detections/endpoint/bits_job_persistence.yml  | 21 ++++++------
 .../endpoint/bitsadmin_download_file.yml      | 21 ++++++------
 ...load_with_urlcache_and_split_arguments.yml | 21 ++++++------
 ...oad_with_verifyctl_and_split_arguments.yml | 21 ++++++------
 .../certutil_exe_certificate_extraction.yml   | 20 +++++++-----
 .../certutil_with_decode_argument.yml         | 20 +++++++-----
 .../change_default_file_association.yml       | 12 +++----
 ...hange_to_safe_mode_with_network_config.yml | 13 ++++----
 .../endpoint/chcp_command_execution.yml       | 22 ++++---------
 .../check_elevated_cmd_using_whoami.yml       | 16 +++++-----
 ...ar_unallocated_sector_using_cipher_app.yml | 21 ++++++------
 .../endpoint/clop_common_exec_parameter.yml   | 21 ++++++------
 .../clop_ransomware_known_service_name.yml    |  8 ++++-
 ...cmd_carry_out_string_command_parameter.yml | 19 +++++------
 .../endpoint/cmd_echo_pipe___escalation.yml   | 21 ++++++------
 ...cmdline_tool_not_executed_in_cmd_shell.yml | 21 ++++++------
 .../endpoint/cmlua_or_cmstplua_uac_bypass.yml |  3 +-
 .../endpoint/common_ransomware_extensions.yml | 10 +++---
 .../endpoint/common_ransomware_notes.yml      | 10 +++---
 .../endpoint/conti_common_exec_parameter.yml  | 21 ++++++------
 ..._loading_from_world_writable_directory.yml | 21 ++++++------
 ...ate_local_admin_accounts_using_net_exe.yml | 18 +++++++----
 ...or_delete_windows_shares_using_net_exe.yml | 19 +++++++----
 ...ate_remote_thread_in_shell_application.yml |  3 +-
 .../endpoint/creation_of_shadow_copy.yml      | 20 +++++++-----
 ...f_shadow_copy_with_wmic_and_powershell.yml | 18 +++++++----
 ...ping_via_copy_command_from_shadow_copy.yml | 21 ++++++------
 ...ial_dumping_via_symlink_to_shadow_copy.yml | 21 ++++++------
 .../csc_net_on_the_fly_compilation.yml        | 18 +++++------
 .../curl_download_and_bash_execution.yml      | 19 ++++++-----
 .../delete_shadowcopy_with_powershell.yml     |  3 +-
 detections/endpoint/deleting_of_net_users.yml | 21 ++++++------
 .../endpoint/deleting_shadow_copies.yml       | 19 +++++++----
 ...tect_azurehound_command_line_arguments.yml | 20 +++++++-----
 .../detect_azurehound_file_modifications.yml  | 13 +++-----
 ...detect_excessive_user_account_lockouts.yml |  6 ++--
 .../endpoint/detect_exchange_web_shell.yml    | 15 ++++-----
 .../endpoint/detect_html_help_renamed.yml     | 21 ++++++------
 .../detect_html_help_spawn_child_process.yml  | 21 ++++++------
 .../detect_html_help_url_in_command_line.yml  | 21 ++++++------
 ...l_help_using_infotech_storage_handlers.yml | 20 +++++++-----
 .../detect_mimikatz_using_loaded_images.yml   |  5 +--
 .../detect_mshta_inline_hta_execution.yml     | 20 +++++++-----
 detections/endpoint/detect_mshta_renamed.yml  | 21 ++++++------
 .../detect_mshta_url_in_command_line.yml      | 20 +++++++-----
 ...nterception_by_creation_of_program_exe.yml | 18 +++++++----
 ...system_network_configuration_discovery.yml | 18 +++++++----
 ...ohibited_applications_spawning_cmd_exe.yml | 19 +++++++----
 .../detect_psexec_with_accepteula_flag.yml    | 20 +++++++-----
 .../detect_rclone_command_line_usage.yml      | 17 +++++-----
 .../detect_regasm_spawning_a_process.yml      | 17 +++++-----
 .../detect_regasm_with_network_connection.yml |  8 +++--
 ..._regasm_with_no_command_line_arguments.yml | 19 +++++++----
 .../detect_regsvcs_spawning_a_process.yml     | 18 +++++------
 ...detect_regsvcs_with_network_connection.yml |  7 ++--
 ...regsvcs_with_no_command_line_arguments.yml | 19 +++++++----
 ...ct_regsvr32_application_control_bypass.yml | 21 ++++++------
 detections/endpoint/detect_renamed_7_zip.yml  | 21 ++++++------
 detections/endpoint/detect_renamed_psexec.yml | 21 ++++++------
 detections/endpoint/detect_renamed_rclone.yml | 22 +++++++------
 detections/endpoint/detect_renamed_winrar.yml | 21 ++++++------
 ...2_application_control_bypass___advpack.yml | 21 ++++++------
 ..._application_control_bypass___setupapi.yml | 21 ++++++------
 ..._application_control_bypass___syssetup.yml | 21 ++++++------
 .../detect_rundll32_inline_hta_execution.yml  | 20 +++++++-----
 ...tect_sharphound_command_line_arguments.yml | 16 +++++-----
 .../detect_sharphound_file_modifications.yml  | 13 +++-----
 .../endpoint/detect_sharphound_usage.yml      | 21 ++++++------
 ..._cmd_exe_to_launch_script_interpreters.yml | 14 ++++----
 .../disable_amsi_through_registry.yml         | 21 ++++--------
 .../disable_defender_antivirus_registry.yml   | 22 ++++---------
 ...able_defender_blockatfirstseen_feature.yml | 22 ++++---------
 ...disable_defender_enhanced_notification.yml | 22 ++++---------
 .../disable_defender_mpengine_registry.yml    | 22 ++++---------
 .../disable_defender_spynet_reporting.yml     | 22 ++++---------
 ...efender_submit_samples_consent_feature.yml | 22 ++++---------
 .../endpoint/disable_etw_through_registry.yml | 21 ++++--------
 .../endpoint/disable_logs_using_wevtutil.yml  | 18 +++++------
 detections/endpoint/disable_registry_tool.yml | 21 ++++--------
 detections/endpoint/disable_schedule_task.yml | 12 +++----
 ...le_security_logs_using_minint_registry.yml | 22 ++++---------
 .../endpoint/disable_show_hidden_files.yml    | 21 ++++--------
 .../disable_uac_remote_restriction.yml        | 22 ++++---------
 .../endpoint/disable_windows_app_hotkeys.yml  | 21 +++---------
 .../disable_windows_behavior_monitoring.yml   | 21 ++++--------
 ...disable_windows_smartscreen_protection.yml | 21 ++++--------
 .../endpoint/disabling_cmd_application.yml    | 22 ++++---------
 .../endpoint/disabling_controlpanel.yml       | 22 ++++---------
 .../endpoint/disabling_defender_services.yml  | 22 ++++---------
 .../disabling_firewall_with_netsh.yml         | 21 ++++++------
 ...isabling_folderoptions_windows_feature.yml | 22 ++++---------
 .../endpoint/disabling_net_user_account.yml   | 21 ++++++------
 .../endpoint/disabling_norun_windows_app.yml  | 22 ++++---------
 .../disabling_remote_user_account_control.yml | 15 ++++-----
 .../disabling_systemrestore_in_registry.yml   | 22 ++++---------
 .../endpoint/disabling_task_manager.yml       | 22 ++++---------
 ...no_command_line_arguments_with_network.yml | 18 +++--------
 .../dns_exfiltration_using_nslookup_app.yml   | 19 +++++++----
 .../domain_account_discovery_with_dsquery.yml | 18 +++++------
 .../domain_account_discovery_with_net_app.yml | 18 +++++------
 .../domain_account_discovery_with_wmic.yml    | 18 +++++------
 ...omain_controller_discovery_with_nltest.yml | 20 +++++++-----
 .../domain_controller_discovery_with_wmic.yml | 20 +++++++-----
 .../domain_group_discovery_with_dsquery.yml   | 20 +++++++-----
 .../domain_group_discovery_with_net.yml       | 20 +++++++-----
 .../domain_group_discovery_with_wmic.yml      | 20 +++++++-----
 .../download_files_using_telegram.yml         |  3 +-
 .../endpoint/drop_icedid_license_dat.yml      |  3 +-
 .../endpoint/dsquery_domain_discovery.yml     | 16 +++++-----
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   | 18 +++++++----
 .../endpoint/dump_lsass_via_procdump.yml      | 14 ++++----
 .../elevated_group_discovery_with_net.yml     | 20 +++++++-----
 .../elevated_group_discovery_with_wmic.yml    | 20 +++++++-----
 .../enable_rdp_in_other_port_number.yml       | 20 +++---------
 ...le_wdigest_uselogoncredential_registry.yml | 23 ++++---------
 ...erate_users_local_group_using_telegram.yml |  3 +-
 detections/endpoint/esentutl_sam_copy.yml     | 21 ++++++------
 detections/endpoint/etw_registry_disabled.yml | 23 ++++---------
 detections/endpoint/eventvwr_uac_bypass.yml   | 22 ++++---------
 .../endpoint/excel_spawning_powershell.yml    | 20 +++++++-----
 .../excel_spawning_windows_script_host.yml    | 14 +++-----
 .../excessive_attempt_to_disable_services.yml | 14 ++++----
 ...ve_file_deletion_in_windefender_folder.yml |  3 +-
 ...ocesses_created_in_windows_temp_folder.yml |  9 +++---
 ...r_of_service_control_start_as_disabled.yml | 16 +++++-----
 ...excessive_number_of_taskhost_processes.yml |  9 +++---
 .../excessive_service_stop_attempt.yml        | 20 +++++++-----
 .../endpoint/excessive_usage_of_cacls_app.yml | 15 ++++-----
 .../endpoint/excessive_usage_of_net_app.yml   | 20 +++++++-----
 .../excessive_usage_of_nslookup_app.yml       |  3 +-
 .../excessive_usage_of_sc_service_utility.yml |  3 +-
 .../endpoint/excessive_usage_of_taskkill.yml  | 14 ++++----
 ..._or_script_creation_in_suspicious_path.yml | 12 +++----
 ...cute_javascript_with_jscript_com_clsid.yml | 16 +++++-----
 ...ution_of_file_with_multiple_extensions.yml | 10 +++---
 .../endpoint/extraction_of_registry_hives.yml | 20 +++++++-----
 .../endpoint/file_with_samsam_extension.yml   | 10 +++---
 .../firewall_allowed_program_enable.yml       | 18 +++++------
 detections/endpoint/fodhelper_uac_bypass.yml  | 18 +++++------
 detections/endpoint/fsutil_zeroing_file.yml   | 14 ++++----
 ...ltdomainpasswordpolicy_with_powershell.yml | 18 +++++------
 .../endpoint/get_aduser_with_powershell.yml   | 18 +++++------
 ...esultantpasswordpolicy_with_powershell.yml | 18 +++++------
 .../get_domainpolicy_with_powershell.yml      | 18 +++++------
 .../get_domaintrust_with_powershell.yml       | 20 +++++++-----
 ...maintrust_with_powershell_script_block.yml |  6 ++--
 .../get_domainuser_with_powershell.yml        | 18 +++++------
 .../get_foresttrust_with_powershell.yml       | 20 +++++++-----
 ...resttrust_with_powershell_script_block.yml |  5 +--
 .../get_wmiobject_group_discovery.yml         | 21 ++++++------
 .../getadcomputer_with_powershell.yml         | 20 +++++++-----
 .../endpoint/getadgroup_with_powershell.yml   | 20 +++++++-----
 .../getcurrent_user_with_powershell.yml       | 20 +++++++-----
 ...rent_user_with_powershell_script_block.yml | 10 +++---
 .../getdomaincomputer_with_powershell.yml     | 20 +++++++-----
 .../getdomaincontroller_with_powershell.yml   | 20 +++++++-----
 .../getdomaingroup_with_powershell.yml        | 20 +++++++-----
 .../endpoint/getlocaluser_with_powershell.yml |  9 +-----
 .../getnettcpconnection_with_powershell.yml   | 20 +++++++-----
 ...twmiobject_ds_computer_with_powershell.yml | 20 +++++++-----
 .../getwmiobject_ds_group_with_powershell.yml | 20 +++++++-----
 .../getwmiobject_ds_user_with_powershell.yml  | 18 +++++------
 ...wmiobject_user_account_with_powershell.yml |  9 +-----
 ...no_command_line_arguments_with_network.yml | 18 +++--------
 .../hide_user_account_from_sign_in_screen.yml | 21 +++---------
 ..._files_and_directories_with_attrib_exe.yml | 12 +++----
 ...equency_copy_of_files_in_network_share.yml |  3 +-
 .../high_process_termination_frequency.yml    |  3 +-
 detections/endpoint/hunting_for_log4shell.yml |  9 +++++-
 detections/endpoint/icacls_deny_command.yml   | 14 ++++----
 detections/endpoint/icacls_grant_command.yml  | 14 ++++----
 ...did_exfiltrated_archived_file_creation.yml |  3 +-
 ...ateral_movement_commandline_parameters.yml | 20 +++++++-----
 ...class_file_download_by_java_user_agent.yml | 21 ++++++------
 .../jscript_execution_using_cscript_app.yml   | 16 +++++-----
 ...on_flag_disabled_in_useraccountcontrol.yml |  5 +--
 .../known_services_killed_by_ransomware.yml   |  3 +-
 ...add_files_in_known_crontab_directories.yml | 12 +++----
 .../endpoint/linux_add_user_account.yml       | 18 +++++------
 .../linux_at_allow_config_file_creation.yml   | 12 +++----
 .../linux_at_application_execution.yml        | 18 +++++------
 .../linux_change_file_owner_to_root.yml       | 17 +++++-----
 ...x_common_process_for_elevation_control.yml | 17 +++++-----
 .../endpoint/linux_dd_file_overwrite.yml      | 17 +++++-----
 .../linux_doas_conf_file_creation.yml         | 12 +++----
 .../endpoint/linux_doas_tool_execution.yml    | 17 +++++-----
 .../linux_edit_cron_table_parameter.yml       | 16 +++++-----
 ...ile_created_in_kernel_driver_directory.yml | 11 ++++---
 ...x_file_creation_in_init_boot_directory.yml | 11 ++++---
 ...nux_file_creation_in_profile_directory.yml | 12 +++----
 ...ert_kernel_module_using_insmod_utility.yml | 17 +++++-----
 ...l_kernel_module_using_modprobe_utility.yml | 17 +++++-----
 .../endpoint/linux_java_spawning_shell.yml    | 20 +++++++-----
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 17 +++++-----
 .../linux_pkexec_privilege_escalation.yml     | 19 +++++++----
 ...ss_or_modification_of_sshd_config_file.yml | 16 +++++-----
 ...ux_possible_access_to_credential_files.yml | 16 +++++-----
 .../linux_possible_access_to_sudoers_file.yml | 16 +++++-----
 ...append_command_to_at_allow_config_file.yml | 18 +++++------
 ..._append_command_to_profile_config_file.yml | 17 +++++-----
 ...cronjob_entry_on_existing_cronjob_file.yml | 18 +++++------
 ...sible_cronjob_modification_with_editor.yml | 16 +++++-----
 .../linux_possible_ssh_key_file_creation.yml  | 11 ++++---
 .../linux_preload_hijack_library_calls.yml    | 17 +++++-----
 ...vice_file_created_in_systemd_directory.yml | 12 +++----
 .../endpoint/linux_service_restarted.yml      | 17 +++++-----
 .../linux_service_started_or_enabled.yml      | 17 +++++-----
 .../linux_setuid_using_chmod_utility.yml      | 17 +++++-----
 .../linux_setuid_using_setcap_utility.yml     | 17 +++++-----
 .../endpoint/linux_sudo_or_su_execution.yml   | 17 +++++-----
 .../linux_sudoers_tmp_file_creation.yml       | 11 ++++---
 .../linux_system_network_discovery.yml        | 16 +++++-----
 .../linux_visudo_utility_execution.yml        | 17 +++++-----
 .../endpoint/loading_of_dynwrapx_module.yml   |  3 +-
 .../local_account_discovery_with_net.yml      |  9 +-----
 .../local_account_discovery_with_wmic.yml     |  9 +-----
 .../logon_script_event_trigger_execution.yml  | 12 +++----
 .../endpoint/mailsniper_invoke_functions.yml  |  3 +-
 .../malicious_inprocserver32_modification.yml | 16 ++--------
 ...cious_powershell_executed_as_a_service.yml |  3 +-
 ...s_powershell_process___encoded_command.yml | 15 ++++-----
 ...hell_process___execution_policy_bypass.yml | 18 +++++++----
 ...ll_process_with_obfuscation_techniques.yml | 20 +++++++-----
 ...z_passtheticket_commandline_parameters.yml | 18 +++++------
 ...mmc_exe_lolbas_execution_process_spawn.yml | 21 ++++++------
 .../endpoint/modification_of_wallpaper.yml    |  3 +-
 ...dify_acl_permission_to_files_or_folder.yml | 14 ++++----
 ...nitor_registry_keys_for_print_monitors.yml | 25 ++++-----------
 ..._scripting_process_loading_ldap_module.yml |  3 +-
 ...s_scripting_process_loading_wmi_module.yml |  3 +-
 ...d_suspicious_spawned_by_script_process.yml | 15 ++++-----
 ..._spawning_rundll32_or_regsvr32_process.yml | 21 ++++++------
 .../mshtml_module_load_in_office_product.yml  |  3 +-
 .../msmpeng_application_dll_side_loading.yml  | 12 +++----
 ...uthenticate_using_explicit_credentials.yml |  5 +--
 ..._authenticate_from_host_using_kerberos.yml |  5 +--
 ...s_failing_to_authenticate_from_process.yml |  9 +++---
 ...tely_failing_to_authenticate_from_host.yml |  7 ++--
 .../endpoint/net_localgroup_discovery.yml     | 21 ++++++------
 .../endpoint/net_profiler_uac_bypass.yml      | 10 +++---
 .../network_connection_discovery_arp.yml      | 20 +++++++-----
 .../network_connection_discovery_net.yml      | 20 +++++++-----
 .../network_connection_discovery_netstat.yml  | 20 +++++++-----
 ...work_discovery_using_route_windows_app.yml | 18 +++++------
 .../endpoint/nishang_powershelltcponeline.yml | 21 ++++++------
 .../nltest_domain_trust_discovery.yml         | 16 +++++-----
 ...e_process_accessing_chrome_default_dir.yml |  3 +-
 ...fox_process_access_firefox_profile_dir.yml |  3 +-
 detections/endpoint/ntdsutil_export_ntds.yml  | 16 +++++-----
 .../office_application_drop_executable.yml    | 17 +++-------
 ...ice_application_spawn_regsvr32_process.yml | 22 +++++++------
 ...ice_application_spawn_rundll32_process.yml | 21 ++++++------
 ...office_document_creating_schedule_task.yml |  3 +-
 .../office_document_executing_macro_code.yml  |  3 +-
 ...ment_spawned_child_process_to_download.yml | 21 ++++++------
 .../office_product_spawn_cmd_process.yml      | 22 +++++++------
 .../office_product_spawning_bitsadmin.yml     | 22 +++++++------
 .../office_product_spawning_certutil.yml      | 22 +++++++------
 .../office_product_spawning_mshta.yml         | 22 +++++++------
 ..._product_spawning_rundll32_with_no_dll.yml | 21 ++++++------
 .../endpoint/office_product_spawning_wmic.yml | 22 +++++++------
 .../office_product_writing_cab_or_inf.yml     | 15 ++-------
 .../endpoint/office_spawning_control.yml      | 21 ++++++------
 ...nnection_from_java_using_default_ports.yml | 22 ++++++-------
 .../overwriting_accessibility_binaries.yml    | 10 +++---
 .../password_policy_discovery_with_net.yml    | 18 +++++------
 ...mission_modification_using_takeown_app.yml | 18 +++++------
 .../endpoint/ping_sleep_batch_command.yml     | 22 +++++++------
 .../possible_browser_pass_view_parameter.yml  | 22 +++++++------
 ...ible_lateral_movement_powershell_spawn.yml | 21 ++++++------
 ...entially_malicious_code_on_commandline.yml | 17 +++++-----
 .../endpoint/powershell_4104_hunting.yml      |  1 +
 ...connect_to_internet_with_hidden_window.yml | 14 ++++----
 ...powershell_disable_security_monitoring.yml | 21 ++++++------
 ...powershell_enable_smb1protocol_feature.yml |  3 +-
 .../powershell_execute_com_object.yml         |  3 +-
 .../powershell_get_localgroup_discovery.yml   | 20 +++++++-----
 .../powershell_processing_stream_of_data.yml  |  5 +--
 ...remote_thread_to_known_windows_process.yml |  3 +-
 ...hell_remove_windows_defender_directory.yml |  3 +-
 .../powershell_start_bitstransfer.yml         | 21 ++++++------
 ...ll_windows_defender_exclusion_commands.yml |  3 +-
 ...nt_automatic_repair_mode_using_bcdedit.yml | 18 +++++------
 .../print_spooler_adding_a_printer_driver.yml |  3 +-
 ...print_spooler_failed_to_load_a_plug_in.yml |  3 +-
 ...eating_lnk_file_in_suspicious_location.yml | 21 +++++-------
 ...process_deleting_its_process_file_path.yml | 18 ++++++-----
 .../endpoint/process_execution_via_wmi.yml    | 15 ++++-----
 .../process_kill_base_on_file_path.yml        | 20 +++++++-----
 .../process_writing_dynamicwrapperx.yml       | 20 +++---------
 .../endpoint/processes_launching_netsh.yml    | 15 ++++-----
 .../ransomware_notes_bulk_creation.yml        | 12 ++++---
 ...rsive_delete_of_directory_in_batch_cmd.yml | 20 +++++++-----
 ...ulating_windows_services_registry_keys.yml | 14 ++++----
 ...istry_keys_for_creating_shim_databases.yml | 21 +++---------
 .../registry_keys_used_for_persistence.yml    | 21 +++---------
 ...try_keys_used_for_privilege_escalation.yml | 22 +++----------
 ...2_silent_and_install_param_dll_loading.yml | 20 +++++++-----
 ...svr32_with_known_silent_switch_cmdline.yml | 20 +++++++-----
 .../remcos_client_registry_install_entry.yml  | 22 ++++---------
 ...cos_rat_file_creation_in_remcos_folder.yml |  6 +---
 ..._instantiation_via_dcom_and_powershell.yml | 20 +++++++-----
 ...instantiation_via_winrm_and_powershell.yml | 20 +++++++-----
 ...cess_instantiation_via_winrm_and_winrs.yml | 21 ++++++------
 .../remote_process_instantiation_via_wmi.yml  | 20 +++++++-----
 ...s_instantiation_via_wmi_and_powershell.yml | 20 +++++++-----
 .../remote_system_discovery_with_dsquery.yml  | 20 +++++++-----
 .../remote_system_discovery_with_net.yml      | 20 +++++++-----
 .../remote_system_discovery_with_wmic.yml     | 20 +++++++-----
 .../endpoint/remote_wmi_command_attempt.yml   | 16 +++++-----
 .../endpoint/resize_shadowstorage_volume.yml  | 16 ++++------
 .../endpoint/revil_common_exec_parameter.yml  | 18 +++++------
 detections/endpoint/revil_registry_entry.yml  | 21 ++++--------
 .../rubeus_command_line_parameters.yml        | 18 +++++------
 ...ticket_exports_through_winlogon_access.yml |  9 +++---
 .../runas_execution_in_commandline.yml        | 18 +++++------
 .../endpoint/rundll32_control_rundll_hunt.yml | 21 ++++++------
 ...ontrol_rundll_world_writable_directory.yml | 21 ++++++------
 ...ll32_create_remote_thread_to_a_process.yml |  3 +-
 ...rundll32_createremotethread_in_browser.yml |  3 +-
 detections/endpoint/rundll32_dnsquery.yml     |  3 +-
 ...undll32_process_creating_exe_dll_files.yml |  3 +-
 .../endpoint/rundll32_shimcache_flush.yml     | 21 ++++++------
 ...no_command_line_arguments_with_network.yml | 24 +++++++-------
 .../rundll_loading_dll_by_ordinal.yml         | 21 ++++++------
 .../endpoint/ryuk_test_files_detected.yml     | 10 +++---
 .../endpoint/ryuk_wake_on_lan_command.yml     | 17 +++++-----
 .../sam_database_file_access_attempt.yml      |  6 ++--
 .../endpoint/samsam_test_file_write.yml       | 10 +++---
 .../sc_exe_manipulating_windows_services.yml  | 12 +++----
 ..._by_app_connect_and_create_adsi_object.yml |  3 +-
 ...edule_task_with_http_command_arguments.yml |  3 +-
 ...ule_task_with_rundll32_command_trigger.yml |  3 +-
 ...k_creation_on_remote_endpoint_using_at.yml | 21 ++++++------
 ...eduled_task_deleted_or_created_via_cmd.yml | 14 ++++----
 ...led_task_initiation_on_remote_endpoint.yml | 21 ++++++------
 .../endpoint/schtasks_run_task_on_demand.yml  | 14 ++++----
 ...htasks_scheduling_job_on_remote_system.yml | 13 ++++----
 .../schtasks_used_for_forcing_a_reboot.yml    | 12 +++----
 .../screensaver_event_trigger_execution.yml   | 12 +++----
 .../endpoint/script_execution_via_wmi.yml     | 12 +++----
 detections/endpoint/sdclt_uac_bypass.yml      | 21 +++---------
 .../sdelete_application_execution.yml         | 21 ++++++------
 ...host_with_no_command_line_with_network.yml | 17 +++-------
 .../secretdumps_offline_ntds_dumping_tool.yml | 18 +++++------
 ...incipalnames_discovery_with_powershell.yml | 11 +++++++
 ...ceprincipalnames_discovery_with_setspn.yml | 21 ++++++------
 detections/endpoint/services_escalate_exe.yml | 18 +++++------
 ...ces_exe_lolbas_execution_process_spawn.yml | 21 ++++++------
 ...ution_policy_to_unrestricted_or_bypass.yml | 10 +++---
 .../endpoint/shim_database_file_creation.yml  | 12 +++----
 ...nstallation_with_suspicious_parameters.yml | 11 +++----
 .../endpoint/short_lived_scheduled_task.yml   | 10 +++---
 .../endpoint/short_lived_windows_accounts.yml |  8 ++---
 .../endpoint/silentcleanup_uac_bypass.yml     | 21 +++---------
 .../single_letter_process_on_endpoint.yml     | 10 +++---
 detections/endpoint/slui_runas_elevated.yml   | 16 +++++-----
 .../endpoint/slui_spawning_a_process.yml      | 17 +++++-----
 .../endpoint/spoolsv_spawning_rundll32.yml    | 22 +++++++------
 .../spoolsv_suspicious_loaded_modules.yml     |  3 +-
 .../spoolsv_suspicious_process_access.yml     |  3 +-
 detections/endpoint/spoolsv_writing_a_dll.yml | 18 +++++------
 .../spoolsv_writing_a_dll___sysmon.yml        |  3 +-
 .../endpoint/sqlite_module_in_temp_folder.yml |  3 +-
 .../start_up_during_safe_mode_boot.yml        | 20 +++---------
 ...uspicious_computer_account_name_change.yml |  3 +-
 .../endpoint/suspicious_copy_on_system32.yml  | 20 +++++++-----
 ...ious_dllhost_no_command_line_arguments.yml | 19 +++++++----
 .../suspicious_driver_loaded_path.yml         |  3 +-
 ...ous_gpupdate_no_command_line_arguments.yml | 19 +++++++----
 .../suspicious_icedid_rundll32_cmdline.yml    | 21 ++++++------
 ...cious_image_creation_in_appdata_folder.yml | 14 ++------
 ...icious_kerberos_service_ticket_request.yml |  3 +-
 .../suspicious_linux_discovery_commands.yml   | 11 +++----
 ...ous_microsoft_workflow_compiler_rename.yml | 21 ++++++------
 ...ious_microsoft_workflow_compiler_usage.yml | 19 +++++++----
 .../endpoint/suspicious_msbuild_path.yml      | 20 +++++++-----
 .../endpoint/suspicious_msbuild_rename.yml    | 21 ++++++------
 .../endpoint/suspicious_msbuild_spawn.yml     | 20 +++++++-----
 .../suspicious_mshta_child_process.yml        | 14 ++++----
 .../endpoint/suspicious_mshta_spawn.yml       | 20 +++++++-----
 ...ess_dns_query_known_abuse_web_services.yml |  3 +-
 .../endpoint/suspicious_process_file_path.yml | 16 +++++-----
 ...picious_process_with_discord_dns_query.yml |  3 +-
 .../endpoint/suspicious_reg_exe_process.yml   | 16 +++++-----
 ...ious_regsvr32_register_suspicious_path.yml | 21 ++++++------
 .../suspicious_rundll32_dllregisterserver.yml | 21 ++++++------
 .../suspicious_rundll32_plugininit.yml        | 22 +++++++------
 .../endpoint/suspicious_rundll32_startw.yml   | 21 ++++++------
 ...undll32_with_no_command_line_arguments.yml | 19 +++++++----
 ...s_scheduled_task_from_public_directory.yml | 17 +++++-----
 ...protocolhost_no_command_line_arguments.yml | 19 +++++++----
 ...picious_ticket_granting_ticket_request.yml |  3 +-
 .../suspicious_wav_file_in_appdata_folder.yml | 14 ++------
 .../endpoint/suspicious_wevtutil_usage.yml    | 12 +++----
 ...spicious_writes_to_windows_recycle_bin.yml | 22 ++++++-------
 ...ost_exe_lolbas_execution_process_spawn.yml | 21 ++++++------
 ...nfo_gathering_using_dxdiag_application.yml | 21 ++++++------
 ...system_information_discovery_detection.yml | 11 +++----
 ...rocesses_run_from_unexpected_locations.yml | 18 +++++------
 .../system_user_discovery_with_query.yml      | 20 +++++++-----
 .../system_user_discovery_with_whoami.yml     | 20 +++++++-----
 .../time_provider_persistence_registry.yml    | 21 ++++--------
 detections/endpoint/trickbot_named_pipe.yml   |  3 +-
 .../uac_bypass_mmc_load_unsigned_dll.yml      |  3 +-
 .../uac_bypass_with_colorui_com_object.yml    |  3 +-
 ...d_messaging_service_spawning_a_process.yml | 17 +++++-----
 .../endpoint/uninstall_app_using_msiexec.yml  | 17 +++++-----
 .../endpoint/unload_sysmon_filter_driver.yml  | 14 ++++----
 ..._of_kerberos_service_tickets_requested.yml | 11 ++++---
 ...er_discocvery_with_env_vars_powershell.yml | 20 +++++++-----
 ..._with_env_vars_powershell_script_block.yml | 10 +++---
 detections/endpoint/usn_journal_deletion.yml  | 14 ++++----
 .../vbscript_execution_using_wscript_app.yml  | 20 +++++++-----
 .../endpoint/verclsid_clsid_execution.yml     | 21 ++++++------
 detections/endpoint/w3wp_spawning_shell.yml   | 20 +++++++-----
 .../wbadmin_delete_system_backups.yml         | 12 +++----
 .../wbemprox_com_object_execution.yml         |  3 +-
 ...ss_connecting_to_ip_check_web_services.yml |  3 +-
 .../wermgr_process_create_executable_file.yml |  3 +-
 ...cess_spawned_cmd_or_powershell_process.yml | 22 +++++++------
 .../wget_download_and_bash_execution.yml      | 19 ++++++-----
 detections/endpoint/windows_adfind_exe.yml    | 16 +++++-----
 ...ndows_curl_download_to_suspicious_path.yml | 21 ++++++------
 ...dows_curl_upload_to_remote_destination.yml | 21 ++++++------
 ...dows_defender_exclusion_registry_entry.yml | 22 ++++---------
 .../windows_disable_memory_crash_dump.yml     | 30 ++++++++---------
 .../windows_disableantispyware_reg.yml        | 12 +++----
 .../endpoint/windows_diskcryptor_usage.yml    | 21 ++++++------
 .../windows_diskshadow_proxy_execution.yml    | 17 +++++-----
 .../endpoint/windows_dism_remove_defender.yml | 21 ++++++------
 ...ows_dotnet_binary_in_non_standard_path.yml | 22 +++++++------
 .../windows_event_for_service_disabled.yml    |  3 +-
 ...dows_excessive_disabled_services_event.yml |  3 +-
 ...e_without_extension_in_critical_folder.yml | 23 +++++++------
 .../windows_high_file_deletion_frequency.yml  |  3 +-
 .../windows_installutil_credential_theft.yml  | 14 +++++++-
 ...ndows_installutil_in_non_standard_path.yml | 23 ++++++-------
 ..._installutil_remote_network_connection.yml | 27 +++++++++-------
 .../windows_installutil_uninstall_option.yml  | 21 ++++++------
 ...tallutil_uninstall_option_with_network.yml | 26 ++++++++-------
 ...indows_installutil_url_in_command_line.yml | 21 ++++++------
 ...w_compress_color_and_info_tip_registry.yml | 20 +++---------
 .../endpoint/windows_nirsoft_advancedrun.yml  | 21 ++++++------
 .../endpoint/windows_nirsoft_utilities.yml    | 22 +++++++------
 ...ows_process_with_namedpipe_commandline.yml | 26 +++++++--------
 ...indows_raccine_scheduled_task_deletion.yml | 21 ++++++------
 .../windows_rasautou_dll_execution.yml        | 21 ++++++------
 ...ws_raw_access_to_disk_volume_partition.yml |  3 +-
 ...raw_access_to_master_boot_record_drive.yml |  3 +-
 ...ows_remote_assistance_spawning_process.yml | 21 ++++++------
 .../windows_schtasks_create_run_as_system.yml | 21 ++++++------
 ...ndows_security_account_manager_stopped.yml | 11 ++++---
 ...ws_service_creation_on_remote_endpoint.yml | 21 ++++++------
 ..._service_creation_using_registry_entry.yml | 28 ++++++++--------
 ..._service_initiation_on_remote_endpoint.yml | 21 ++++++------
 .../windows_wmi_process_call_create.yml       | 26 +++++++--------
 ..._scheduled_task_created_to_spawn_shell.yml |  5 +--
 ...eduled_task_created_within_public_path.yml |  5 +--
 ...ws_task_scheduler_event_action_started.yml |  7 +++-
 .../endpoint/winhlp32_spawning_a_process.yml  | 21 ++++++------
 detections/endpoint/winword_spawning_cmd.yml  | 22 +++++++------
 .../endpoint/winword_spawning_powershell.yml  | 22 +++++++------
 .../winword_spawning_windows_script_host.yml  | 18 +++--------
 detections/endpoint/wmic_group_discovery.yml  | 21 ++++++------
 ...wmic_noninteractive_app_uninstallation.yml | 21 ++++++------
 .../endpoint/wmic_xsl_execution_via_url.yml   | 21 ++++++------
 ...sve_exe_lolbas_execution_process_spawn.yml | 21 ++++++------
 ...pt_or_cscript_suspicious_child_process.yml | 21 ++++++------
 ...ost_exe_lolbas_execution_process_spawn.yml | 21 ++++++------
 detections/endpoint/wsreset_uac_bypass.yml    | 21 +++---------
 detections/endpoint/xmrig_driver_loaded.yml   |  3 +-
 .../xsl_script_execution_with_wmic.yml        | 16 +++++-----
 ...connecting_to_dynamic_domain_providers.yml | 11 +++----
 .../network/detect_outbound_ldap_traffic.yml  |  8 ++---
 ...ry_length_with_high_standard_deviation.yml |  6 ++--
 ...ltiple_archive_files_http_post_traffic.yml |  3 +-
 .../plain_http_post_exfiltrated_data.yml      |  3 +-
 ...g4shell_jndi_payload_injection_attempt.yml |  2 +-
 ...oad_injection_with_outbound_connection.yml |  5 ++-
 558 files changed, 4327 insertions(+), 4050 deletions(-)

diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
index 402a9f2174..6025bbdde9 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
@@ -60,10 +60,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.command
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.command
+  - All_Changes.user
+  - All_Changes.status
   risk_score: 15
   security_domain: network
   supported_tas:
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
index 2ee081faff..30100483c7 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
@@ -5,21 +5,21 @@ date: '2020-09-07'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment about security groups by a user.
 search: '| tstats count as security_group_api_calls values(All_Changes.command) as
-  command from datamodel=Change.All_Changes where All_Changes.object_category=firewall
-  AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
-  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
-  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
-  <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1]
-  | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005
-  | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1
-  | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"),
-  0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold
-  = security_group_api_calls - expected_upper_threshold | table _time, user, command,
-  security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
+  command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success
+  by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
+  HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time,
+  "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay
+  isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality
+  >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename
+  "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold
+  = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls
+  > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls
+  - expected_upper_threshold | table _time, user, command, security_group_api_calls,
+  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
 how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
   run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
   create the probability density function model.
@@ -65,11 +65,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.command
-  - Change.All_Changes.object_category
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.command
+  - All_Changes.object_category
+  - All_Changes.status
+  - All_Changes.user
   risk_score: 15
   security_domain: network
   supported_tas:
diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
index c96b4df089..931bf81982 100644
--- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
@@ -63,8 +63,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.userName
   risk_score: 49
   security_domain: network
diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index 5e2287321d..5c2276390f 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -64,8 +64,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.userName
   risk_score: 63
   security_domain: network
diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml
index f634bb8135..5a203a77d8 100644
--- a/detections/cloud/aws_createloginprofile.yml
+++ b/detections/cloud/aws_createloginprofile.yml
@@ -67,8 +67,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.userName
   risk_score: 72
   security_domain: network
diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
index b6465ac9ea..677fc3cbd7 100644
--- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
+++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
@@ -5,7 +5,7 @@ date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Authentication.Authentication
+- Authentication
 description: This search looks for AssumeRole events where an IAM role in a different
   account is requested for the first time.
 search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication
@@ -68,11 +68,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Authentication.Authentication.signature
-  - Authentication.Authentication.src
-  - Authentication.Authentication.user
-  - Authentication.Authentication.user_role
-  - Authentication.Authentication.vendor_account
   - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.user_role
+  - Authentication.src
   risk_score: 15
   security_domain: network
diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
index fc1585a97a..170a48597e 100644
--- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
@@ -55,9 +55,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - awsRegion
-  - eventID
   - eventName
   - eventSource
+  - eventID
+  - awsRegion
+  - requestParameters.policy
+  - userIdentity.principalId
   risk_score: 25
   security_domain: threat
diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
index f9f17d7bf8..c77f2d28d6 100644
--- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
@@ -55,7 +55,11 @@ tags:
   required_fields:
   - _time
   - eventName
-  - region
+  - requestParameters.x-amz-server-side-encryption
+  - requestParameters.bucketName
+  - requestParameters.x-amz-copy-source
+  - requestParameters.key
   - userAgent
+  - region
   risk_score: 15
   security_domain: threat
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index ae43e81049..9a9eeb3114 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -53,11 +53,14 @@ tags:
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - awsRegion
-  - eventName
   - eventSource
-  - src_ip
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
   - user
   - userName
+  - src_ip
   risk_score: 70
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index c2384ce223..2baabc0834 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -52,11 +52,14 @@ tags:
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - awsRegion
-  - eventName
   - eventSource
-  - src_ip
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
   - user
   - userName
+  - src_ip
   risk_score: 7
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index 8ec3306777..755368af77 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -51,11 +51,14 @@ tags:
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - awsRegion
-  - eventName
   - eventSource
-  - src_ip
+  - eventName
+  - responseElements.imageScanFindings.findings{}
+  - awsRegion
+  - requestParameters.imageId.imageDigest
+  - requestParameters.repositoryName
   - user
   - userName
+  - src_ip
   risk_score: 21
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
index 38e9557691..e64f1de95b 100644
--- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
@@ -53,11 +53,14 @@ tags:
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - awsRegion
-  - eventName
   - eventSource
-  - src_ip
+  - eventName
+  - awsRegion
+  - requestParameters.imageTag
+  - requestParameters.registryId
+  - requestParameters.repositoryName
   - user
   - userName
+  - src_ip
   risk_score: 49
   security_domain: network
diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
index 1184ce0a0d..82d4fd850e 100644
--- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml
+++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
@@ -53,11 +53,14 @@ tags:
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - awsRegion
-  - eventName
   - eventSource
-  - src_ip
+  - eventName
+  - awsRegion
+  - requestParameters.imageTag
+  - requestParameters.registryId
+  - requestParameters.repositoryName
   - user
   - userName
+  - src_ip
   risk_score: 49
   security_domain: network
diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 5726014cc5..690360f6f2 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -62,8 +62,9 @@ tags:
   - _time
   - eventName
   - src
-  - user
   - userAgent
+  - user
+  - userIdentity.arn
   risk_object: src
   risk_object_type: system
   risk_score: 18
diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
index 684b0a2f7d..fce7e3c4ed 100644
--- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml
+++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
@@ -56,10 +56,11 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
-  - errorCode
   - eventName
   - eventSource
   - userAgent
+  - errorCode
+  - userIdentity.type
   risk_object: src_ip
   risk_object_type: system
   risk_score: 10
diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
index f65d9bf2fd..10c379a951 100644
--- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
@@ -63,8 +63,9 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.policyName
   risk_score: 28
   security_domain: access
diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml
index a660da48aa..88f7e99926 100644
--- a/detections/cloud/aws_iam_delete_policy.yml
+++ b/detections/cloud/aws_iam_delete_policy.yml
@@ -60,8 +60,9 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.policyArn
   risk_score: 10
   security_domain: access
diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml
index 1d1c542886..efbceee4a2 100644
--- a/detections/cloud/aws_iam_failure_group_deletion.yml
+++ b/detections/cloud/aws_iam_failure_group_deletion.yml
@@ -63,8 +63,9 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.groupName
   risk_score: 5
   security_domain: cloud
diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml
index 1151093bf2..c39a47fc4d 100644
--- a/detections/cloud/aws_iam_successful_group_deletion.yml
+++ b/detections/cloud/aws_iam_successful_group_deletion.yml
@@ -63,8 +63,9 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.groupName
   risk_score: 5
   security_domain: cloud
diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml
index e66938e559..af5ab9bcdd 100644
--- a/detections/cloud/aws_lambda_updatefunctioncode.yml
+++ b/detections/cloud/aws_lambda_updatefunctioncode.yml
@@ -61,7 +61,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
+  - userAgent
+  - errorCode
   risk_score: 63
   security_domain: cloud
diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
index 68831ab3fc..028c55621a 100644
--- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
@@ -71,7 +71,14 @@ tags:
   required_fields:
   - _time
   - eventName
-  - userAgent
+  - requestParameters.ruleAction
+  - requestParameters.egress
+  - requestParameters.aclProtocol
+  - requestParameters.portRange.to
+  - requestParameters.portRange.from
+  - requestParameters.cidrBlock
   - userName
+  - userIdentity.principalId
+  - userAgent
   risk_score: 48
   security_domain: network
diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml
index 87e690e8e6..5a09c419bf 100644
--- a/detections/cloud/aws_network_access_control_list_deleted.yml
+++ b/detections/cloud/aws_network_access_control_list_deleted.yml
@@ -62,8 +62,10 @@ tags:
   required_fields:
   - _time
   - eventName
+  - requestParameters.egress
+  - userName
+  - userIdentity.principalId
   - src
   - userAgent
-  - userName
   risk_score: 5
   security_domain: network
diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
index d97a41e36f..0610fb3962 100644
--- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
@@ -63,7 +63,11 @@ tags:
   required_fields:
   - _time
   - eventName
+  - requestParameters.principalArn
+  - requestParameters.roleArn
+  - requestParameters.roleSessionName
   - recipientAccountId
+  - responseElements.issuer
   - sourceIPAddress
   - userAgent
   risk_score: 64
diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml
index d08e2e54a5..b9f00c6653 100644
--- a/detections/cloud/aws_saml_update_identity_provider.yml
+++ b/detections/cloud/aws_saml_update_identity_provider.yml
@@ -59,6 +59,10 @@ tags:
   - _time
   - eventName
   - eventType
+  - requestParameters.sAMLProviderArn
+  - userIdentity.sessionContext.sessionIssuer.arn
   - sourceIPAddress
+  - userIdentity.accessKeyId
+  - userIdentity.principalId
   risk_score: 64
   security_domain: threat
diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml
index 5981e95073..6f90e57391 100644
--- a/detections/cloud/aws_setdefaultpolicyversion.yml
+++ b/detections/cloud/aws_setdefaultpolicyversion.yml
@@ -66,9 +66,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
-  - eventSource
   - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
   risk_score: 30
   security_domain: threat
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index f5c8ba57a8..0c7fd9c7b2 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -60,8 +60,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - errorCode
   - eventName
   - userAgent
+  - errorCode
+  - requestParameters.userName
   risk_score: 30
   security_domain: threat
diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml
index cd9eef026d..53814e0f32 100644
--- a/detections/cloud/circle_ci_disable_security_job.yml
+++ b/detections/cloud/circle_ci_disable_security_job.yml
@@ -47,6 +47,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields: []
+  required_fields:
+  - _times
   risk_score: 72
   security_domain: network
diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml
index de6eec9a16..38af4b677a 100644
--- a/detections/cloud/circle_ci_disable_security_step.yml
+++ b/detections/cloud/circle_ci_disable_security_step.yml
@@ -47,6 +47,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields: []
+  required_fields:
+  - _times
   risk_score: 72
   security_domain: network
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index c527c1593d..b8ec68216c 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -5,7 +5,7 @@ date: '2020-09-04'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for new commands from each user role.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
@@ -60,12 +60,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.command
-  - Change.All_Changes.object
-  - Change.All_Changes.status
-  - Change.All_Changes.user
-  - Change.All_Changes.user_type
   - _time
+  - All_Changes.user
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.command
+  - All_Changes.object
   risk_score: 36
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
index 401c02cac1..6caa388503 100644
--- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
@@ -5,7 +5,7 @@ date: '2021-07-13'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud compute instances created by users who have
   not created them before.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
@@ -62,11 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.object
-  - Change.All_Changes.user
-  - Change.All_Changes.vendor_region
   - _time
+  - All_Changes.object
+  - All_Changes.action
+  - All_Changes.user
+  - All_Changes.vendor_region
   risk_score: 18
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
index eb374abef1..c963597bcb 100644
--- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
@@ -5,18 +5,18 @@ date: '2020-09-02'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks at cloud-infrastructure events where an instance is
   created in any region within the last hour and then compares it to a lookup file
   of previously seen regions where instances have been created.
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
-  by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")`
-  | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW
-  firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
-  enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
-  OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user,
-  dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`'
+  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region,
+  All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
+  vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
+  max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)
+  | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(),
+  "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
+  | `cloud_compute_instance_created_in_previously_unused_region_filter`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
   to build the initial table of images observed and times. You must also enable the
@@ -67,11 +67,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.object_id
-  - Change.All_Changes.user
-  - Change.All_Changes.vendor_region
   - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.vendor_region
+  - All_Changes.user
   risk_score: 42
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
index 16c81db993..5b4851a0ae 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2018-10-12'
 author: David Dorsey, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Change
 description: This search looks for cloud compute instances being created with previously
   unseen image IDs.
 search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
@@ -62,6 +63,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.image_id
+  - All_Changes.user
   risk_score: 36
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index f84b8965a7..1498019242 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-09-12'
 author: David Dorsey, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Change
 description: Find EC2 instances being created with previously unseen instance types.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
   as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
@@ -62,6 +63,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.instance_type
+  - All_Changes.user
   risk_score: 30
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
index 64a28f125c..5bf2246bf0 100644
--- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
@@ -5,7 +5,7 @@ date: '2020-07-29'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud instances being modified by users who have
   not previously modified them.
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
@@ -62,13 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.change_type
-  - Change.All_Changes.command
-  - Change.All_Changes.object_id
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.object_id
+  - All_Changes.command
+  - All_Changes.action
+  - All_Changes.change_type
+  - All_Changes.status
+  - All_Changes.user
   risk_score: 42
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
index 5d8602e23a..0cf7d9894d 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
@@ -5,7 +5,7 @@ date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
   cities. Provisioning activities are defined broadly as any event that runs or creates
   something.
@@ -81,13 +81,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.command
-  - Change.All_Changes.object
-  - Change.All_Changes.src
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_score: 18
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
index e557d6ba57..dbb77c2335 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
@@ -5,7 +5,7 @@ date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
   countries. Provisioning activities are defined broadly as any event that runs or
   creates something.
@@ -81,13 +81,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.command
-  - Change.All_Changes.object
-  - Change.All_Changes.src
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
index 96fe8ed2f5..5c86c14cb0 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
@@ -5,14 +5,14 @@ date: '2020-08-16'
 author: Rico Valdez, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
   IP addresses. Provisioning activities are defined broadly as any event that runs
   or creates something.
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
-  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
-  OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
-  All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
+  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
+  All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command
+  | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
   src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
   | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
   OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
@@ -80,13 +80,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.command
-  - Change.All_Changes.object_id
-  - Change.All_Changes.src
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
index ffaa76a33a..48456c0769 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
@@ -5,7 +5,7 @@ date: '2020-08-16'
 author: Rico Valdez, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search looks for cloud provisioning activities from previously unseen
   regions. Provisioning activities are defined broadly as any event that runs or creates
   something.
@@ -81,13 +81,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.action
-  - Change.All_Changes.command
-  - Change.All_Changes.object
-  - Change.All_Changes.src
-  - Change.All_Changes.status
-  - Change.All_Changes.user
   - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index 3c8f045e3d..b3f286b339 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -5,7 +5,7 @@ date: '2020-05-28'
 author: Rico Valdez, Splunk
 type: Hunting
 datamodel:
-- Authentication.Authentication
+- Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
@@ -62,8 +62,8 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Authentication.Authentication.signature
-  - Authentication.Authentication.user
   - _time
+  - Authentication.signature
+  - Authentication.user
   risk_score: 30
   security_domain: threat
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index 6baaa7ce05..e1604415d7 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication.Authentication
+- Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
@@ -71,9 +71,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Authentication.Authentication.signature
-  - Authentication.Authentication.src
-  - Authentication.Authentication.user
   - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_score: 18
   security_domain: threat
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 8e859915e3..f017005eef 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication.Authentication
+- Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
@@ -71,9 +71,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Authentication.Authentication.signature
-  - Authentication.Authentication.src
-  - Authentication.Authentication.user
   - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_score: 42
   security_domain: threat
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index 4442bdd943..ef02104408 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -5,7 +5,7 @@ date: '2020-10-07'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Authentication.Authentication
+- Authentication
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
@@ -71,9 +71,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Authentication.Authentication.signature
-  - Authentication.Authentication.src
-  - Authentication.Authentication.user
   - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_score: 36
   security_domain: threat
diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml
index ae0f045832..2cf1e5d425 100644
--- a/detections/cloud/detect_new_open_s3_buckets.yml
+++ b/detections/cloud/detect_new_open_s3_buckets.yml
@@ -64,11 +64,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - eventName
   - eventSource
-  - permission
-  - uri
-  - userAgent
+  - eventName
+  - requestParameters.bucketName
   - user_arn
+  - userIdentity.principalId
+  - userAgent
+  - uri
+  - permission
   risk_score: 48
   security_domain: threat
diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
index 5f40339495..95fec6af8a 100644
--- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
@@ -68,9 +68,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - bucketName
-  - eventName
   - eventSource
+  - eventName
+  - requestParameters.accessControlList.x-amz-grant-read-acp
+  - requestParameters.accessControlList.x-amz-grant-write
+  - requestParameters.accessControlList.x-amz-grant-write-acp
+  - requestParameters.accessControlList.x-amz-grant-full-control
+  - requestParameters.bucketName
+  - userIdentity.userName
+  - userIdentity.principalId
   - userAgent
+  - bucketName
   risk_score: 48
   security_domain: threat
diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml
index fbb3b4d6b9..e297f4c0d5 100644
--- a/detections/cloud/detect_shared_ec2_snapshot.yml
+++ b/detections/cloud/detect_shared_ec2_snapshot.yml
@@ -62,11 +62,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - aws_account_id
   - eventName
-  - src_ip
-  - user_agent
   - user_arn
+  - src_ip
+  - requestParameters.attributeType
+  - aws_account_id
   - vendor_region
+  - user_agent
   risk_score: 48
   security_domain: threat
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index 3c177468f1..db578d529d 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -48,12 +48,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
+  - Resources{}.Type
   - Title
   - Types{}
-  - _time
-  - dest
-  - severity
   - vendor_account
   - vendor_region
+  - severity
+  - dest
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml
index 0c9555ba56..0ac8b391b0 100644
--- a/detections/cloud/github_dependabot_alert.yml
+++ b/detections/cloud/github_dependabot_alert.yml
@@ -50,6 +50,16 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
+  - alert.id
+  - repository.full_name
+  - repository.html_url
   - action
+  - alert.affected_package_name
+  - alert.affected_range
+  - alert.created_at
+  - alert.external_identifier
+  - alert.external_reference
+  - alert.fixed_in
+  - alert.severity
   risk_score: 27
   security_domain: network
diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml
index e1cc6f1814..82025ef1a6 100644
--- a/detections/cloud/github_pull_request_from_unknown_user.yml
+++ b/detections/cloud/github_pull_request_from_unknown_user.yml
@@ -48,6 +48,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields: []
+  required_fields:
+  - _time
+  - alert.id
+  - repository.full_name
+  - repository.html_url
+  - action
+  - alert.affected_package_name
+  - alert.affected_range
+  - alert.created_at
+  - alert.external_identifier
+  - alert.external_reference
+  - alert.fixed_in
+  - alert.severity
   risk_score: 27
   security_domain: network
diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml
index 2dafc2f6f8..04a38dc077 100644
--- a/detections/cloud/gsuite_drive_share_in_external_email.yml
+++ b/detections/cloud/gsuite_drive_share_in_external_email.yml
@@ -60,8 +60,12 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
+  - parameters.doc_title
+  - src_domain
   - dest_domain
   - email
-  - src_domain
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
   risk_score: 72
   security_domain: endpoint
diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml
index 7cd945a00f..9c9133fe0b 100644
--- a/detections/cloud/gsuite_email_suspicious_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_attachment.yml
@@ -58,8 +58,13 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
+  - attachment{}.file_extension_type
+  - attachment{}.sha256
+  - destination{}.service
   - num_message_attachments
   - payload_size
   - subject
+  - destination{}.address
+  - source.address
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
index a5dfc2d571..b65fe208be 100644
--- a/detections/cloud/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -65,7 +65,12 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
+  - parameters.doc_title
+  - src_domain
   - dest_domain
   - email
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
   risk_score: 21
   security_domain: endpoint
diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml
index dca89a3004..cd76a25d77 100644
--- a/detections/cloud/kubernetes_scanner_image_pulling.yml
+++ b/detections/cloud/kubernetes_scanner_image_pulling.yml
@@ -47,6 +47,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields: []
+  required_fields:
+  - object.message
+  - source.host
+  - object.involvedObject.name
+  - object.involvedObject.namespace
+  - object.involvedObject.kind
+  - object.message
+  - object.reason
   risk_score: 81
   security_domain: network
diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
index 53c95353e6..731f801395 100644
--- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml
+++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
@@ -61,11 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ActorIpAddress
-  - Operation
-  - ResultStatus
-  - Workload
   - _time
+  - Workload
+  - Operation
+  - Actor{}.ID
+  - Actor{}.Type
+  - ActorIpAddress
   - dest
+  - ResultStatus
   risk_score: 18
   security_domain: threat
diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml
index 2bc704ace6..08efdec24d 100644
--- a/detections/cloud/o365_added_service_principal.yml
+++ b/detections/cloud/o365_added_service_principal.yml
@@ -60,8 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ActorIpAddress
-  - Workload
   - _time
+  - Workload
+  - signature
+  - Actor{}.ID
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - Target{}.ID
+  - ActorIpAddress
   risk_score: 42
   security_domain: threat
diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
index 7e22c1899e..aaee2fa67e 100644
--- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -62,10 +62,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - action
-  - status
+  - signature
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - ModifiedProperties{}.OldValue
   - user
-  - user_id
   - vendor_account
+  - status
+  - user_id
+  - action
   risk_score: 42
   security_domain: threat
diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml
index 4b68714a8e..3a7ef5e300 100644
--- a/detections/cloud/o365_disable_mfa.yml
+++ b/detections/cloud/o365_disable_mfa.yml
@@ -53,9 +53,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Operation
-  - ResultStatus
-  - UserType
   - _time
+  - Operation
+  - UserType
+  - user
+  - status
+  - signature
+  - dest
+  - ResultStatus
   risk_score: 64
   security_domain: threat
diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml
index 0ad97dd812..7a416e6f60 100644
--- a/detections/cloud/o365_new_federated_domain_added.yml
+++ b/detections/cloud/o365_new_federated_domain_added.yml
@@ -60,13 +60,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ObjectId
+  - _time
+  - Workload
   - Operation
+  - Parameters{}.Value
+  - ObjectId
   - OrganizationName
   - OriginatingServer
   - UserId
   - UserKey
-  - Workload
-  - _time
   risk_score: 64
   security_domain: threat
diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
index 32a7a3ccbb..71a2f82616 100644
--- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
@@ -5,7 +5,7 @@ date: '2021-08-17'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious 7z process with commandline pointing
   to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
   to archive a sensitive files and place it in network share tmp folder. This search
@@ -59,15 +59,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 7849e9c8bf..f5c8857b30 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this search is to detect a potential account discovery series of command
   used by several malware or attack to recon the target machine. This technique is
   also seen in some note worthy malware like trickbot where it runs a cmd process,
@@ -66,14 +66,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 5
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml
index dae2e86ad4..86071ff0f0 100644
--- a/detections/endpoint/active_setup_registry_autostart.yml
+++ b/detections/endpoint/active_setup_registry_autostart.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of the active setup
   registry for persistence and privilege escalation. This technique was seen in several
   malware (poisonIvy), adware and APT to gain persistence to the compromised machine
@@ -69,20 +68,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
index bdd0483628..52aae5c92b 100644
--- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to detect a suspicious registry modification to implement
   auto admin logon to a host. This technique was seen in BlackMatter ransomware to
   automatically logon to the compromise host after  triggering a safemode boot to
@@ -63,21 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
index bc069d2d73..be1e38c53e 100644
--- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
@@ -5,7 +5,7 @@ date: '2021-11-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify a suspicious process command-line related
   to Windows Defender exclusion feature. This command is abused by adversaries, malware
   authors and red teams to bypass Windows Defender Antivirus products by excluding
@@ -62,16 +62,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index 705328403e..41bc3e37ff 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -5,7 +5,7 @@ date: '2021-06-23'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious modification of firewall to allow
   file and printer sharing. This technique was seen in ransomware to be able to discover
   more machine connected to the compromised host to encrypt more files
@@ -42,16 +42,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
index cd8739451a..10d10e646c 100644
--- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic detects a potential suspicious modification of firewall
   rule registry allowing inbound traffic in specific port with public profile. This
   technique was identified when an adversary wants to grant remote access to a machine
@@ -67,21 +66,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.dest
+  - Registry.user
   risk_score: 3
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index 0a90b9f6df..644a57103f 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic identifies suspicious PowerShell command to allow
   inbound traffic inbound to a specific local port within the public profile. This
   technique was seen in some attacker want to have a remote access to a machine by
diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index affb67c552..87fcccb2b4 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -5,7 +5,7 @@ date: '2021-06-23'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious modification to the firewall to
   allow network discovery on a machine. This technique was seen in couple of ransomware
   (revil, reddot) to discover other machine connected to the compromised host to encrypt
@@ -44,16 +44,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml
index 185d4c1075..06d6b5dcc7 100644
--- a/detections/endpoint/allow_operation_with_consent_admin.yml
+++ b/detections/endpoint/allow_operation_with_consent_admin.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic identifies a potential privilege escalation attempt to
   perform malicious task. This registry modification is designed to allow the `Consent
   Admin` to perform an operation that requires elevation without consent or credentials.
@@ -68,21 +67,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml
index 8807ff0180..481f9a8198 100644
--- a/detections/endpoint/anomalous_usage_of_7zip.yml
+++ b/detections/endpoint/anomalous_usage_of_7zip.yml
@@ -5,7 +5,7 @@ date: '2021-04-22'
 author: Michael Haag, Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
   or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
   It has been observed where an adversary will rename `7z.exe`. Additional coverage
@@ -70,15 +70,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 1e3780936e..ea941bfa39 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -5,7 +5,7 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadFile` method. This particular method is utilized in many different
   PowerShell frameworks to download files and output to disk. Identify the source
@@ -74,15 +74,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index f21bb0ca46..0b89645de4 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -5,7 +5,7 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadString` method. This particular method is utilized in many different
   PowerShell frameworks to download files and output to disk. Identify the source
@@ -68,15 +68,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml
index 9a97267731..f29439bb45 100644
--- a/detections/endpoint/attacker_tools_on_endpoint.yml
+++ b/detections/endpoint/attacker_tools_on_endpoint.yml
@@ -5,7 +5,7 @@ date: '2021-11-04'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for execution of commonly used attacker tools on an
   endpoint.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -80,11 +80,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
index 5db06960d5..7c871d858f 100644
--- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Attempt To Add Certificate To Untrusted Store
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
@@ -73,14 +73,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index 57c9dbf4d1..4e742ebb72 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for attempts to stop security-related services on the
   endpoint.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -78,15 +78,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 20
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index 53b660b73b..da30681035 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Monitor for execution of reg.exe with parameters specifying an export
   of keys that contain hashed credentials that attackers may try to crack offline.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -72,15 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml
index fc224895c7..7041013f6a 100644
--- a/detections/endpoint/auto_admin_logon_registry_entry.yml
+++ b/detections/endpoint/auto_admin_logon_registry_entry.yml
@@ -5,8 +5,7 @@ date: '2020-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to detect a suspicious registry modification to implement
   auto admin logon to a host. This technique was seen in BlackMatter ransomware to
   automatically logon to the compromise host after  triggering a safemode boot to
@@ -63,21 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 05379ffc90..6461f64403 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -5,8 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: The search looks for a batch file (.bat) written to the Windows system
   directory tree.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
@@ -74,14 +73,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
index 70babdaa80..4bc260d08d 100644
--- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
@@ -5,7 +5,7 @@ date: '2021-09-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host from safe mode back to normal boot configuration. This technique was seen
   in blackMatter ransomware where it force the compromised host to boot in safe mode
@@ -56,12 +56,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml
index c99acb8bd1..fd4eacf029 100644
--- a/detections/endpoint/bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml
@@ -5,7 +5,7 @@ date: '2020-12-21'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for flags passed to bcdedit.exe modifications to the
   built-in Windows error recovery boot configurations. This is typically used by ransomware
   to prevent recovery.
@@ -67,12 +67,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 61c7ddc760..1f32249fd9 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
   The query identifies the parameters used to create, resume or add a file to a BITS
@@ -72,15 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index 2533b4c300..740f549f79 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
   object. In addition, look for `download` or `upload` on the command-line, the switches
@@ -78,15 +78,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 7e83ed3032..091aa6f61e 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -5,7 +5,7 @@ date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index baacde78a3..aa671b6eb9 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -5,7 +5,7 @@ date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -71,15 +71,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index 078144cc1b..45ba783055 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -5,7 +5,7 @@ date: '2021-01-26'
 author: Rod Soto, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for arguments to certutil.exe indicating the manipulation
   or extraction of Certificate. This certificate can then be used to sign new authentication
   tokens specially inside Federated environments such as Windows ADFS.
@@ -60,14 +60,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index 1db0d158f0..9a0cfa8f5d 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -5,7 +5,7 @@ date: '2021-03-23'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
   and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
   and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
@@ -71,14 +71,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 40
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml
index 74e0977ad0..282c29c085 100644
--- a/detections/endpoint/change_default_file_association.yml
+++ b/detections/endpoint/change_default_file_association.yml
@@ -5,7 +5,7 @@ date: '2021-09-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: This analytic is developed to detect suspicious registry modification
   to change the default file association of windows to malicious payload. This techninique
   was seen in some APT where it modify the default process to run file association,
@@ -58,12 +58,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml
index c696c951ba..90f758f46d 100644
--- a/detections/endpoint/change_to_safe_mode_with_network_config.yml
+++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml
@@ -5,7 +5,7 @@ date: '2021-09-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host to boot in safe mode with network config. This technique was seen in blackMatter
   ransomware where it force the compromised host to boot in safe mode to continue
@@ -55,12 +55,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml
index 277954819b..dabadf67ed 100644
--- a/detections/endpoint/chcp_command_execution.yml
+++ b/detections/endpoint/chcp_command_execution.yml
@@ -5,7 +5,7 @@ date: '2021-07-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect execution of chcp.exe application. this utility
   is used to change the active code page of the console. This technique was seen in
   icedid malware to know the locale region/language/country of the compromise host.
@@ -55,22 +55,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
-  - dest
-  - parent_process
-  - parent_process_id
-  - parent_process_name
-  - process
-  - process_id
   - process_name
+  - process
+  - parent_process_name
+  - parent_process
+  - process_id
+  - parent_process_id
+  - dest
   - user
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml
index fac623301b..20d3b7f612 100644
--- a/detections/endpoint/check_elevated_cmd_using_whoami.yml
+++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml
@@ -5,7 +5,7 @@ date: '2021-09-15'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious whoami execution to check if the
   cmd or shell instance process is with elevated privileges. This technique was seen
   in FIN7 js implant where it execute this as part of its data collection to the infected
@@ -55,14 +55,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
index da0ddcdd31..5f95a83096 100644
--- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this search is to detect execution of `cipher.exe` to clear the unallocated
   sectors of a specific disk. This technique was seen in some ransomware to make it
   impossible to forensically recover deleted files.
@@ -63,15 +63,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml
index a4005492b7..ea8701cc6e 100644
--- a/detections/endpoint/clop_common_exec_parameter.yml
+++ b/detections/endpoint/clop_common_exec_parameter.yml
@@ -5,7 +5,7 @@ date: '2021-03-17'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytics are designed to identifies some CLOP ransomware
   variant that using arguments to execute its main code or feature of its code. In
   this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files
@@ -67,15 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 100
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml
index 656e59ed24..3fd889e83f 100644
--- a/detections/endpoint/clop_ransomware_known_service_name.yml
+++ b/detections/endpoint/clop_ransomware_known_service_name.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-03-17'
 author: Teoderick Contreras
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This detection is to identify the common service name created by the
   CLOP ransomware as part of its persistence and high privilege code execution in
   the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API
@@ -60,6 +61,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - EventCode
+  - cmdline
   - _time
+  - parent_process_name
+  - process_name
+  - OriginalFileName
+  - process_path
   risk_score: 100
   security_domain: endpoint
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index e9993abfb0..da15eb4ccf 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -5,7 +5,7 @@ date: '2022-01-18'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies command-line arguments where `cmd.exe
   /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and
   terminate after command or process completion. This technique is commonly seen in
@@ -65,14 +65,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index 3cc8204c11..d2e19bae02 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -5,7 +5,7 @@ date: '2021-05-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies a common behavior by Cobalt Strike and other
   frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
   Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
index 0428335f2f..ca1384fc22 100644
--- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a non-standard parent process (not
   matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
   This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
@@ -73,15 +73,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
index 49b2d5f521..c14995c3de 100644
--- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-13'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic detects a potential process using COM Object like CMLUA
   or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries
   to gain administrative privileges to its running process.
diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index a9f5edb481..8c69dd4cfa 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The search looks for file modifications with extensions commonly used
   by Ransomware
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -81,10 +81,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml
index 33c53658f0..c685c5bc5e 100644
--- a/detections/endpoint/common_ransomware_notes.yml
+++ b/detections/endpoint/common_ransomware_notes.yml
@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The search looks for files created with names matching those typically
   used in ransomware notes that tell the victim how to get their data back.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -66,10 +66,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml
index a778a3ce11..5512203ac6 100644
--- a/detections/endpoint/conti_common_exec_parameter.yml
+++ b/detections/endpoint/conti_common_exec_parameter.yml
@@ -5,7 +5,7 @@ date: '2021-06-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search detects the suspicious commandline argument of revil ransomware
   to encrypt specific or all local drive and network shares of the compromised machine
   or host.
@@ -64,15 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
index a3dce58f7e..13e215abb1 100644
--- a/detections/endpoint/control_loading_from_world_writable_directory.yml
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies control.exe loading either a .cpl
   or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
   review parallel processes, parent and child, for further suspicious behaviors. In
@@ -73,14 +73,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 4d51b47fef..ca3390c2f4 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for the creation of local administrator accounts using
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
@@ -72,12 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index bcf8b0653c..af27466036 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -5,7 +5,7 @@ date: '2020-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for the creation or deletion of hidden shares using
   net.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
@@ -69,13 +69,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml
index a6c4440b66..b3d17dfb23 100644
--- a/detections/endpoint/create_remote_thread_in_shell_application.yml
+++ b/detections/endpoint/create_remote_thread_in_shell_application.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-08-04'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect suspicious process injection in command shell.
   This technique was seen in IcedID where it execute cmd.exe process to inject its
   shellcode as part of its execution as banking trojan. It is really uncommon to have
diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index 68f784e043..bc3f53bc27 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -5,7 +5,7 @@ date: '2019-12-10'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -70,14 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 2789eb7ed3..52b61c246c 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search detects the use of wmic and Powershell to create a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -68,12 +68,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index c21294dbab..982bb93c5f 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search detects credential dumping using copy command from a shadow
   copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index ae901f61b8..e7e11cc09c 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search detects the creation of a symlink to a shadow copy.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*
@@ -68,15 +68,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml
index bbda130b6e..416939c42f 100644
--- a/detections/endpoint/csc_net_on_the_fly_compilation.yml
+++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this analytic is to detect a suspicious compile before delivery approach
   of .net compiler csc.exe. This technique was seen in several adversaries, malware
   and even in red teams to take advantage the csc.exe .net compiler tool to compile
@@ -59,14 +59,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml
index d964910004..fc436a3232 100644
--- a/detections/endpoint/curl_download_and_bash_execution.yml
+++ b/detections/endpoint/curl_download_and_bash_execution.yml
@@ -5,7 +5,7 @@ date: '2021-12-10'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of curl on Linux or MacOS attempting
   to download a file from a remote source and pipe it to bash. This is typically found
   with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
@@ -64,13 +64,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 5236e44d89..7349f7bf96 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-12'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This following analytic detects PowerShell command to delete shadow copy
   using the WMIC PowerShell module. This technique was seen used by a recent adversary
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml
index ed381b1602..4e4527f998 100644
--- a/detections/endpoint/deleting_of_net_users.yml
+++ b/detections/endpoint/deleting_of_net_users.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -67,15 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index c1ff22be12..99741805d5 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -5,7 +5,7 @@ date: '2020-11-09'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
   Service.  Wmic is an interface to the Windows Management Instrumentation.  This
   search looks for either of these tools being used to delete shadow copies.
@@ -74,13 +74,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
index b637cbbc66..2c4baed941 100644
--- a/detections/endpoint/detect_azurehound_command_line_arguments.yml
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the common command-line argument used
   by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
   be modified, but these changes are dependent upon the operator. In most instances
@@ -70,14 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml
index 605ec25240..3b77169959 100644
--- a/detections/endpoint/detect_azurehound_file_modifications.yml
+++ b/detections/endpoint/detect_azurehound_file_modifications.yml
@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The following analytic is similar to SharpHound file modifications, but
   this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
   equivilent but for Azure. It's possible this may never be seen in an environment
@@ -69,16 +69,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_id
   - _time
-  - dest
-  - file_create_time
-  - file_name
   - file_path
+  - dest
+  - file_name
   - process_id
+  - file_create_time
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index a25adfa1a9..6f4faf640f 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
-- Change.All_Changes
+- Change
 description: This search detects user accounts that have been locked out a relatively
   high number of times in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -56,9 +56,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.result
-  - Change.All_Changes.user
   - _time
+  - All_Changes.result
   - nodename
+  - All_Changes.user
   risk_score: 36
   security_domain: access
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 026154ae8e..5795b04f12 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -5,8 +5,7 @@ date: '2021-10-05'
 author: Michael Haag, Shannon Davis, David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: 'The following query identifies suspicious .aspx created in 3 paths identified
   by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
   group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
@@ -87,14 +86,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index cfdd7915e8..12d0f3ca29 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -79,14 +79,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml
index 658e64d866..ec49b6d6db 100644
--- a/detections/endpoint/detect_html_help_spawn_child_process.yml
+++ b/detections/endpoint/detect_html_help_spawn_child_process.yml
@@ -5,7 +5,7 @@ date: '2021-02-11'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) that spawns a child process. This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -80,15 +80,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index 967a7c64c7..4714a277ec 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file from a remote url. This particular technique will load Windows
   script code from a compiled help file. CHM files may  contain nearly any file type
@@ -84,15 +84,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 0b76b8aa16..1b6c30f710 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
   will load Windows script code from a compiled help file, using InfoTech Storage
@@ -81,14 +81,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
index 1576507d42..6617f7be17 100644
--- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml
+++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
@@ -74,10 +74,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
+  - _time
   - EventCode
-  - Image
   - ImageLoaded
   - ProcessId
+  - Computer
+  - Image
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 24ef9dab70..499ad568b5 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Bhavin Patel, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies "mshta.exe" execution with inline protocol
   handlers. "JavaScript", "VBScript", and "About" are the only supported options when
   invoking HTA content directly on the command-line. The search will return the first
@@ -76,14 +76,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 784187aedd..a67750f930 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies renamed instances of mshta.exe executing.
   Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta
@@ -73,14 +73,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 8f4a408656..180b73585e 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
   utility is used to make remote http connections. Adversaries may use mshta.exe to
   proxy the download and execution of remote .hta files. The analytic identifies command
@@ -77,14 +77,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
index cbaa669688..cd4be52fb9 100644
--- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
@@ -5,7 +5,7 @@ date: '2020-07-03'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The detection Detect Path Interception By Creation Of program exe is
   detecting the abuse of unquoted service paths, which is a popular technique for
   privilege escalation. '
@@ -71,12 +71,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
index 7694145c6b..fc25eaa2bc 100644
--- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
@@ -5,7 +5,7 @@ date: '2020-11-10'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for fast execution of processes used for system network
   configuration discovery on the endpoint.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -74,12 +74,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 32
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
index 4354104a07..0118aefed2 100644
--- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -5,7 +5,7 @@ date: '2020-11-10'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for executions of cmd.exe spawned by a process that
   is often abused by attackers and that does not typically launch cmd.exe.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -75,12 +75,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 0b7bfc88ad..226b47f814 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for events where `PsExec.exe` is run with the `accepteula`
   flag in the command line. PsExec is a built-in Windows utility that enables you
   to execute processes on other systems. It is fully interactive for console applications.
@@ -80,14 +80,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml
index 99b8526181..5e172ae5d8 100644
--- a/detections/endpoint/detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/detect_rclone_command_line_usage.yml
@@ -5,7 +5,7 @@ date: '2021-11-29'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies commonly used command-line arguments used by
   `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
   specific to the configuration used by adversaries. In particular, an adversary may
@@ -73,14 +73,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.original_file_name
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
index cc17d164b8..d7c71727dc 100644
--- a/detections/endpoint/detect_regasm_spawning_a_process.yml
+++ b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -5,7 +5,7 @@ date: '2021-02-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies regasm.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
@@ -77,15 +77,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index 1f5e663751..ad5797a361 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -72,12 +72,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
-  - EventID
   - _time
+  - EventID
   - dest_ip
   - process_name
-  - src_ip
+  - Computer
   - user
+  - src_ip
+  - dest_host
+  - dest_ip
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index 499be5ef39..258427a5e9 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies regasm.exe with no command line arguments.
   This particular behavior occurs when another process injects into regasm.exe, no
   command line arguments will be present. During investigation, identify any network
@@ -75,13 +75,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
index 05436ab079..cc9286fe4a 100644
--- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml
+++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
@@ -5,7 +5,7 @@ date: '2021-02-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies regsvcs.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
@@ -75,15 +75,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 85645a703d..c92572151b 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -72,12 +72,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
-  - EventID
   - _time
+  - EventID
   - dest_ip
   - process_name
-  - src_ip
+  - Computer
   - user
+  - src_ip
+  - dest_host
   risk_score: 80
   security_domain: Endpoint
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 62e8fed65f..12558d8096 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies regsvcs.exe with no command line arguments.
   This particular behavior occurs when another process injects into regsvcs.exe, no
   command line arguments will be present. During investigation, identify any network
@@ -75,13 +75,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index 4acecf3722..a346085832 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -5,7 +5,7 @@ date: '2021-01-28'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
   Regsvr32.exe is a command-line program used to register and unregister object linking
   and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
@@ -82,15 +82,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index b8d583ea77..686669851d 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
   this stage of an attack, review parallel processes and file modifications for data
   that is staged or potentially have been exfiltrated. This analytic utilizes the
@@ -65,14 +65,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 3edb84f872..aae0bea823 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies renamed instances of `PsExec.exe` being
   utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
   or other SysInternal utility usage with the command-line argument of `-accepteula`.
@@ -73,14 +73,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index 20172280d5..c26cf9478a 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -4,8 +4,7 @@ version: 2
 date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel:
-- Endpoint.Processes
+datamodel: []
 description: The following analytic identifies the usage of `rclone.exe`, renamed,
   being used to exfiltrate data to a remote destination. RClone has been used by multiple
   ransomware groups to exfiltrate data. In many instances, it will be downloaded from
@@ -70,14 +69,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 615f50ff59..6cdad6b951 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
   In most cases, it is not common for WinRAR to be used renamed, however it is common
   to be installed by a third party application and executed from a non-standard path.
@@ -68,14 +68,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index a84893ec75..ea505ebdbf 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe loading advpack.dll and
   ieadvpack.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,
@@ -81,15 +81,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index 3eae993c71..1bd63ea426 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe loading setupapi.dll and
   iesetupapi.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,
@@ -79,15 +79,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index bd4e4c4043..5be793a4fb 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe loading syssetup.dll by
   calling the LaunchINFSection function on the command line. This particular technique
   will load script code from a file. Upon a successful execution, the following module
@@ -81,15 +81,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index b71b9f1963..0ce3298538 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -5,7 +5,7 @@ date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies "rundll32.exe" execution with inline
   protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
   options when invoking HTA content directly on the command-line. This type of behavior
@@ -67,14 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index 18fe14b925..c884eb7f88 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-06-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies common command-line arguments used
   by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
   function names may be modified, but these changes are dependent upon the operator.
@@ -61,14 +61,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index 5e3df344d3..f8b790df6d 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -5,7 +5,7 @@ date: '2021-05-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
   SharpHound will query the domain controller and begin gathering all the data related
   to the domain and trusts. For output, it will drop a .zip file upon completion following
@@ -75,16 +75,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_id
   - _time
-  - dest
-  - file_create_time
-  - file_name
   - file_path
+  - dest
+  - file_name
   - process_id
+  - file_create_time
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index fe1462e5a9..02400d37b8 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -5,7 +5,7 @@ date: '2021-05-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies SharpHound binary usage by using the
   original filena,e. In addition to renaming the PE, other coverage is available to
   detect command-line arguments. This particular analytic looks for the original_file_name
@@ -66,15 +66,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
index c1022cd652..b56f9aa201 100644
--- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for the execution of the cscript.exe or wscript.exe
   processes, with a parent of cmd.exe. The search will return the count, the first
   and last time this execution was seen on a machine, the user, and the destination
@@ -58,13 +58,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml
index 3b0c18f7de..9387e05324 100644
--- a/detections/endpoint/disable_amsi_through_registry.yml
+++ b/detections/endpoint/disable_amsi_through_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to identify modification in registry to disable AMSI windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
@@ -49,20 +48,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 8d03173a87..1561147480 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
@@ -63,20 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index d1d7181beb..dbfea7ede7 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the BlockAtFirstSeen feature where it block
@@ -62,20 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index e6d67a67ca..970291b826 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the Enhanced Notification feature wher user
@@ -62,20 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index c478a53084..370a57cfc1 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
@@ -63,20 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index 95a5e8bbe0..99325b43e3 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the spynet reporting for its telemetry.
@@ -61,20 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index 70c6cbbf75..725608f220 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: his analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the submit samples feature for further analysis..
@@ -61,20 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml
index 868806d19a..b29449cebb 100644
--- a/detections/endpoint/disable_etw_through_registry.yml
+++ b/detections/endpoint/disable_etw_through_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to identify modification in registry to disable ETW windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
@@ -48,20 +47,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml
index 7fe9cd03bc..42a6106f04 100644
--- a/detections/endpoint/disable_logs_using_wevtutil.yml
+++ b/detections/endpoint/disable_logs_using_wevtutil.yml
@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect execution of wevtutil.exe to disable logs. This
   technique was seen in several ransomware to disable the event logs to evade alerts
   and detections.
@@ -50,15 +50,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
   risk_score: 24
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index bd1e31e428..39f23f330c 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search identifies modification of registry to disable the regedit
   or registry tools of the windows operating system. Since registry tool is a swiss
   knife in analyzing registry, malware such as RAT or trojan Spy disable this application
@@ -61,20 +60,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 40
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index b3a0e0ce62..9a5bce2c78 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -5,7 +5,7 @@ date: '2021-10-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious commandline to disable existing
   schedule task. This technique is used by adversaries or commodity malware like IceID
   to disable security application (AV products) in the targetted host to evade detections.
@@ -53,13 +53,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml
index 25c7cee522..8ff1bc575c 100644
--- a/detections/endpoint/disable_security_logs_using_minint_registry.yml
+++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious registry modification to disable
   security audit logs. This technique was shared by a researcher to disable Security
   logs of windows by adding this registry. The Windows will think it is WinPE and
@@ -62,20 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index f0925a38ab..ced2b6bebf 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following analytic is to identify a modification in the Windows registry
   to prevent users from seeing all the files with hidden attributes. This event or
   techniques are known on some worm and trojan spy malware that will drop hidden files
@@ -64,19 +63,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_nam
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml
index 70a14acc92..a8f72f0663 100644
--- a/detections/endpoint/disable_uac_remote_restriction.yml
+++ b/detections/endpoint/disable_uac_remote_restriction.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of registry to disable
   UAC remote restriction. This technique was well documented in Microsoft page where
   attacker may modify this registry value to bypassed UAC feature of windows host.
@@ -66,20 +65,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index 8536f1aae6..e65a348ce7 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic detects a suspicious registry modification to disable Windows
   hotkey (shortcut keys) for native Windows applications. This technique is commonly
   used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
@@ -63,21 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
   risk_score: 40
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml
index c03c79cb4b..2117620028 100644
--- a/detections/endpoint/disable_windows_behavior_monitoring.yml
+++ b/detections/endpoint/disable_windows_behavior_monitoring.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
@@ -68,20 +67,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 40
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
index 1f0e1740f2..6f5fa6cbd7 100644
--- a/detections/endpoint/disable_windows_smartscreen_protection.yml
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following search identifies a modification of registry to disable
   the smartscreen protection of windows machine. This is windows feature provide an
   early warning system against website that might engage in phishing attack or malware
@@ -64,19 +63,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_nam
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
index d127d0c550..6352615096 100644
--- a/detections/endpoint/disabling_cmd_application.yml
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to identify modification in registry to disable cmd prompt
   application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
   or deleting there samples through cmd application which is one of the tool of analyst
@@ -65,21 +64,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
index c9b3a4f375..1e511acb0e 100644
--- a/detections/endpoint/disabling_controlpanel.yml
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -5,8 +5,7 @@ date: '2022-01-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: this search is to identify registry modification to disable control panel
   window. This technique is commonly seen in malware to prevent their artifacts ,
   persistence removed on the infected machine.
@@ -64,21 +63,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index 690a89fb5a..954a4147b9 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
@@ -64,20 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index c2a46c9cdd..dd4de0a3cd 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -5,7 +5,7 @@ date: '2021-03-31'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to identifies suspicious firewall disabling using netsh
   application. this technique is commonly seen in malware that tries to communicate
   or download its component or other payload to its C2 server.
@@ -57,15 +57,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
index 38e1fb45af..b55293c3ce 100644
--- a/detections/endpoint/disabling_folderoptions_windows_feature.yml
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to identify registry modification to disable folder options
   feature of windows to show hidden files, file extension and etc. This technique
   used by malware in combination if disabling show hidden files feature to hide their
@@ -66,20 +65,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml
index 2d5e0e4a74..c048edf698 100644
--- a/detections/endpoint/disabling_net_user_account.yml
+++ b/detections/endpoint/disabling_net_user_account.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify a suspicious command-line that disables a
   user account using the `net.exe` utility native to Windows. This technique may used
   by the adversaries to interrupt availability of such users to do their malicious
@@ -64,15 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
index 2397299a56..cf96acc806 100644
--- a/detections/endpoint/disabling_norun_windows_app.yml
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to identify modification of registry to disable run application
   in window start menu. this application is known to be a helpful shortcut to windows
   OS user to run known application and also to execute some reg or batch script. This
@@ -68,21 +67,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml
index fcd653f612..d0ea85b197 100644
--- a/detections/endpoint/disabling_remote_user_account_control.yml
+++ b/detections/endpoint/disabling_remote_user_account_control.yml
@@ -4,8 +4,7 @@ version: 4
 date: '2020-11-18'
 author: David Dorsey, Patrick Bareiss, Splunk
 type: TTP
-datamodel:
-- Endpoint.Registry
+datamodel: []
 description: The search looks for modifications to registry keys that control the
   enforcement of Windows User Account Control (UAC).
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -62,12 +61,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.action
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.registry_key_name
+  - Registry.user
+  - Registry.action
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index 0ad46ada60..02bf9ee4e6 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following search identifies the modification of registry related
   in disabling the system restore of a machine. This event or behavior are seen in
   some RAT malware to make the restore of the infected machine  difficult and keep
@@ -67,21 +66,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
index c113937187..dea2692223 100644
--- a/detections/endpoint/disabling_task_manager.yml
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to identifies modification of registry to disable the
   task manager of windows operating system. this event or technique are commonly seen
   in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
@@ -66,21 +65,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
index 892fda08e0..31e8145593 100644
--- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
@@ -5,8 +5,7 @@ date: '2021-10-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies DLLHost.exe with no command line arguments
   with a network connection. It is unusual for DLLHost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -69,19 +68,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
-  - dest_port
-  - parent_process_name
+  - EventID
   - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
   - process_path
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
index 5cfa3a33ac..739eb1ad54 100644
--- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
+++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
@@ -5,7 +5,7 @@ date: '2021-04-15'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
@@ -71,13 +71,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml
index 85117f4030..a529264fd2 100644
--- a/detections/endpoint/domain_account_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to discover  domain users. The `user` argument returns a list
   of all users registered in the domain. Red Teams and adversaries alike engage in
@@ -59,14 +59,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index 05b0d85ce0..d08b791f3f 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to query for domain users. Red Teams and adversaries
   alike may use net.exe to enumerate domain users for situational awareness and Active
@@ -59,15 +59,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml
index 82c19f5442..5069bf4f2a 100644
--- a/detections/endpoint/domain_account_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_account_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for domain users. Red Teams and adversaries alike use
   wmic.exe to enumerate domain users for situational awareness and Active Directory
@@ -60,15 +60,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml
index be944edb76..f44aa2ab73 100644
--- a/detections/endpoint/domain_controller_discovery_with_nltest.yml
+++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml
@@ -5,7 +5,7 @@ date: '2021-08-30'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `nltest.exe` with command-line
   arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:',
   can be used to return a list of all domain controllers. Red Teams and adversaries
@@ -50,13 +50,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 21
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml
index d67c52ec2b..9a3933b67c 100644
--- a/detections/endpoint/domain_controller_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to discover remote systems. The arguments utilized in this command
   line return a list of all domain controllers in a Windows domain. Red Teams and
@@ -50,12 +50,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 21
   security_domain: endpoint
diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml
index d3ddc7fd73..d0a5bb3640 100644
--- a/detections/endpoint/domain_group_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml
@@ -5,7 +5,7 @@ date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to query for domain groups. The argument `group`, returns a list
   of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe
@@ -50,12 +50,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml
index 93bc0b157a..f591073b41 100644
--- a/detections/endpoint/domain_group_discovery_with_net.yml
+++ b/detections/endpoint/domain_group_discovery_with_net.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` with command-line
   arguments utilized to query for domain groups. The argument `group /domain`, returns
   a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate
@@ -50,12 +50,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml
index 54e1732006..80069157d4 100644
--- a/detections/endpoint/domain_group_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_group_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for domain groups. The arguments utilized in this command
   return a list of all domain groups. Red Teams and adversaries alike use wmic.exe
@@ -51,12 +51,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index b3b8bcdb63..a5b1c7c64f 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-06'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic will identify a suspicious download by the Telegram
   application on a Windows system. This behavior was identified on a honeypot where
   the adversary gained access, installed Telegram and followed through with downloading
diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml
index f3a7ad6e44..0906ac0fba 100644
--- a/detections/endpoint/drop_icedid_license_dat.yml
+++ b/detections/endpoint/drop_icedid_license_dat.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-30'
 author: Teoderick Contreras, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect dropping a suspicious file named as "license.dat"
   in %appdata%. This behavior seen in latest IcedID malware that contain the actual
   core bot that will be injected in other process to do banking stealing.
diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml
index 5e24bf4623..ae07891213 100644
--- a/detections/endpoint/dsquery_domain_discovery.yml
+++ b/detections/endpoint/dsquery_domain_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-03-31'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies "dsquery.exe" execution with arguments
   looking for `TrustedDomain` query directly on the command-line. This is typically
   indicative of an Administrator or adversary perform domain trust discovery. Note
@@ -83,14 +83,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index ea09588f1a..f0806cf1a4 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -5,7 +5,7 @@ date: '2020-02-21'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Detect the usage of comsvcs.dll for dumping the lsass process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll*
@@ -70,12 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 19adb8a4a5..ac76cbe814 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'Detect procdump.exe dumping the lsass process. This query looks for
   both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
   file with all process memory. Both are highly suspect and should be reviewed. This
@@ -79,12 +79,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml
index a8c63b6231..5f4c9e0fb8 100644
--- a/detections/endpoint/elevated_group_discovery_with_net.yml
+++ b/detections/endpoint/elevated_group_discovery_with_net.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe`  with
   command-line arguments utilized to query for specific elevated domain groups. Red
   Teams and adversaries alike use net.exe to enumerate elevated domain groups for
@@ -57,13 +57,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 21
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml
index 3361100bda..bf92cb2add 100644
--- a/detections/endpoint/elevated_group_discovery_with_wmic.yml
+++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for specific domain groups. Red Teams and adversaries
   alike use net.exe to enumerate elevated domain groups for situational awareness
@@ -55,13 +55,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 21
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml
index f9974a40f5..3ad2ad5db9 100644
--- a/detections/endpoint/enable_rdp_in_other_port_number.yml
+++ b/detections/endpoint/enable_rdp_in_other_port_number.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a modification to registry to enable rdp to
   a machine with different port number. This technique was seen in some atttacker
   tries to do lateral movement and remote access to a compromised machine to gain
@@ -62,20 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
index 57588d47e5..cc55d2f898 100644
--- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious registry modification to enable
   plain text credential feature of windows. This technique was used by several malware
   and also by mimikatz to be able to dumpe the a plain text credential to the compromised
@@ -67,21 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
index d51d756d15..c560e7562a 100644
--- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml
+++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-06'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will detect a suspicious Telegram process enumerating all
   network users in a local group. This technique was seen in a Monero infected honeypot
   to mapped all the users on the compromised system. EventCode 4798 is generated when
diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml
index 20242af5f5..d8d8d11524 100644
--- a/detections/endpoint/esentutl_sam_copy.yml
+++ b/detections/endpoint/esentutl_sam_copy.yml
@@ -5,7 +5,7 @@ date: '2021-08-18'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the process - `esentutl.exe` - being
   used to capture credentials stored in ntds.dit or the SAM file on disk. During triage,
   review parallel processes and determine if legitimate activity. Upon determination
@@ -65,14 +65,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml
index 6ca2a31359..041d54c3a3 100644
--- a/detections/endpoint/etw_registry_disabled.yml
+++ b/detections/endpoint/etw_registry_disabled.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a registry modification to disable ETW feature
   of windows. This technique is to evade EDR appliance to evade detections and hide
   its execution from audit logs.
@@ -67,21 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.registry_value_data
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index 5e37b82160..9669c84655 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following search identifies Eventvwr bypass by identifying the registry
   modification into a specific path that eventvwr.msc looks to (but is not valid)
   upon execution. A successful attack will include a suspicious command to be executed
@@ -72,21 +71,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml
index c3e68dc910..b838d060fa 100644
--- a/detections/endpoint/excel_spawning_powershell.yml
+++ b/detections/endpoint/excel_spawning_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Microsoft Excel spawning PowerShell.
   Typically, this is not common behavior and not default with Excel.exe. Excel.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -69,13 +69,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml
index 41b78bdd98..e808a71e12 100644
--- a/detections/endpoint/excel_spawning_windows_script_host.yml
+++ b/detections/endpoint/excel_spawning_windows_script_host.yml
@@ -5,7 +5,7 @@ date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Microsoft Excel spawning Windows Script
   Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and
   not default with Excel.exe. Excel.exe will generally be found in the following path
@@ -71,16 +71,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
-  - dest
-  - parent_process_name
   - process_name
+  - process_id
+  - parent_process_name
+  - dest
   - user
+  - parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index 16b84359c9..7726131774 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify suspicious series of command-line to disable
   several services. This technique is seen where the adversary attempts to disable
   security app services or other malware services to complete the objective on the
@@ -55,13 +55,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
index 0fd77975fc..6802ab9d27 100644
--- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
+++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-01-20'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will identify excessive file deletion events in the Windows
   Defender folder. This technique was seen in the WhisperGate malware campaign in
   which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege
diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
index f9bb2cfd79..986e23feaf 100644
--- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
@@ -5,7 +5,7 @@ date: '2022-02-28'
 author: Michael Hart, Mauricio Velazco, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify suspicious series of process executions.  We
   have observed that post exploit framework tools like Koadic and Meterpreter will
   launch an excessive number of processes with distinct file paths from Windows\Temp
@@ -52,11 +52,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
index cb8f1a47ec..bac83efcff 100644
--- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
@@ -5,7 +5,7 @@ date: '2021-06-25'
 author: Michael Hart, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This detection targets behaviors observed when threat actors have used
   sc.exe to modify services. We observed malware in a honey pot spawning numerous
   sc.exe processes in a short period of time, presumably to impair defenses, possibly
@@ -63,14 +63,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml
index 0aaf40439c..4ddb7bef7a 100644
--- a/detections/endpoint/excessive_number_of_taskhost_processes.yml
+++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml
@@ -5,7 +5,7 @@ date: '2021-06-07'
 author: Michael Hart
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This detection targets behaviors observed in post exploit kits like Meterpreter
   and Koadic that are run in memory.  We have observed that these tools must invoke
   an excessive number of taskhost.exe and taskhostex.exe processes to complete various
@@ -60,10 +60,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml
index 175c668f4a..6c46da14ca 100644
--- a/detections/endpoint/excessive_service_stop_attempt.yml
+++ b/detections/endpoint/excessive_service_stop_attempt.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies suspicious series of attempt to kill multiple
   services on a system using either `net.exe` or `sc.exe`. This technique is use by
   adversaries to terminate security services or other related services to continue
@@ -58,14 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml
index 1f21d55b13..4bac489fdd 100644
--- a/detections/endpoint/excessive_usage_of_cacls_app.yml
+++ b/detections/endpoint/excessive_usage_of_cacls_app.yml
@@ -5,7 +5,7 @@ date: '2021-05-07'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`
   or `icacls.exe` application to change file or folder permission. This behavior is
   commonly seen where the adversary attempts to impair some users from deleting or
@@ -55,14 +55,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml
index 505c1b26bc..107c0ce90d 100644
--- a/detections/endpoint/excessive_usage_of_net_app.yml
+++ b/detections/endpoint/excessive_usage_of_net_app.yml
@@ -5,7 +5,7 @@ date: '2021-05-06'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within
   a bucket of time (1 minute). This behavior was seen in a Monero incident where the
   adversary attempts to create many users, delete and disable users as part of its
@@ -62,14 +62,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 28
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml
index 02700408af..48b38da855 100644
--- a/detections/endpoint/excessive_usage_of_nslookup_app.yml
+++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-21'
 author: Teoderick Contreras, Stanislav Miskovic, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
index 41d68e22ce..62ea23123b 100644
--- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml
+++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-06-24'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious excessive usage of sc.exe in a
   host machine. This technique was seen in several ransomware , xmrig and other malware
   to create, modify, delete or disable a service may related to security application
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 0a0db340f9..8f76b5ab68 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies excessive usage of `taskkill.exe` application.
   This application is commonly used by adversaries to evade detections by killing
   security product processes or even other processes to evade detection.
@@ -59,13 +59,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
   risk_score: 28
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 75e6d5b0ed..f3b5cf9ca5 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -5,7 +5,7 @@ date: '2021-05-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic will identify suspicious executable or scripts (known file
   extensions) in list of suspicious file path in Windows. This technique is used by
   adversaries to evade detection. The suspicious file path are known paths used in
@@ -72,12 +72,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_id
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.file_path
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
index 421bf86ce2..9a8c8241a2 100644
--- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
@@ -5,7 +5,7 @@ date: '2021-06-22'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify suspicious process of cscript.exe where it
   tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique
   was seen in ransomware (reddot ransomware) where it execute javascript with this
@@ -64,14 +64,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.dest
+  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index d031132a18..42dcd578c5 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -5,7 +5,7 @@ date: '2020-11-18'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for processes launched from files that have double
   extensions in the file name. This is typically done to obscure the "real" file extension
   and make it appear as though the file being accessed is a data file, as opposed
@@ -67,11 +67,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index d9045512f0..cb08f69826 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -5,7 +5,7 @@ date: '2021-09-09'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of `reg.exe` exporting Windows
   Registry hives containing credentials. Adversaries may use this technique to export
   registry hives for offline credential access attacks. Typically found executed from
@@ -64,14 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml
index 907dd66247..bd44cb5cf9 100644
--- a/detections/endpoint/file_with_samsam_extension.yml
+++ b/detections/endpoint/file_with_samsam_extension.yml
@@ -5,7 +5,7 @@ date: '2018-12-14'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The search looks for file writes with extensions consistent with a SamSam
   ransomware attack.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -62,11 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml
index a016d6c9bc..d76c1302c7 100644
--- a/detections/endpoint/firewall_allowed_program_enable.yml
+++ b/detections/endpoint/firewall_allowed_program_enable.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic detects a potential suspicious modification of firewall
   rule allowing to execute specific application. This technique was identified when
   an adversary and red teams to bypassed firewall file execution restriction in a
@@ -56,15 +56,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index 48f66394ab..a92768317f 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -5,7 +5,7 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific
   registry keys upon execution, that do not exist. Therefore, an attacker can write
   its malicious commands in these registry keys to be executed by fodhelper.exe with
@@ -75,15 +75,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml
index 6202f47d5c..53787bc8c5 100644
--- a/detections/endpoint/fsutil_zeroing_file.yml
+++ b/detections/endpoint/fsutil_zeroing_file.yml
@@ -5,7 +5,7 @@ date: '2021-08-11'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious fsutil process to zeroing a target
   file. This technique was seen in lockbit ransomware where it tries to zero out its
   malware path as part of its defense evasion after encrypting the compromised host.
@@ -48,13 +48,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process
+  - Processes.parent_process
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index e8732a2ed6..b41274ac38 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-26'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` executing the
   Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy
   in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate
@@ -60,14 +60,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml
index 5416fc9123..d7d92a915a 100644
--- a/detections/endpoint/get_aduser_with_powershell.yml
+++ b/detections/endpoint/get_aduser_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns
   a list of all domain users. Red Teams and adversaries alike may use this commandlet
@@ -61,14 +61,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index 8f37c2314d..ff29d907d3 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` executing the
   Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy
   in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate
@@ -60,15 +60,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index 1fc25c0b39..a47bfa8f2e 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` executing the
   `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain.
   Red Teams and adversaries alike may use PowerShell to enumerate domain policies
@@ -60,15 +60,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 30
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml
index ca5d242e66..549a7639fb 100644
--- a/detections/endpoint/get_domaintrust_with_powershell.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies Get-DomainTrust from PowerView in order to gather
   domain trust information. Typically, this is utilized within a script being executed
   and used to enumerate the domain trust information. This grants the adversary an
@@ -57,14 +57,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 12
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 21055c409d..8ad1cbdf75 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -66,10 +66,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
+  - _time
   - EventCode
   - Message
+  - Path
+  - OpCode
+  - ComputerName
   - User
-  - _time
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml
index df19ebf2b4..2977e9943a 100644
--- a/detections/endpoint/get_domainuser_with_powershell.yml
+++ b/detections/endpoint/get_domainuser_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
@@ -60,15 +60,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml
index fd31b5cda1..3a7aed21ae 100644
--- a/detections/endpoint/get_foresttrust_with_powershell.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies Get-ForestTrust from PowerSploit in order to
   gather domain trust information. Typically, this is utilized within a script being
   executed and used to enumerate the domain trust information. This grants the adversary
@@ -58,14 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 12
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index 96b44ab9d1..d04a74656a 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -57,11 +57,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
+  - _time
   - EventCode
   - Message
+  - Path
   - OpCode
+  - ComputerName
   - User
-  - _time
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml
index 808f58b0c1..b162b59416 100644
--- a/detections/endpoint/get_wmiobject_group_discovery.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
   being used with PowerShell to identify local groups on the endpoint. \ Typically,
   by itself, is not malicious but may raise suspicion based on time of day, endpoint
@@ -59,14 +59,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml
index 000caf937a..76b9ac8495 100644
--- a/detections/endpoint/getadcomputer_with_powershell.yml
+++ b/detections/endpoint/getadcomputer_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-07'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns
   a list of all domain computers. Red Teams and adversaries alike may use this commandlet
@@ -49,12 +49,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml
index 9000830d40..db1c10b8d6 100644
--- a/detections/endpoint/getadgroup_with_powershell.yml
+++ b/detections/endpoint/getadgroup_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is
   used to return a list of all groups available in a Windows Domain. Red Teams and
@@ -52,12 +52,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index eb04466494..01e7598eea 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powerhsell.exe` with command-line
   arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class.
   This method returns an object that represents the current Windows user. Red Teams
@@ -50,13 +50,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index 2f0db17e67..d1892d1e2a 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -49,10 +49,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
-  - EventCode
-  - Message
-  - User
   - _time
+  - Path
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml
index 7734ae695e..4da1c3199e 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-07'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
@@ -50,13 +50,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml
index e07c64cd22..fedfa7eaf9 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-07'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. `Get-DomainController` is part of
   PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red
@@ -51,12 +51,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml
index c53d4acb5d..e3797d79ed 100644
--- a/detections/endpoint/getdomaingroup_with_powershell.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
@@ -52,13 +52,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index b7eb24b83c..020615cadd 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-23'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for local users. The `Get-LocalUser` commandlet is used
   to return a list of all local users. Red Teams and adversaries may leverage this
@@ -50,13 +50,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml
index 7ace29c4fc..4dc7f09e60 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection`
   commandlet lists the current TCP connections. Red Teams and adversaries alike may
@@ -50,12 +50,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
index 38db3ff0e0..71659ca87e 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-07'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined
   with the `DS_Computer` parameter can be used to return a list of all domain computers.
@@ -51,13 +51,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 21
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
index 764ecf7b8e..37f46c9956 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined
   with the `-class ds_group` parameter can be used to return the full list of groups
@@ -54,13 +54,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
index 23d5330b36..9b10a7f427 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined
   with the `-class ds_user` parameter can be used to return the full list of users
@@ -62,15 +62,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index 9f853264d2..f8d752fb4a 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-08-23'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query local users. The `Get-WmiObject` commandlet combined
   with the `Win32_UserAccount` parameter is used to return a list of all local users.
@@ -51,13 +51,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
index ef7c9cdfda..f009546893 100644
--- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
@@ -5,8 +5,7 @@ date: '2021-04-19'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies gpupdate.exe with no command line arguments
   and with a network connection. It is unusual for gpupdate.exe to execute with no
   command line arguments present. This particular behavior is common with malicious
@@ -73,19 +72,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
-  - dest_port
-  - parent_process_name
+  - EventID
   - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
   - process_path
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
index 726d2986c8..eac5da28f8 100644
--- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml
+++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
@@ -5,8 +5,7 @@ date: '2022-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic identifies a suspicious registry modification to hide a
   user account on the Windows Login screen. This technique was seen in some tradecraft
   where the adversary will create a hidden user account with Admin privileges in login
@@ -73,21 +72,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
index 9cc12e21aa..8d475b0572 100644
--- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
   as hidden by using specific flags so that the victim does not see the file.  The
   search looks for specific command-line arguments to detect the use of attrib.exe
@@ -66,12 +66,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
index b5133a6bdf..6b7b613d2b 100644
--- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
+++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-11-16'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic is to detect a suspicious high frequency copying/moving
   of files in network share as part of information sabotage. This anomaly event can
   be a good indicator of insider trying to sabotage data by transfering classified
diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml
index fff2824a7f..7c46bf863c 100644
--- a/detections/endpoint/high_process_termination_frequency.yml
+++ b/detections/endpoint/high_process_termination_frequency.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-03-16'
 author: Teoderick Contreras
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytics are designed to indentify a high frequency of process
   termination on a machine which is a common behavior of ransomware malware before
   encrypting files. This technique is designed to avoid an exception error while accessing
diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml
index 02593ba1b0..21de6d3f2e 100644
--- a/detections/endpoint/hunting_for_log4shell.yml
+++ b/detections/endpoint/hunting_for_log4shell.yml
@@ -5,7 +5,7 @@ date: '2021-12-14'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Web.Web
+- Web
 description: 'The following hunting query assists with quickly assessing CVE-2021-44228,
   or Log4Shell, activity mapped to the Web Datamodel. This is a combination query
   attempting to identify, score and dashboard. Because the Log4Shell vulnerability
@@ -106,6 +106,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
   - _raw
   risk_score: 40
   security_domain: network
diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml
index ddcab2a8b8..b83fcbeec1 100644
--- a/detections/endpoint/icacls_deny_command.yml
+++ b/detections/endpoint/icacls_deny_command.yml
@@ -5,7 +5,7 @@ date: '2021-04-29'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies a potential adversary that changes the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
@@ -56,13 +56,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml
index 19e32a35b3..c7d56e34d4 100644
--- a/detections/endpoint/icacls_grant_command.yml
+++ b/detections/endpoint/icacls_grant_command.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies potential adversaries that modify the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft and coinminer scripts to evade detections and restrict access to their
@@ -56,13 +56,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
index a033ac4ce4..06a6670bcf 100644
--- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
+++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-30'
 author: Teoderick Contreras, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious file creation namely passff.tar
   and cookie.tar. This files are possible archived of stolen browser information like
   history and cookies in a compromised machine with IcedID.
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index 7ce34beaf6..0668bed541 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -5,7 +5,7 @@ date: '2022-01-18'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the presence of suspicious commandline parameters
   typically present when using Impacket tools. Impacket is a collection of python
   classes meant to be used with Microsoft network protocols. There are multiple scripts
@@ -67,14 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml
index adfe406150..03c7bc0dbf 100644
--- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml
+++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml
@@ -5,14 +5,14 @@ date: '2021-12-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Web.Web
+- Web
 description: The following analytic identifies a Java user agent performing a GET
   request for a .class file from the remote site. This is potentially indicative of
   exploitation of the Java application and may be related to current event CVE-2021-44228
   (Log4Shell).
-search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*"
-  Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method,
-  Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
+search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET"
+  Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
+  Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   web or proxy logs, or ensure it is being filled by a proxy like device, into the
@@ -58,11 +58,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Web.Web.dest
-  - Web.Web.http_method
-  - Web.Web.http_user_agent
-  - Web.Web.src
-  - Web.Web.url
-  - Web.Web.url_length
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
   risk_score: 40
   security_domain: network
diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml
index ecfce2dba8..ab7430fa8c 100644
--- a/detections/endpoint/jscript_execution_using_cscript_app.yml
+++ b/detections/endpoint/jscript_execution_using_cscript_app.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a execution of jscript using cscript process.
   Commonly when a user run jscript file it was executed by wscript.exe application.
   This technique was seen in FIN7 js implant to execute its malicious script using
@@ -59,14 +59,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
index 51efd8845f..80d788cf75 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -51,9 +51,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Account_Name
+  - _time
   - EventCode
-  - MSADChangedAttributes
+  - Account_Name
   - Security_ID
+  - MSADChangedAttributes
   risk_score: 45
   security_domain: endpoint
diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml
index f05aa60ba6..fa8b448f0f 100644
--- a/detections/endpoint/known_services_killed_by_ransomware.yml
+++ b/detections/endpoint/known_services_killed_by_ransomware.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-06-04'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search detects a suspicioous termination of known services killed
   by ransomware before encrypting files in a compromised machine. This technique is
   commonly seen in most of ransomware now a days to avoid exception error while accessing
diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
index 77154e92b3..37bbd7ea38 100644
--- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
+++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The following analytic identifies a suspicious file creation in known
   cron table directories. This event is commonly abuse by malware, adversaries and
   red teamers to persist on the target or compromised host. crontab or cronjob is
@@ -62,11 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml
index c43fed07c5..a0c781c9f9 100644
--- a/detections/endpoint/linux_add_user_account.yml
+++ b/detections/endpoint/linux_add_user_account.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for commands to create user accounts on the linux
   platform. This technique is commonly abuse by adversaries, malware author and red
   teamers to persist on the targeted or compromised host by creating new user with
@@ -60,13 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml
index 1e8e124d85..44c01c5905 100644
--- a/detections/endpoint/linux_at_allow_config_file_creation.yml
+++ b/detections/endpoint/linux_at_allow_config_file_creation.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The following analytic identifies a suspicious file creation of /etc/at.allow
   or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red
   teamers to persist on the targeted or compromised host. These config files can restrict
@@ -61,11 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml
index 7cbb194cc2..6558da85bd 100644
--- a/detections/endpoint/linux_at_application_execution.yml
+++ b/detections/endpoint/linux_at_application_execution.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a suspicious process creation of At
   application. This process can be used by malware, adversaries and red teamers to
   create persistence entry to the targeted or compromised host with their malicious
@@ -62,13 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index 17bd1a1951..bee64e143f 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for a commandline that change the file owner to root
   using chown utility tool. This technique is commonly abuse by adversaries, malware
   author and red teamers to escalate privilege to the targeted or compromised host
@@ -62,14 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml
index 3b1821fdbb..bf83c6c1ee 100644
--- a/detections/endpoint/linux_common_process_for_elevation_control.yml
+++ b/detections/endpoint/linux_common_process_for_elevation_control.yml
@@ -5,7 +5,7 @@ date: '2021-12-23'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for possible elevation control access using
   a common known process in linux platform to change the attribute and file ownership.
   This technique is commonly abused by adversaries, malware author and red teamers
@@ -69,14 +69,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml
index 3cb46a20ef..77ed4d3d15 100644
--- a/detections/endpoint/linux_dd_file_overwrite.yml
+++ b/detections/endpoint/linux_dd_file_overwrite.yml
@@ -5,7 +5,7 @@ date: '2022-02-14'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for dd command to overwrite file. This technique
   was abused by adversaries or threat actor to destroy files or data on specific system
   or in a large number of host within network to interrupt host avilability, services
@@ -57,14 +57,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml
index 01f93a2954..1a0d7dce2b 100644
--- a/detections/endpoint/linux_doas_conf_file_creation.yml
+++ b/detections/endpoint/linux_doas_conf_file_creation.yml
@@ -5,7 +5,7 @@ date: '2022-01-05'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic is to detect the creation of doas.conf file in linux host
   platform. This configuration file can be use by doas utility tool to allow or permit
   standard users to perform tasks as root, the same way sudo does. This tool is developed
@@ -62,11 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml
index 55d42a3055..0997182fa7 100644
--- a/detections/endpoint/linux_doas_tool_execution.yml
+++ b/detections/endpoint/linux_doas_tool_execution.yml
@@ -5,7 +5,7 @@ date: '2022-01-05'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect the doas tool execution in linux host platform.
   This utility tool allow standard users to perform tasks as root, the same way sudo
   does. This tool is developed as a minimalistic alternative to sudo application.
@@ -63,14 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
index ac42a44383..17d993daf8 100644
--- a/detections/endpoint/linux_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a suspicious cronjobs modification
   using crontab edit parameter. This commandline parameter can be abuse by malware
   author, adversaries, and red red teamers to add cronjob entry to their malicious
@@ -60,13 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
index f5009747d7..c8e48e229c 100644
--- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -5,7 +5,7 @@ date: '2021-12-22'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic looks for suspicious file creation in kernel/driver directory
   in linux platform. This directory is known folder for all linux kernel module available
   within the system. so creation of file in this directory is a good indicator that
@@ -63,10 +63,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 72
   security_domain: endpoint
diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
index 2601045d97..28b9fee84d 100644
--- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic looks for suspicious file creation on init system directories
   for automatic execution of script or file upon boot up. This technique is commonly
   abuse by adversaries, malware author and red teamer to persist on the targeted or
@@ -59,10 +59,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml
index 69ed4b7a53..7ad259ac67 100644
--- a/detections/endpoint/linux_file_creation_in_profile_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic looks for suspicious file creation in /etc/profile.d directory
   to automatically execute scripts by shell upon boot up of a linux machine. This
   technique is commonly abused by adversaries, malware and red teamers as a persistence
@@ -61,11 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
index 2491ec7d99..9efacdd220 100644
--- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -5,7 +5,7 @@ date: '2021-12-22'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for inserting of linux kernel module using insmod
   utility function. This event can detect a installation of rootkit or malicious kernel
   module to gain elevated privileges to their malicious code and bypassed detections.
@@ -61,14 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index 01a2f360ed..9825cd8934 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -5,7 +5,7 @@ date: '2021-12-22'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for possible installing a linux kernel module using
   modprobe utility function. This event can detect a installation of rootkit or malicious
   kernel module to gain elevated privileges to their malicious code and bypassed detections.
@@ -62,14 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml
index 604e6155cb..e3287580d3 100644
--- a/detections/endpoint/linux_java_spawning_shell.yml
+++ b/detections/endpoint/linux_java_spawning_shell.yml
@@ -5,7 +5,7 @@ date: '2021-12-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the process name of Java, Apache, or
   Tomcat spawning a Linux shell. This is potentially indicative of exploitation of
   the Java application and may be related to current event CVE-2021-44228 (Log4Shell).
@@ -63,13 +63,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 0ea8d38278..f3c9be8b15 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for suspicious command lines that may add entry
   to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly
   abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -63,14 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml
index f917eae8ca..5c4b713717 100644
--- a/detections/endpoint/linux_pkexec_privilege_escalation.yml
+++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml
@@ -5,7 +5,7 @@ date: '2022-01-28'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `pkexec` spawning with no command-line
   arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034
   (PwnKit) which is present in the default configuration of all major Linux distributions
@@ -70,12 +70,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index 3286dab16d..22818a0ab6 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -5,7 +5,7 @@ date: '2022-01-11'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for suspicious process command-line that might
   be accessing or modifying sshd_config. This file is the ssh configuration file that
   might be modify by threat actors or adversaries to redirect port connection, allow
@@ -62,13 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml
index ffe7fad69a..3b695cc0f6 100644
--- a/detections/endpoint/linux_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_possible_access_to_credential_files.yml
@@ -5,7 +5,7 @@ date: '2022-01-10'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a possible attempt to dump or access the content
   of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd"
   store user information within linux OS while "etc/shadow" contain the user passwords
@@ -63,13 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
index 40c16b2b50..4d287e68ca 100644
--- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
@@ -5,7 +5,7 @@ date: '2022-01-10'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a possible access or modification of /etc/sudoers
   file. "/etc/sudoers" file controls who can run what command as what users on what
   machine and can also control whether a specific user need a password for particular
@@ -61,13 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
index c6012d5485..4eb48d7d79 100644
--- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for suspicious commandline that may use to append
   user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by
   malware, adversaries or red teamers to persist on the targeted or compromised host.
@@ -63,13 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index ee80a8a3a0..e3ec58909f 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for suspicious command-lines that can be possibly
   used to modify user profile files to automatically execute scripts/executables by
   shell upon reboot of the machine. This technique is commonly abused by adversaries,
@@ -63,14 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
index 491c39d64a..4c56681b14 100644
--- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for possible suspicious commandline that may use
   to append a code to any existing cronjob files for persistence or privilege escalation.
   This technique is commonly abused by malware, adversaries and red teamers to automatically
@@ -60,13 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
index 425072c495..4866c6a3a8 100644
--- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
+++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
@@ -5,7 +5,7 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for possible modification of cronjobs file using
   editor. This event is can be seen in normal user but can also be a good hunting
   indicator for unwanted user modifying cronjobs for possible persistence or privilege
@@ -60,13 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 6
   security_domain: endpoint
diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
index c446657f77..6945aed5fc 100644
--- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml
+++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
@@ -5,7 +5,7 @@ date: '2022-01-11'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic is to look for possible ssh key file creation on ~/.ssh/
   folder. This technique is commonly abused by threat actors and adversaries to gain
   persistence and privilege escalation to the targeted host. by creating ssh private
@@ -60,10 +60,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index de359cc437..97c79b0d14 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -5,7 +5,7 @@ date: '2021-12-22'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious command that may hijack a library
   function in linux platform. This technique is commonly abuse by adversaries, malware
   author and red teamers to gain privileges and persist on the machine. This detection
@@ -60,14 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
index 71aff9b889..999fecc6a8 100644
--- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
+++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic looks for suspicious file creation in systemd timer directory
   in linux platform. systemd is a system and service manager for Linux distributions.
   From the Windows perspective, this process fulfills the duties of wininit.exe and
@@ -67,11 +67,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml
index 17448a1f88..f8791b39ec 100644
--- a/detections/endpoint/linux_service_restarted.yml
+++ b/detections/endpoint/linux_service_restarted.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for restarted or re-enable services in linux platform.
   This technique can be executed or performed using systemctl or service tool application.
   Adversaries may create or modify Windows services to repeatedly execute malicious
@@ -65,14 +65,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml
index 03080181ea..f49665180d 100644
--- a/detections/endpoint/linux_service_started_or_enabled.yml
+++ b/detections/endpoint/linux_service_started_or_enabled.yml
@@ -5,7 +5,7 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for created or enable services in linux platform.
   This technique can be executed or performed using systemctl or service tool application.
   Adversaries may create or modify Windows services to repeatedly execute malicious
@@ -65,14 +65,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml
index be8916e434..9c0993d9d1 100644
--- a/detections/endpoint/linux_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for suspicious chmod utility execution to enable
   SUID bit. This allows a user to temporarily gain root access, usually in order to
   run a program. For example, only the root account is allowed to change the password
@@ -65,14 +65,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml
index 19cccdae0c..a9b84716e8 100644
--- a/detections/endpoint/linux_setuid_using_setcap_utility.yml
+++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for suspicious setcap utility execution to enable
   SUID bit. This allows a user to temporarily gain root access, usually in order to
   run a program. For example, only the root account is allowed to change the password
@@ -66,14 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml
index f019493f8d..fb739d3abf 100644
--- a/detections/endpoint/linux_sudo_or_su_execution.yml
+++ b/detections/endpoint/linux_sudo_or_su_execution.yml
@@ -5,7 +5,7 @@ date: '2022-01-04'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect the execution of sudo or su command in linux
   operating system. The "sudo" command allows a system administrator to delegate authority
   to give certain users (or groups of users) the ability to run some (or all) commands
@@ -63,14 +63,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 4e267fbd75..1df4b0d961 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -5,7 +5,7 @@ date: '2021-12-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This analytic is to looks for file creation of sudoers.tmp file cause
   by editing /etc/sudoers using visudo or editor in linux platform. This technique
   may abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -61,10 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
+  - Filesystem.file_path
   risk_score: 72
   security_domain: endpoint
diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml
index 3406ebdc68..11f21bf5ff 100644
--- a/detections/endpoint/linux_system_network_discovery.yml
+++ b/detections/endpoint/linux_system_network_discovery.yml
@@ -5,7 +5,7 @@ date: '2022-02-11'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for possible enumeration of local network configuration.
   This technique is commonly used as part of recon of adversaries or threat actor
   to know some network information for its next or further attack. This anomaly detections
@@ -58,13 +58,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index 5efa44936b..4acdf38f55 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -5,7 +5,7 @@ date: '2021-12-21'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to looks for suspicious commandline that add entry to
   /etc/sudoers by using visudo utility tool in linux platform. This technique may
   abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -62,14 +62,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 16
   security_domain: endpoint
diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml
index b08a45cb10..8367b6300c 100644
--- a/detections/endpoint/loading_of_dynwrapx_module.yml
+++ b/detections/endpoint/loading_of_dynwrapx_module.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-11-18'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: DynamicWrapperX is an ActiveX component that can be used in a script
   to call Windows API functions, but it requires the dynwrapx.dll to be installed
   and registered. With that, registering or loading dynwrapx.dll to a host is highly
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index 916ee27658..d2220dfca8 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to query for local users. The two arguments `user`
   and 'users', return a list of all local users. Red Teams and adversaries alike use
@@ -49,13 +49,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index 05efc65bd9..d2dd2876a8 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for local users. The argument `useraccount` is used
   to leverage WMI to return a list of all local users. Red Teams and adversaries alike
@@ -48,13 +48,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml
index 764a375eb7..cce4592702 100644
--- a/detections/endpoint/logon_script_event_trigger_execution.yml
+++ b/detections/endpoint/logon_script_event_trigger_execution.yml
@@ -5,7 +5,7 @@ date: '2021-09-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a suspicious modification of registry entry
   to persist and gain privilege escalation upon booting up of compromised host. This
   technique was seen in several APT and malware where it modify UserInitMprLogonScript
@@ -56,12 +56,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml
index 8bae9e0a77..028bb99c8b 100644
--- a/detections/endpoint/mailsniper_invoke_functions.yml
+++ b/detections/endpoint/mailsniper_invoke_functions.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect known mailsniper.ps1 functions executed in a
   machine. This technique was seen in some attacker to harvest some sensitive e-mail
   in a compromised exchange server.
diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml
index 0cc679b914..21c9bc00db 100644
--- a/detections/endpoint/malicious_inprocserver32_modification.yml
+++ b/detections/endpoint/malicious_inprocserver32_modification.yml
@@ -5,8 +5,7 @@ date: '2021-10-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following analytic identifies a process modifying the registry with
   a known malicious CLSID under InProcServer32. Most COM classes are registered with
   the operating system and are identified by a GUID that represents the Class Identifier
@@ -76,22 +75,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
   - dest
   - process_name
-  - registry_key_name
   - registry_path
+  - registry_key_name
   - registry_value_name
   - user
   risk_score: 80
diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
index e8fd993b05..391afadbf2 100644
--- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml
+++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-07'
 author: Ryan Becwar
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This detection is to identify the abuse the Windows SC.exe to execute
   malicious commands or payloads via PowerShell.
 search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index e032333af3..0b1bb8f3ea 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -5,7 +5,7 @@ date: '2022-01-18'
 author: David Dorsey, Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the use of the EncodedCommand PowerShell
   parameter. This is typically used by Administrators to run complex scripts, but
   commonly used by adversaries to hide their code. \
@@ -78,13 +78,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index c335580838..23a31dc47e 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Rico Valdez, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for PowerShell processes started with parameters used
   to bypass the local execution policy for scripts. These parameters are often observed
   in attacks leveraging PowerShell scripts as they override the default PowerShell
@@ -65,12 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index b2783d92db..1fa77cee67 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -5,7 +5,7 @@ date: '2021-01-19'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for PowerShell processes launched with arguments that
   have characters indicative of obfuscation on the command-line.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -63,14 +63,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
index 967dc32b26..bda911cd5a 100644
--- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -5,7 +5,7 @@ date: '2022-02-01'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic looks for the use of Mimikatz command line parameters
   leveraged to execute pass the ticket attacks. Red teams and adversaries alike may
   use the pass the ticket technique using stolen Kerberos tickets to move laterally
@@ -62,14 +62,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
index bc297d7b0b..aab3e5935e 100644
--- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-23'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the DCOM protocol
   and the MMC20 COM object, the executed command is spawned as a child processs of
@@ -65,15 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml
index 9ab0e1be7e..abbc9ace22 100644
--- a/detections/endpoint/modification_of_wallpaper.yml
+++ b/detections/endpoint/modification_of_wallpaper.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-06-02'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies suspicious modification of registry to deface
   or change the wallpaper of a compromised machines as part of its payload. This technique
   was commonly seen in ransomware like REVIL where it create a bitmap file contain
diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
index 86dc4f0fde..5f41d4c5c9 100644
--- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
+++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies suspicious modification of ACL permission to
   a files or folder to make it available to everyone. This technique may be used by
   the adversary to evade ACLs or protected files access. This changes is commonly
@@ -53,13 +53,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
   risk_score: 32
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
index 351d772516..d445f2249f 100644
--- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
@@ -4,9 +4,7 @@ version: 3
 date: '2020-01-28'
 author: Bhavin Patel, Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+datamodel: []
 description: This search looks for registry activity associated with modifications
   to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this
   scenario, an attacker can load an arbitrary .dll into the print-monitor registry
@@ -74,21 +72,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.action
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.action
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.registry_key_name
+  - Registry.user
+  - Registry.registry_value_name
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
index 5c94fa10e5..39ae4926de 100644
--- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-13'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious MS scripting process such as wscript.exe
   or cscript.exe that loading ldap module to process ldap query. This behavior was
   seen in FIN7 implant where it uses javascript to execute ldap query to parse host
diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
index 0aee20a152..369b9ee11e 100644
--- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-13'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious MS scripting process such as wscript.exe
   or cscript.exe that loading wmi module to process wmi query. This behavior was seen
   in FIN7 implant where it uses javascript to execute wmi query to parse host information
diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
index bf9235beca..4880410409 100644
--- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
+++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
@@ -5,7 +5,7 @@ date: '2021-10-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious child process of MSBuild spawned
   by Windows Script Host - cscript or wscript. This behavior or event are commonly
   seen and used by malware or adversaries to execute malicious msbuild process using
@@ -60,14 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.original_file_name
+  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index 0a784968a4..04b24fdeed 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -5,7 +5,7 @@ date: '2021-07-19'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious mshta.exe process that spawn rundll32
   or regsvr32 child process. This technique was seen in several malware nowadays like
   trickbot to load its initial .dll stage loader to execute and download the the actual
@@ -58,15 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index ba6f91049c..bb9f98ed80 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-09'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following detection identifies the module load of mshtml.dll into
   an Office product. This behavior has been related to CVE-2021-40444, whereas the
   malicious document will load ActiveX, which activates the MSHTML component. The
diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml
index 38d9253ebe..c4f72a52aa 100644
--- a/detections/endpoint/msmpeng_application_dll_side_loading.yml
+++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml
@@ -5,7 +5,7 @@ date: '2021-07-05'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll
   in non default windows defender folder. This technique was seen couple days ago
   with revil ransomware in Kaseya Supply chain. The approach is to drop an old version
@@ -40,12 +40,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_id
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
index afc5263528..84430a2b77 100644
--- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
+++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
@@ -74,9 +74,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
+  - EventCode
+  - Security_ID
   - Account_Name
   - ComputerName
-  - EventCode
-  - _time
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
index 473dea952c..5ebf02b7cc 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -70,9 +70,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
+  - EventCode
+  - Result_Code
   - Account_Name
   - Client_Address
-  - EventCode
-  - _time
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
index 6d6fd7f257..1496df5d6c 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
@@ -73,11 +73,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Account_Name
-  - Caller_Process_Name
-  - ComputerName
+  - _time
   - EventCode
   - Logon_Type
-  - _time
+  - Caller_Process_Name
+  - Security_ID
+  - Account_Name
+  - ComputerName
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
index 0587aac7b4..5b9049e85a 100644
--- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
+++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
@@ -72,11 +72,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Account_Name
-  - ComputerName
+  - _time
   - EventCode
   - Logon_Type
+  - Security_ID
+  - Account_Name
+  - ComputerName
   - Source_Network_Address
-  - _time
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index 6b134520d4..ea47f2e0e7 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting analytic will identify the use of localgroup discovery
   using `net localgroup`. During triage, review parallel processes and identify any
   further suspicious behavior.
@@ -58,14 +58,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index f16e1ff411..cf677f99cd 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -5,7 +5,7 @@ date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect modification of registry to bypass UAC windows
   feature. This technique is to add a payload dll path on .NET COR file path that
   will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring
@@ -55,11 +55,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml
index 4c53baaa9b..7561ba6375 100644
--- a/detections/endpoint/network_connection_discovery_arp.yml
+++ b/detections/endpoint/network_connection_discovery_arp.yml
@@ -5,7 +5,7 @@ date: '2021-09-10'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `arp.exe` utilized to get a
   listing of network connections on a compromised system. Red Teams and adversaries
   alike may use arp.exe for situational awareness and Active Directory Discovery.
@@ -48,12 +48,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml
index 442e9b4a11..6427083184 100644
--- a/detections/endpoint/network_connection_discovery_net.yml
+++ b/detections/endpoint/network_connection_discovery_net.yml
@@ -5,7 +5,7 @@ date: '2021-09-10'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` with command-line
   arguments utilized to get a listing of network connections on a compromised system.
   Red Teams and adversaries alike may use net.exe for situational awareness and Active
@@ -49,12 +49,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml
index 3b25f3066c..a699d24058 100644
--- a/detections/endpoint/network_connection_discovery_netstat.yml
+++ b/detections/endpoint/network_connection_discovery_netstat.yml
@@ -5,7 +5,7 @@ date: '2021-09-10'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `netstat.exe` with command-line
   arguments utilized to get a listing of network connections on a compromised system.
   Red Teams and adversaries alike may use netstat.exe for situational awareness and
@@ -49,12 +49,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml
index 4badc78a10..444db4a4f3 100644
--- a/detections/endpoint/network_discovery_using_route_windows_app.yml
+++ b/detections/endpoint/network_discovery_using_route_windows_app.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic look for a spawned process of route.exe windows application.
   Adversaries and red teams alike abuse this application the recon or do a network
   discovery on a target host. but one possible false positive might be an automated
@@ -53,14 +53,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index 58737cf7a7..e4858581cd 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -5,7 +5,7 @@ date: '2021-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
   spawns a call back to a remote command and control server. This is a powershell
   oneliner. In addition, this will capture on the command-line additional utilities
@@ -58,15 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 2e92978e72..0351a8b0cc 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-01-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for the execution of `nltest.exe` with command-line
   arguments utilized to query for Domain Trust information. Two arguments `/domain
   trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted
@@ -65,14 +65,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index f1357d0652..3306d0a93d 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect an anomaly event of non-chrome process accessing
   the files in chrome user default folder. This folder contains all the sqlite database
   of the chrome browser related to users login, history, cookies and etc. Most of
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 40e78f6e73..a0ab4f8f17 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect an anomaly event of non-firefox process accessing
   the files in  profile folder. This folder contains all the sqlite database of the
   firefox browser related to users login, history, cookies and etc. Most of the RAT,
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 6b97130433..aa6664ba7e 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -5,7 +5,7 @@ date: '2021-01-28'
 author: Michael Haag, Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
   database - NTDS.dit, typically used for offline password cracking. It may be used
   in normal circumstances with no command line arguments or shorthand variations of
@@ -68,14 +68,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 50
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml
index 9dd051dc3c..25b2f1dfa7 100644
--- a/detections/endpoint/office_application_drop_executable.yml
+++ b/detections/endpoint/office_application_drop_executable.yml
@@ -5,8 +5,7 @@ date: '2021-09-13'
 author: Teoderick Contreras, Michael Haag Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious MS office application that drop
   or create executables or script in the host. This behavior is commonly seen in spear
   phishing office attachment where it drop malicious files or script to compromised
@@ -65,17 +64,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
+  - Image
+  - TargetFilename
+  - ProcessGuid
   - dest
+  - user_id
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml
index 040f17b575..7cee8cbf6d 100644
--- a/detections/endpoint/office_application_spawn_regsvr32_process.yml
+++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml
@@ -5,7 +5,7 @@ date: '2021-07-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this detection was designed to identifies suspicious spawned process
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like IcedID that used MS office as its weapon or attack
@@ -53,16 +53,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index a2d79325d0..30f2fa1600 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -5,7 +5,7 @@ date: '2021-04-13'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this detection was designed to identifies suspicious spawned process
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like trickbot that used MS office as its weapon or attack
@@ -55,14 +55,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml
index 574a5fd61b..e3455839fd 100644
--- a/detections/endpoint/office_document_creating_schedule_task.yml
+++ b/detections/endpoint/office_document_creating_schedule_task.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-14'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search detects a potential malicious office document that create
   schedule task entry through macro VBA api or through loading taskschd.dll. This
   technique was seen in so many malicious macro malware that create persistence ,
diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml
index 00ff733b24..5d78357f23 100644
--- a/detections/endpoint/office_document_executing_macro_code.yml
+++ b/detections/endpoint/office_document_executing_macro_code.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-14'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this detection was designed to identifies suspicious office documents
   that using macro code. Macro code is known to be one of the prevalent weaponization
   or attack vector of threat actor. This malicious macro code is embed to a office
diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index 8afb25668b..f3d8d1fa01 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect potential malicious office document executing
   lolbin child process to download payload or other malware. Since most of the attacker
   abused the capability of office document to execute living on land application to
@@ -53,15 +53,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 651fd914c3..69de3a2862 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -5,7 +5,7 @@ date: '2021-07-19'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: this search is to detect a suspicious office product process that spawn
   cmd child process. This is commonly seen in a ms office product having macro to
   execute shell command to download or execute malicious lolbin relative to its malicious
@@ -59,16 +59,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml
index 0b458ecd9b..094bebf61f 100644
--- a/detections/endpoint/office_product_spawning_bitsadmin.yml
+++ b/detections/endpoint/office_product_spawning_bitsadmin.yml
@@ -5,7 +5,7 @@ date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line
@@ -64,16 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 0196ffc1fc..0326a05e7a 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -5,7 +5,7 @@ date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `certutil.exe`. In malicious instances, the command-line
@@ -64,16 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml
index 21dd01b129..5c136fd5a4 100644
--- a/detections/endpoint/office_product_spawning_mshta.yml
+++ b/detections/endpoint/office_product_spawning_mshta.yml
@@ -5,7 +5,7 @@ date: '2021-04-26'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `mshta.exe`. In malicious instances, the command-line of
@@ -64,16 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
index 2c4904a8a7..d2a2ea1b65 100644
--- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
@@ -5,7 +5,7 @@ date: '2021-04-22'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies the latest behavior utilized by IcedID
   malware family. This detection identifies any Windows Office Product spawning `rundll32.exe`
   without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe`
@@ -67,15 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index 7c2be2f632..cb49a67c41 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies the latest behavior utilized by Ursnif
   malware family. This detection identifies any Windows Office Product spawning `wmic.exe`.
   In malicious instances, the command-line of `wmic.exe` will contain `wmic process
@@ -66,16 +66,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml
index 6d412ef122..6df24c4ce8 100644
--- a/detections/endpoint/office_product_writing_cab_or_inf.yml
+++ b/detections/endpoint/office_product_writing_cab_or_inf.yml
@@ -5,8 +5,7 @@ date: '2021-09-10'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies behavior related to CVE-2021-40444.
   Whereas the malicious document will load ActiveX and download the remote payload
   (.inf, .cab). During triage, review parallel processes and further activity on endpoint
@@ -68,20 +67,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
   - dest
+  - process_name
+  - process
   - file_create_time
   - file_name
   - file_path
-  - process
-  - process_name
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
index dff6f0a204..9a776be427 100644
--- a/detections/endpoint/office_spawning_control.yml
+++ b/detections/endpoint/office_spawning_control.yml
@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies control.exe spawning from an office
   product. This detection identifies any Windows Office Product spawning `control.exe`.
   In malicious instances, the command-line of `control.exe` will contain a file path
@@ -72,14 +72,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index d172a7489a..b22c450fe7 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -4,9 +4,7 @@ version: 1
 date: '2021-12-13'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+datamodel: []
 description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability
   is that the victim server will perform outbound connections to attacker-controlled
   infrastructure. This is required as part of the JNDI lookup as well as for retrieving
@@ -61,15 +59,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.process_guid
+  - Processes.process_name
+  - Processes.dest
+  - Processes.process_path
+  - Processes.process
+  - Processes.parent_process_name
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
   risk_score: 54
   security_domain: endpoint
diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml
index 36ee9d083b..4c2b15a2e0 100644
--- a/detections/endpoint/overwriting_accessibility_binaries.yml
+++ b/detections/endpoint/overwriting_accessibility_binaries.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: Microsoft Windows contains accessibility features that can be launched
   with a key combination before a user has logged in. An adversary can modify or replace
   these programs so they can get a command prompt or backdoor without logging in to
@@ -62,11 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml
index 2284783c9b..b78172fb96 100644
--- a/detections/endpoint/password_policy_discovery_with_net.yml
+++ b/detections/endpoint/password_policy_discovery_with_net.yml
@@ -5,7 +5,7 @@ date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command line arguments used to obtain the domain password policy. Red Teams and
   adversaries may leverage `net.exe` for situational awareness and Active Directory
@@ -58,14 +58,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml
index 0f807b6e0f..0a4ff79263 100644
--- a/detections/endpoint/permission_modification_using_takeown_app.yml
+++ b/detections/endpoint/permission_modification_using_takeown_app.yml
@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a modification of file or directory permission
   using takeown.exe windows app. This technique was seen in some ransomware that take
   the ownership of a folder or files to encrypt or delete it.
@@ -54,15 +54,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml
index 5a6273dfb2..f015fa1240 100644
--- a/detections/endpoint/ping_sleep_batch_command.yml
+++ b/detections/endpoint/ping_sleep_batch_command.yml
@@ -5,7 +5,7 @@ date: '2022-01-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will identify the possible execution of ping sleep batch
   commands. This technique was seen in several malware samples and is used to trigger
   sleep times without explicitly calling sleep functions or commandlets. The goal
@@ -65,16 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml
index 6cfcfac61c..5b0b1d67e8 100644
--- a/detections/endpoint/possible_browser_pass_view_parameter.yml
+++ b/detections/endpoint/possible_browser_pass_view_parameter.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic will detect if a suspicious process contains a commandline
   parameter related to a web browser credential dumper. This technique is used by
   Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to
@@ -63,15 +63,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 16
   security_domain: endpoint
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index bce9380640..6110ef0b52 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-29'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic assists with identifying a PowerShell process
   spawned as a child or grand child process of commonly abused processes during lateral
   movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 45
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index b370743f33..57c5634513 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -5,7 +5,7 @@ date: '2022-01-14'
 author: Michael Hart, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic uses a pretrained machine learning text classifier
   to detect potentially malicious commandlines.  The model identifies unusual combinations
   of keywords found in samples of commandlines where adversaries executed powershell
@@ -17,8 +17,8 @@ description: The following analytic uses a pretrained machine learning text clas
   found in normal usage of the commandline.  The model will output a score where all
   values above zero are suspicious, anything greater than one particularly so.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name
-  Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
+  as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name
+  Processes.process_name Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
   where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score`
   | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
   process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits)
@@ -66,12 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
   risk_score: 12
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 4744e555b1..ee4bb6d61a 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -85,6 +85,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
   - Message
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index f5c7616988..c6cf21808e 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -5,7 +5,7 @@ date: '2022-01-12'
 author: David Dorsey, Michael Haag Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting analytic identifies PowerShell commands utilizing
   the WindowStyle parameter to hide the window on the compromised endpoint. This combination
   of command-line options is suspicious because it is overriding the default PowerShell
@@ -87,13 +87,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 889a450fd5..5f8fcb73e6 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -5,7 +5,7 @@ date: '2021-07-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
@@ -42,15 +42,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
index 09f7287044..e75d2001d3 100644
--- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml
+++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-06-22'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious enabling of smb1protocol through
   "powershell.exe". This technique was seen in some ransomware (like reddot) where
   it enable smb share to do the lateral movement and encrypt other files within the
diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml
index 7ae2f25432..30626cd311 100644
--- a/detections/endpoint/powershell_execute_com_object.yml
+++ b/detections/endpoint/powershell_execute_com_object.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-08-10'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a COM CLSID execution through powershell. This
   technique was seen in several adversaries and malware like ransomware conti where
   it has a feature to execute command using COM Object. This technique may use by
diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml
index 1518dd839c..85979673ad 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting analytic identifies the use of `get-localgroup`
   being used with PowerShell to identify local groups on the endpoint. During triage,
   review parallel processes and identify any further suspicious behavior.
@@ -56,13 +56,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index 3f2f3b7642..cb00089ad5 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -58,10 +58,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
+  - _time
   - EventCode
   - Message
+  - ComputerName
   - User
-  - _time
+  - Score
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index 8593152863..bd27bcef1f 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search is designed to detect suspicious powershell process that
   tries to inject code and to known/critical windows process and execute it using
   CreateRemoteThread. This technique is seen in several malware like trickbot and
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index 1a2053ed64..edf5f27b62 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will identify a suspicious PowerShell command used to delete
   the Windows Defender folder. This technique was seen used by the WhisperGate malware
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index e422c98ecc..41be205342 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -5,7 +5,7 @@ date: '2021-03-29'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
   functionality is present. This technique variation is not as commonly used by adversaries,
   but has been abused in the past. Lesser known uses include the ability to set the
@@ -62,15 +62,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
index 9b8e8ec53e..73b3d2921e 100644
--- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
+++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-11-25'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will detect a suspicious process commandline related to
   windows defender exclusion feature. This command is abused by adversaries, malware
   author and red teams to bypassed Windows Defender Anti-Virus product by excluding  folder
diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
index 0f7f738483..54aa65d39c 100644
--- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
@@ -5,7 +5,7 @@ date: '2021-06-10'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious bcdedit.exe execution to ignore
   all failures. This technique was used by ransomware to prevent the compromise machine
   automatically boot in repair mode.
@@ -55,15 +55,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
index 5d6179ad55..37337cc0ef 100644
--- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml
+++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: 'The following analytic identifies new printer drivers being load by
   utilizing the Windows PrintService operational logs, EventCode 316. This was identified
   during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
index 3d487d3a09..9cce3bd372 100644
--- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: 'The following analytic identifies driver load errors utilizing the Windows
   PrintService Admin logs. This was identified during our testing of CVE-2021-34527
   previously (CVE-2021-1675) or PrintNightmare. \
diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index ba6febdc56..25799511ff 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -5,8 +5,7 @@ date: '2021-08-26'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: This search looks for a process launching an `*.lnk` file under `C:\User*`
   or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -71,18 +70,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.file_hash
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
-  - Endpoint.Filesystem.user
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_guid
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Filesystem.file_hash
+  - Filesystem.user
   risk_score: 63
   security_domain: network
   supported_tas:
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index 033ac993ba..f507305b83 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2022-02-18'
 author: Teoderick Contreras
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This detection is to identify a suspicious process that tries to delete
   the process file path related to its process. This technique is known to be defense
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
@@ -59,14 +60,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
   - EventCode
-  - Image
-  - ParentCommandLine
-  - ParentImage
-  - ProcessID
-  - _time
-  - result
+  - Computer
   - user
+  - ParentImage
+  - ParentCommandLine
+  - Image
+  - cmdline
+  - ProcessID
+  - result
+  - _time
   risk_score: 60
   security_domain: endpoint
diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index 03864491fc..faec4079dd 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -5,7 +5,7 @@ date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `WmiPrvSE.exe` spawning a process.
   This typically occurs when a process is instantiated from a local or remote process
   using `wmic.exe`. During triage, review parallel processes for suspicious behavior
@@ -63,15 +63,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index e986faf631..335870e7f0 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -5,7 +5,7 @@ date: '2021-05-04'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of `wmic.exe` using `delete`
   to remove a executable path. This is typically ran via a batch file during beginning
   stages of an adversary setting up for mining on an endpoint.
@@ -56,14 +56,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml
index ab1ca7fa76..569355761b 100644
--- a/detections/endpoint/process_writing_dynamicwrapperx.yml
+++ b/detections/endpoint/process_writing_dynamicwrapperx.yml
@@ -5,8 +5,7 @@ date: '2021-10-05'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: DynamicWrapperX is an ActiveX component that can be used in a script
   to call Windows API functions, but it requires the dynwrapx.dll to be installed
   and registered. With that, a binary writing dynwrapx.dll to disk and registering
@@ -77,23 +76,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
-  - Endpoint.Filesystem.user
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
   - dest
-  - file_create_time user
+  - process_name
+  - process_guid
   - file_name
   - file_path
-  - process_guid
-  - process_name
+  - file_create_time user
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index fc6ec0b059..f6ebe63ee3 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -5,7 +5,7 @@ date: '2021-09-16'
 author: Michael Haag, Josef Kuepker, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for processes launching netsh.exe. Netsh is a command-line
   scripting utility that allows you to, either locally or remotely, display or modify
   the network configuration of a computer that is currently running. Netsh can be
@@ -67,14 +67,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml
index 6804b707ce..db1f7434ed 100644
--- a/detections/endpoint/ransomware_notes_bulk_creation.yml
+++ b/detections/endpoint/ransomware_notes_bulk_creation.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-03-12'
 author: Teoderick Contreras
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytics identifies a big number of instance of ransomware
   notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This
   behavior is a good sensor if the ransomware note filename is quite new for security
@@ -56,11 +57,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
   - EventCode
-  - Image
-  - TargetFilename
-  - _time
   - file_name
+  - _time
+  - TargetFilename
+  - Computer
+  - Image
+  - user
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index 3f8f8d1f37..f05c0a88d0 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -5,7 +5,7 @@ date: '2021-06-22'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious commandline designed to delete
   files or directory recursive using batch command. This technique was seen in ransomware
   (reddot) where it it tries to delete the files in recycle bin to impaire user from
@@ -41,14 +41,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index 3261145fc9..dae747c94c 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -5,7 +5,7 @@ date: '2020-11-26'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The search looks for reg.exe modifying registry keys that define Windows
   services and their configurations.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -70,13 +70,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
+  - Processes.dest
   risk_score: 45
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
index 7e0c3cf4ac..1c3534eb54 100644
--- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml
+++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
@@ -4,9 +4,7 @@ version: 4
 date: '2020-01-28'
 author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+datamodel: []
 description: This search looks for registry activity associated with application compatibility
   shims, which can be leveraged by attackers for various nefarious purposes.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
@@ -69,19 +67,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 9ecd8f6462..6958389f31 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
@@ -93,21 +92,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
   risk_score: 76
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
index b2d8f637f8..ef863cb47b 100644
--- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
@@ -4,9 +4,7 @@ version: 5
 date: '2022-01-26'
 author: David Dorsey, Teoderick Contreras, Splunk
 type: TTP
-datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+datamodel: []
 description: This search looks for modifications to registry keys that can be used
   to elevate privileges. The registry keys under "Image File Execution Options" are
   used to intercept calls to an executable and can be used to attach malicious binaries
@@ -76,20 +74,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.dest
+  - Registry.user
   risk_score: 76
   security_domain: endpoint
diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
index 47a5b325ff..013a7e4816 100644
--- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
@@ -5,7 +5,7 @@ date: '2021-10-04'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a loading of dll using regsvr32 application
   with silent parameter and dllinstall execution. This technique was seen in several
   RAT malware similar to remcos, njrat and adversaries to load their malicious DLL
@@ -71,14 +71,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
index 41e3ab3abd..9a2eec50d2 100644
--- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
+++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
@@ -5,7 +5,7 @@ date: '2021-07-27'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies Regsvr32.exe utilizing the silent switch
   to load DLLs. This technique has most recently been seen in IcedID campaigns to
   load its initial dll that will download the 2nd stage loader that will download
@@ -72,14 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml
index 21bd34ab65..17c83f11a9 100644
--- a/detections/endpoint/remcos_client_registry_install_entry.yml
+++ b/detections/endpoint/remcos_client_registry_install_entry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search detects registry key license at host where Remcos RAT agent
   is installed.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
@@ -54,21 +53,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.process_id
+  - Registry.dest
+  - Registry.user
   risk_score: 90
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
index 412bef8481..1184bd9ade 100644
--- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
@@ -5,7 +5,7 @@ date: '2021-09-21'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: This search is to detect file creation in remcos folder in appdata which
   is the keylog and clipboard logs that will be send to its c2 server. This is really
   a good TTP indicator that there is a remcos rat in the system that do keylogging,
@@ -49,10 +49,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
   - _time
   - dest
   - file_create_time
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index 4f6c7c8a4b..4a7362585c 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with arguments
   utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically,
   this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams
@@ -53,14 +53,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index 53609f18c1..fff1f18412 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-11-16'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with arguments
   utilized to start a process on a remote endpoint by abusing the WinRM protocol.
   Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
@@ -54,14 +54,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 45
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 9ec616dd42..2abcf01122 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -5,7 +5,7 @@ date: '2021-11-11'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `winrs.exe` with command-line
   arguments utilized to start a process on a remote endpoint. Red Teams and adversaries
   alike may abuse the WinRM protocol and this binary for lateral movement and remote
@@ -52,15 +52,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index f4d0f99032..2f68f5492b 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Rico Valdez, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies wmic.exe being launched with parameters to spawn
   a process on a remote system. Red Teams and adversaries alike may abuse WMI and
   this binary for lateral movement and remote code execution.
@@ -68,14 +68,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index f2116f1a25..d9ff14079a 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` leveraging
   the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start
   a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may
@@ -52,14 +52,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml
index 9f6619832b..5d6a595a25 100644
--- a/detections/endpoint/remote_system_discovery_with_dsquery.yml
+++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml
@@ -5,7 +5,7 @@ date: '2021-08-31'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to discover remote systems. The `computer` argument returns a
   list of all computers registered in the domain. Red Teams and adversaries alike
@@ -51,12 +51,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml
index f229c27b83..34d963c52f 100644
--- a/detections/endpoint/remote_system_discovery_with_net.yml
+++ b/detections/endpoint/remote_system_discovery_with_net.yml
@@ -5,7 +5,7 @@ date: '2021-08-30'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to discover remote systems. The argument `domain
   computers /domain` returns a list of all domain computers. Red Teams and adversaries
@@ -51,12 +51,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml
index 17ca573b6d..092c163d81 100644
--- a/detections/endpoint/remote_system_discovery_with_wmic.yml
+++ b/detections/endpoint/remote_system_discovery_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-09-01'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to discover remote systems. The arguments utilized in this command
   return a list of all the systems registered in the domain. Red Teams and adversaries
@@ -52,13 +52,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index 5134ac26fb..b88e03dead 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -5,7 +5,7 @@ date: '2018-12-03'
 author: Rico Valdez, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies usage of `wmic.exe` spawning a local
   or remote process, identified by the `node` switch. During triage, review parallel
   processes for additional commands executed. Look for any file modifications before
@@ -66,14 +66,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.parent_process_id
+  - Processes.process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml
index 98c573e05e..ecbd7e4c63 100644
--- a/detections/endpoint/resize_shadowstorage_volume.yml
+++ b/detections/endpoint/resize_shadowstorage_volume.yml
@@ -5,7 +5,7 @@ date: '2021-03-12'
 author: Teoderick Contreras
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytics identifies the resizing of shadowstorage by ransomware
   malware to avoid the shadow volumes being made again. this technique is an alternative
   by ransomware attacker than deleting the shadowstorage which is known alert in defensive
@@ -64,15 +64,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.process
+  - Process.parent_process_name
   - _time
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml
index 2bb4f09c93..b48aa0033c 100644
--- a/detections/endpoint/revil_common_exec_parameter.yml
+++ b/detections/endpoint/revil_common_exec_parameter.yml
@@ -5,7 +5,7 @@ date: '2021-06-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies suspicious commandline parameter that are commonly
   used by REVIL ransomware to encrypts the compromise machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -56,15 +56,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml
index c51c42758a..d24975ae03 100644
--- a/detections/endpoint/revil_registry_entry.yml
+++ b/detections/endpoint/revil_registry_entry.yml
@@ -5,8 +5,7 @@ date: '2021-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic identifies suspicious modification in registry entry to
   keep some malware data during its infection. This technique seen in several apt
   implant, malware and ransomware like REVIL where it keep some information like the
@@ -64,20 +63,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_path
+  - Registry.registry_key_name
   risk_score: 60
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index 0d33a9eb7f..d73d45add5 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -5,7 +5,7 @@ date: '2022-02-01'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is
   heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin
   project. This analytic looks for the use of Rubeus command line arguments utilized
@@ -73,14 +73,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
index 71c80d6970..3558058c97 100644
--- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -64,12 +64,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Computer
+  - _time
   - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
   - SourceImage
   - SourceProcessId
-  - TargetImage
-  - TargetProcessId
-  - _time
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml
index 94d34e3ad9..d7fefc7c3e 100644
--- a/detections/endpoint/runas_execution_in_commandline.yml
+++ b/detections/endpoint/runas_execution_in_commandline.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic look for a spawned runas.exe process with a administrator
   user option parameter. This parameter was abused by adversaries, malware author
   or even red teams to gain elevated privileges in target host. This is a good hunting
@@ -55,14 +55,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 611f3e9edc..3e2e0dfb3b 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting detection identifies rundll32.exe with `control_rundll`
   within the command-line, loading a .cpl or another file type. Developed in relation
   to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files
@@ -76,13 +76,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index 3d089e145f..e22be31c8a 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -5,7 +5,7 @@ date: '2021-09-08'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies rundll32.exe with `control_rundll`
   within the command-line, loading a .cpl or another file type from windows\temp,
   programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can
@@ -78,14 +78,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
index 0f1c87ef17..aef668eded 100644
--- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-29'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
   process to cmd.exe process. This technique was seen in IcedID malware to execute
   its malicious code in normal process for defense evasion and to steal sensitive
diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml
index 64fd76cd9a..5c16b5d6d6 100644
--- a/detections/endpoint/rundll32_createremotethread_in_browser.yml
+++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
   process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID
   malware where it hooks the browser to parse banking information as user used the
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index 4e1a7b94b7..cfb2f9d846 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2022-02-18'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious rundll32.exe process having a http
   connection and do a dns query in some web domain. This technique was seen in IcedID
   malware where the rundll32 that execute its payload will contact amazon.com to check
diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
index 777dbdc246..b23c0499f3 100644
--- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
+++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious rundll32 process that drops executable
   (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
   to drop copy of itself in temp folder or download executable drop it either appdata
diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml
index de1f4618ed..845bd66115 100644
--- a/detections/endpoint/rundll32_shimcache_flush.yml
+++ b/detections/endpoint/rundll32_shimcache_flush.yml
@@ -5,7 +5,7 @@ date: '2021-10-05'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious rundll32 commandline to clear
   shim cache. This technique is a anti-forensic technique to clear the cache taht
   are one important artifacts in terms of digital forensic during attacks or incident.
@@ -55,15 +55,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
index 82b48ce8be..632a790430 100644
--- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
@@ -5,8 +5,7 @@ date: '2021-10-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments
   and performing a network connection. It is unusual for rundll32.exe to execute with
   no command line arguments present. This particular behavior is common with malicious
@@ -73,17 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 6e331e09e1..39ea9b205b 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -5,7 +5,7 @@ date: '2022-02-08'
 author: Michael Haag, David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe loading an export function
   by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious
   code. Using rundll32.exe, vice executing directly, may avoid triggering security
@@ -68,14 +68,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml
index 3646aa00d8..0ac5fe69ae 100644
--- a/detections/endpoint/ryuk_test_files_detected.yml
+++ b/detections/endpoint/ryuk_test_files_detected.yml
@@ -4,13 +4,12 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint.Filesystem
+datamodel: []
 description: The search looks for files that contain the key word *Ryuk* under any
   folder in the C drive, which is consistent with Ryuk propagation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem WHERE Filesystem.file_path="C:\\*Ryuk*""
-  BY Filesystem.dest, Filesystem.user, Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk*
+  BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`'
 how_to_implement: You must be ingesting data that records the filesystem activity
   from your hosts to populate the Endpoint Filesystem data-model object. If you are
@@ -56,5 +55,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Filesystem.user
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index e78adcfb45..684c485717 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -5,7 +5,7 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk
   ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered
   off devices on a compromised network to have greater success encrypting them. This
@@ -62,14 +62,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml
index dbce04e31c..c53d34754b 100644
--- a/detections/endpoint/sam_database_file_access_attempt.yml
+++ b/detections/endpoint/sam_database_file_access_attempt.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-23'
 author: Michael Haag, Mauricio Velazco, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases'
   within the file path of `windows\system32\config` using Windows Security EventCode
   4663. This particular behavior is related to credential access, an attempt to either
@@ -66,9 +67,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - _time
+  - process_name
   - Object_Name
   - dest
-  - process_name
   - user
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml
index 72d6290e38..17516b0b39 100644
--- a/detections/endpoint/samsam_test_file_write.yml
+++ b/detections/endpoint/samsam_test_file_write.yml
@@ -5,7 +5,7 @@ date: '2018-12-14'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
+- Endpoint
 description: The search looks for a file named "test.txt" written to the windows system
   directory tree, which is consistent with Samsam propagation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -55,11 +55,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.user
   - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.file_path
   risk_score: 12
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml
index 0d06f72f75..daec04b402 100644
--- a/detections/endpoint/sc_exe_manipulating_windows_services.yml
+++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml
@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for arguments to sc.exe indicating the creation or
   modification of a Windows service.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -70,12 +70,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
index bce5ac1dfa..d627f66d3c 100644
--- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-09-07'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic is to detect an application try to connect and create ADSI
   Object to do LDAP query. Every time an application connects to the directory and
   attempts to create an ADSI object, the Active Directory Schema is checked for changes.
diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml
index a796283cb4..955ca654b2 100644
--- a/detections/endpoint/schedule_task_with_http_command_arguments.yml
+++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
index f7ed8b0f03..9e00f1bc79 100644
--- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
+++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a Rundll32. This
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 87a3d1231b..1a20a684f4 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -5,7 +5,7 @@ date: '2021-11-11'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `at.exe` with command-line arguments
   utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries
   alike may abuse the Task Scheduler for lateral movement and remote code execution.
@@ -54,15 +54,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 657a0f540c..72b31f9060 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -5,7 +5,7 @@ date: '2022-02-22'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the creation or deletion of a scheduled
   task using schtasks.exe with flags - create or delete being passed on the command-line.
   This has been associated with the Dragonfly threat actor, and the SUNBURST attack
@@ -66,13 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index d053085f2d..8860f35c80 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -5,7 +5,7 @@ date: '2021-11-11'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `schtasks.exe` with command-line
   arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and
   adversaries alike may abuse the Task Scheduler for lateral movement and remote code
@@ -51,15 +51,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index 6de86e4725..263758ac10 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -5,7 +5,7 @@ date: '2021-05-07'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies an on demand run of a Windows Schedule Task
   through shell or command-line. This technique has been used by adversaries that
   force to run their created Schedule Task as their persistence mechanism or for lateral
@@ -57,13 +57,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 48
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index b061bc788a..a7d455035f 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -5,7 +5,7 @@ date: '2021-11-11'
 author: David Dorsey, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `schtasks.exe` with command-line
   arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and
   adversaries alike may abuse the Task Scheduler for lateral movement and remote code
@@ -65,13 +65,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index 9beee8f3f1..053b428c8e 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -5,7 +5,7 @@ date: '2020-12-07'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for flags passed to schtasks.exe on the command-line
   that indicate that a forced reboot of system is scheduled.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -62,12 +62,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml
index 7a289dbcbf..003016f8c8 100644
--- a/detections/endpoint/screensaver_event_trigger_execution.yml
+++ b/detections/endpoint/screensaver_event_trigger_execution.yml
@@ -5,7 +5,7 @@ date: '2021-09-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: This analytic is developed to detect possible event trigger execution
   through screensaver registry entry modification for persistence or privilege escalation.
   This technique was seen in several APT and malware where they put the malicious
@@ -59,12 +59,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 572255ea8c..ac87865b4c 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -5,7 +5,7 @@ date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for scripts launched via WMI.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
@@ -59,14 +59,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   risk_score: 36
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml
index af0139d910..cf395a7332 100644
--- a/detections/endpoint/sdclt_uac_bypass.yml
+++ b/detections/endpoint/sdclt_uac_bypass.yml
@@ -5,8 +5,7 @@ date: '2020-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a suspicious sdclt.exe registry modification.
   This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe
   application by modifying some registry that sdclt.exe tries to open or query with
@@ -65,21 +64,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml
index 1419f4c0ac..8b57213736 100644
--- a/detections/endpoint/sdelete_application_execution.yml
+++ b/detections/endpoint/sdelete_application_execution.yml
@@ -5,7 +5,7 @@ date: '2021-10-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect the execution of sdelete.exe application sysinternal
   tools. This tool is one of the most use tool of malware and adversaries to remove
   or clear their tracks and artifact in the targetted host. This tool is designed
@@ -59,15 +59,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 517b5fc9b6..54f3073620 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -5,8 +5,7 @@ date: '2021-10-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments and with a network connection. It is unusual for searchprotocolhost.exe
   to execute with no command line arguments present. This particular behavior is common
@@ -62,19 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
-  - dest_port
-  - parent_process_name
   - process_name
+  - process_id
+  - parent_process_name
+  - dest_port
   - process_path
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
index 84fe6d52ad..9a46d7b579 100644
--- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
+++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
@@ -5,7 +5,7 @@ date: '2021-05-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic detects a potential usage of secretsdump.py tool for dumping
   credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry
   hive. This technique was seen in some attacker that dump ntlm hashes offline after
@@ -57,15 +57,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_id
+  - Processes.process_guid
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index 841e636ae1..63098b3965 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -86,5 +86,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index c59bdef93b..8e3be8fa03 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -5,7 +5,7 @@ date: '2021-10-14'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies `setspn.exe` usage related to querying
   the domain for Service Principle Names. typically, this is a precursor activity
   related to kerberoasting or the silver ticket attack. \
@@ -94,15 +94,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml
index 3511dacf38..f1f7aa5fe7 100644
--- a/detections/endpoint/services_escalate_exe.yml
+++ b/detections/endpoint/services_escalate_exe.yml
@@ -5,7 +5,7 @@ date: '2021-05-18'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of `svc-exe` with Cobalt Strike.
   The behavior typically follows after an adversary has already gained initial access
   and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded
@@ -65,16 +65,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 76
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
index cc3ec5a1ac..7e4b21420b 100644
--- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
@@ -65,15 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index 178aab01fd..abb769c084 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -5,7 +5,7 @@ date: '2022-02-18'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -64,11 +64,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 48
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml
index b5fe03b7b4..a29923fe90 100644
--- a/detections/endpoint/shim_database_file_creation.yml
+++ b/detections/endpoint/shim_database_file_creation.yml
@@ -4,8 +4,7 @@ version: 3
 date: '2020-12-08'
 author: David Dorsey, Splunk
 type: TTP
-datamodel:
-- Endpoint.Filesystem
+datamodel: []
 description: This search looks for shim database files being written to default directories.
   The sdbinst.exe application is used to install shim database files (.sdb). According
   to Microsoft, a shim is a small library that transparently intercepts an API, changes
@@ -61,11 +60,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.action
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_hash
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
   - _time
+  - Filesystem.file_hash
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.dest
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
index 9e605fbf35..d8ac0829e0 100644
--- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
+++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
@@ -5,7 +5,7 @@ date: '2020-11-23'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search detects the process execution and arguments required to silently
   create a shim database.  The sdbinst.exe application is used to install shim database
   files (.sdb). A shim is a small library which transparently intercepts an API, changes
@@ -61,12 +61,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
index 487bc4f58c..260ed20cce 100644
--- a/detections/endpoint/short_lived_scheduled_task.yml
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -56,10 +56,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Account_Name
-  - Command
-  - ComputerName
-  - Task_Name
   - _time
+  - dest
+  - ComputerName
+  - Account_Name
+  - Task_Name
+  - Description
+  - Command
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml
index 7b2b98561c..839c7fb59b 100644
--- a/detections/endpoint/short_lived_windows_accounts.yml
+++ b/detections/endpoint/short_lived_windows_accounts.yml
@@ -5,7 +5,7 @@ date: '2020-07-06'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Change.All_Changes
+- Change
 description: This search detects accounts that were created and deleted in a short
   time period.
 search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
@@ -57,9 +57,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Change.All_Changes.dest
-  - Change.All_Changes.result_id
-  - Change.All_Changes.user
   - _time
+  - All_Changes.result_id
+  - All_Changes.user
+  - All_Changes.dest
   risk_score: 63
   security_domain: access
diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml
index 946658479d..c1a9885737 100644
--- a/detections/endpoint/silentcleanup_uac_bypass.yml
+++ b/detections/endpoint/silentcleanup_uac_bypass.yml
@@ -5,8 +5,7 @@ date: '2020-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a suspicious modification of registry that may
   related to UAC bypassed. This registry will be trigger once the attacker abuse the
   silentcleanup task schedule to gain high privilege execution that will bypass User
@@ -63,21 +62,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml
index 19b30727bd..2d4277a1f6 100644
--- a/detections/endpoint/single_letter_process_on_endpoint.yml
+++ b/detections/endpoint/single_letter_process_on_endpoint.yml
@@ -5,7 +5,7 @@ date: '2020-12-08'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for process names that consist only of a single letter.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user,
@@ -59,11 +59,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_name
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml
index 92608a086d..fce44aa6e2 100644
--- a/detections/endpoint/slui_runas_elevated.yml
+++ b/detections/endpoint/slui_runas_elevated.yml
@@ -5,7 +5,7 @@ date: '2021-05-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the Microsoft Software Licensing User
   Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This
   particular bypass utilizes a registry key/value. Identified by two sources, the
@@ -62,14 +62,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml
index e75d82e0aa..0fa2eac2c0 100644
--- a/detections/endpoint/slui_spawning_a_process.yml
+++ b/detections/endpoint/slui_spawning_a_process.yml
@@ -5,7 +5,7 @@ date: '2021-05-13'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the Microsoft Software Licensing User
   Interface Tool, `slui.exe`, spawning a child process. This behavior is associated
   with publicly known UAC bypass. `slui.exe` is commonly associated with software
@@ -60,15 +60,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml
index f0b762b0ac..8f7e3d5acc 100644
--- a/detections/endpoint/spoolsv_spawning_rundll32.yml
+++ b/detections/endpoint/spoolsv_spawning_rundll32.yml
@@ -5,7 +5,7 @@ date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a suspicious child process, `rundll32.exe`,
   with no command-line arguments being spawned from `spoolsv.exe`. This was identified
   during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
@@ -70,16 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
index a753245fe3..216dd6aa45 100644
--- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
+++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect suspicious loading of dll in specific path relative
   to printnightmare exploitation. In this search we try to detect the loaded modules
   made by spoolsv.exe after the exploitation.
diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml
index 5c36ef9248..ba666c3153 100644
--- a/detections/endpoint/spoolsv_suspicious_process_access.yml
+++ b/detections/endpoint/spoolsv_suspicious_process_access.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies a suspicious behavior related to PrintNightmare,
   or CVE-2021-34527 previously (CVE-2021-1675),  to gain privilege escalation on the
   vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability
diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml
index 9be42bbd3a..f296a79eee 100644
--- a/detections/endpoint/spoolsv_writing_a_dll.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll.yml
@@ -5,8 +5,7 @@ date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
   This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675)
   or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write
@@ -71,14 +70,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
   - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
index c8fe423696..51bddc63a6 100644
--- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
   This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675)
   or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write
diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml
index 8325373ec9..4bb923bf27 100644
--- a/detections/endpoint/sqlite_module_in_temp_folder.yml
+++ b/detections/endpoint/sqlite_module_in_temp_folder.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-08-03'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious file creation of sqlite3.dll in
   %temp% folder. This behavior was seen in IcedID malware where it download sqlite
   module to parse browser database like for chrome or firefox to stole browser information
diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
index 0ecdbe7515..7e2e1427db 100644
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ b/detections/endpoint/start_up_during_safe_mode_boot.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a modification or registry add to the safeboot
   registry as an autostart mechanism. This technique was seen in some ransomware to
   automatically execute its code upon a safe mode boot.
@@ -60,20 +59,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index a384c1a139..fd5671bb4e 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-12-20'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a
   new computer account name and rename it to match the name of a domain controller
diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml
index 73106c8f72..790e3c976f 100644
--- a/detections/endpoint/suspicious_copy_on_system32.yml
+++ b/detections/endpoint/suspicious_copy_on_system32.yml
@@ -5,7 +5,7 @@ date: '2021-10-05'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious copy of file from systemroot
   folder of the windows OS. This technique is commonly used by APT or other malware
   as part of execution (LOLBIN) to run its malicious code using the available legitimate
@@ -58,14 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index 190a52e933..3e39f5d928 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies DLLHost.exe with no command line arguments.
   It is unusual for DLLHost.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -60,13 +60,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml
index a19ab1c39f..10a0bada0e 100644
--- a/detections/endpoint/suspicious_driver_loaded_path.yml
+++ b/detections/endpoint/suspicious_driver_loaded_path.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-29'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will detect suspicious driver loaded paths. This technique
   is commonly used by malicious software like coin miners (xmrig) to register its
   malicious driver from notable directories where executable or drivers do not commonly
diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 9745702022..36e0a60730 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -59,13 +59,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
index 6f6b7742e1..8575a27f5d 100644
--- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
@@ -5,7 +5,7 @@ date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious rundll32.exe commandline to execute
   dll file. This technique was seen in IcedID malware to load its payload dll with
   the following parameter to load encrypted dll payload which is the license.dat.
@@ -55,15 +55,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
index 732e8e63bb..cc90d22e6e 100644
--- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
@@ -5,8 +5,7 @@ date: '2021-09-21'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious creation of image in appdata folder
   made by process that also has a file reference in appdata folder. This technique
   was seen in remcos rat that capture screenshot of the compromised machine and place
@@ -61,22 +60,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
   - dest
   - file_create_time
   - file_name
   - file_path
-  - process
   - process_name
   - process_path
+  - process
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index 62eced7a50..eb1dccb291 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-12-20'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and
   obtain a Kerberos Service Ticket (TGS) with a domain controller computer account
diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
index b79d364c53..1740cfb0b7 100644
--- a/detections/endpoint/suspicious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -5,7 +5,7 @@ date: '2021-12-06'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'This search, detects execution of suspicious bash commands from various
   commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery
   of possible paths of privilege execution, password files, vulnerable directories,
@@ -58,11 +58,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.process_name
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index b7c10f6c56..94eaa1d5b8 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
   Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
@@ -71,14 +71,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index b1de590a99..3b400ef260 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies microsoft.workflow.compiler.exe usage.
   microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
@@ -61,13 +61,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 3e8cf55641..a5d11e2305 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies msbuild.exe executing from a non-standard
   path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319
   and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio
@@ -72,14 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 4fbc4c90bc..fdb7e16f85 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies renamed instances of msbuild.exe executing.
   Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index eb4a09fdc7..eb3153be52 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
   This behavior is indicative of a COM object being utilized to spawn msbuild from
   wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
@@ -67,14 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 6ad540e17b..95b4ff024d 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -5,7 +5,7 @@ date: '2021-01-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies child processes spawning from  "mshta.exe".
   The search will return the first time and last time these command-line arguments
   were used for these executions, as well as the target system, the user, parent process
@@ -70,13 +70,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   risk_score: 40
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index 232b041ac7..fb276a88f8 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-01-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This
   behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe
   or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn
@@ -61,14 +61,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
index 9c0bc559a5..5edadd08ce 100644
--- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2022-01-18'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic detects a suspicious process making a DNS query via known,
   abused text-paste web services, VoIP, instant messaging, and digital distribution
   platforms used to download external files. This technique is abused by adversaries,
diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index ea92e0eceb..ce259ece01 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -5,7 +5,7 @@ date: '2021-05-05'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic will detect a suspicious process running in a
   file path where a process is not commonly seen and is most commonly used by malicious
   software. This behavior has been used by adversaries where they drop and run an
@@ -65,14 +65,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_path
+  - Processes.dest
+  - Processes.user
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml
index a47b1cf8f2..25b462deef 100644
--- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml
+++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-01-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies a process making a DNS query to Discord, a well
   known instant messaging and digital distribution platform. Discord can be abused
   by adversaries, as seen in the WhisperGate campaign, to host and download malicious.
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index 1b2ba1e920..fd7c536250 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -5,8 +5,7 @@ date: '2020-07-22'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Processes
+- Endpoint
 description: This search looks for reg.exe being launched from a command prompt not
   started by the user. When a user launches cmd.exe, the parent process is usually
   explorer.exe. This search filters out those instances.
@@ -69,13 +68,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index c3405b7fe0..656aa2d5cb 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -5,7 +5,7 @@ date: '2021-01-28'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
   by using non-standard file extensions to load malciious DLLs. Upon investigating,
   look for network connections to remote destinations (internal or external). Review
@@ -74,15 +74,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 827b20cb7e..19e3560a01 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -5,7 +5,7 @@ date: '2021-02-09'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe using dllregisterserver
   on the command line to load a DLL. When a DLL is registered, the DllRegisterServer
   method entry point in the DLL is invoked. This is typically seen when a DLL is being
@@ -74,15 +74,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index ef44a1d3c0..b0ddab468c 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -5,7 +5,7 @@ date: '2021-07-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious rundll32.exe process with plugininit
   parameter. This technique is commonly seen in IceID malware to execute its initial
   dll stager to download another payload to the compromised machine.
@@ -55,16 +55,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index 21df108fca..c5e148e8c0 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -5,7 +5,7 @@ date: '2021-02-04'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe executing a DLL function
   name, Start and StartW, on the command line that is commonly observed with Cobalt
   Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32
@@ -75,15 +75,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index cb593db328..ee2bce6a7c 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
@@ -73,13 +73,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 561b59aa04..c663f88758 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -5,7 +5,7 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Scheduled Tasks registering (creating
   a new task) a binary or script to run from a public directory which includes users\public,
   \programdata\ and \windows\temp. Upon triage, review the binary or script in the
@@ -62,14 +62,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 092b7ac379..a804c6b96f 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -5,7 +5,7 @@ date: '2021-09-20'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments. It is unusual for searchprotocolhost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -60,13 +60,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
index 4423f7d1f6..9bafa5a48c 100644
--- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
+++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-12-21'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request
   a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed
diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
index f8b475d091..977bc81441 100644
--- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
@@ -5,8 +5,7 @@ date: '2021-09-21'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious creation of .wav file in appdata
   folder. This behavior was seen in Remcos RAT malware where it put the audio recording
   in the appdata\audio folde as part of data collection. this recording can be send
@@ -60,22 +59,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
   - dest
   - file_create_time
   - file_name
   - file_path
-  - process
   - process_name
   - process_path
+  - process
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml
index 6d967dc390..ed1d109a7c 100644
--- a/detections/endpoint/suspicious_wevtutil_usage.yml
+++ b/detections/endpoint/suspicious_wevtutil_usage.yml
@@ -5,7 +5,7 @@ date: '2021-10-11'
 author: David Dorsey, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The wevtutil.exe application is the windows event log utility. This searches
   for wevtutil.exe with parameters for clearing the application, security, setup,
   trace or system event logs.
@@ -69,12 +69,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 28
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
index 60bab4d380..df4adae9be 100644
--- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
+++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
@@ -4,9 +4,7 @@ version: 4
 date: '2020-07-22'
 author: Rico Valdez, Splunk
 type: TTP
-datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+datamodel: []
 description: This search detects writes to the recycle bin by a process other than
   explorer.exe.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -58,15 +56,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_id
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.process_id
+  - Filesystem.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.dest
   risk_score: 28
   security_domain: endpoint
diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index 7541198ce2..e4ff7baa92 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
@@ -64,14 +64,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
index 37732ac215..25f594ec14 100644
--- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
+++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
@@ -5,7 +5,7 @@ date: '2021-11-19'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious dxdiag.exe process command-line
   execution. Dxdiag is used to collect the system info of the target host. This technique
   has been used by Remcos RATS, various actors, and other malware to collect information
@@ -59,14 +59,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index 324d3b0e98..cba2897e4b 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -5,7 +5,7 @@ date: '2021-09-07'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -59,12 +59,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.user
+  - Processes.process_name
+  - Processes.dest
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index 6e8ea9f806..09b9bc2061 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -5,7 +5,7 @@ date: '2020-12-08'
 author: David Dorsey, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'This search looks for system processes that typically execute from `C:\Windows\System32\`
   or `C:\Windows\SysWOW64`.  This may indicate a malicious process that is trying
   to hide as a legitimate process.\
@@ -72,16 +72,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_hash
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_path
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_name
+  - Processes.process_hash
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index 1b0d4e2656..f5f1790f84 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `query.exe` with command-line
   arguments utilized to discover the logged user. Red Teams and adversaries alike
   may leverage `query.exe` to identify system users on a compromised endpoint for
@@ -49,13 +49,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 5f8a7448a7..2091cb5a3d 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `whoami.exe` without any arguments.
   This windows native binary prints out the current logged user. Red Teams and adversaries
   alike may leverage `whoami.exe` to identify system users on a compromised endpoint
@@ -48,13 +48,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml
index f1c4f3a888..42cbd1ab82 100644
--- a/detections/endpoint/time_provider_persistence_registry.yml
+++ b/detections/endpoint/time_provider_persistence_registry.yml
@@ -5,8 +5,7 @@ date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to detect a suspicious modification of time provider
   registry for persistence and autostart. This technique can allow the attacker to
   persist on the compromised host and autostart as soon as the machine boot up. This
@@ -67,20 +66,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml
index b50473a608..29ba31c3c0 100644
--- a/detections/endpoint/trickbot_named_pipe.yml
+++ b/detections/endpoint/trickbot_named_pipe.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-26'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search is to detect potential trickbot infection through the create/connected
   named pipe to the system. This technique is used by trickbot to communicate to its
   c2 to post or get command during infection.
diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
index 6a4fe5a9ea..6949009607 100644
--- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-07-12'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a suspicious loaded unsigned dll by MMC.exe
   application. This technique is commonly seen in attacker that tries to bypassed
   UAC feature or gain privilege escalation. This is done by modifying some CLSID registry
diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
index 5513bf8cb2..965e53bb2e 100644
--- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml
+++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-08-13'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This search is to detect a possible uac bypass using the colorui.dll
   COM Object. this technique was seen in so many malware and ransomware like lockbit
   where it make use of the colorui.dll COM CLSID to bypass UAC.
diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index bb22fddbd3..5cedb020fb 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This detection identifies Microsoft Exchange Server's Unified Messaging
   services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating
   possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe
@@ -61,15 +61,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml
index fe18bda78c..83fa05eb28 100644
--- a/detections/endpoint/uninstall_app_using_msiexec.yml
+++ b/detections/endpoint/uninstall_app_using_msiexec.yml
@@ -5,7 +5,7 @@ date: '2021-08-09'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious un-installation of application
   using msiexec. This technique was seen in conti leak tool and script where it tries
   to uninstall AV product using this commandline. This commandline to uninstall product
@@ -54,14 +54,15 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml
index 083319126a..2327a5c01f 100644
--- a/detections/endpoint/unload_sysmon_filter_driver.yml
+++ b/detections/endpoint/unload_sysmon_filter_driver.yml
@@ -5,7 +5,7 @@ date: '2020-07-22'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: Attackers often disable security tools to avoid detection. This search
   looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop
   sysmon from collecting the data.
@@ -56,13 +56,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 45
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
index 0bddcc846d..a99d58f466 100644
--- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -57,10 +57,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Client_Address
-  - EventCode
-  - Service_Name
-  - Ticket_Encryption_Type
   - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - Service_Name
+  - service_id
+  - Client_Address
   risk_score: 36
   security_domain: endpoint
diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
index 75b9d555cd..b7fef38a56 100644
--- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments that leverage PowerShell environment variables to identify the current
   logged user. Red Teams and adversaries may leverage this method to identify the
@@ -50,13 +50,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index f387fb8767..cfa68d3777 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -47,10 +47,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - ComputerName
-  - EventCode
-  - Message
-  - User
   - _time
+  - Path
+  - Message
+  - OpCode
+  - ComputerName
+  - User
+  - EventCode
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml
index 0a5e107d7d..d02e6ba8a7 100644
--- a/detections/endpoint/usn_journal_deletion.yml
+++ b/detections/endpoint/usn_journal_deletion.yml
@@ -5,7 +5,7 @@ date: '2018-12-03'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The fsutil.exe application is a legitimate Windows utility used to perform
   tasks related to the file allocation table (FAT) and NTFS file systems. The update
   sequence number (USN) change journal provides a log of all changes made to the files
@@ -61,13 +61,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   risk_score: 45
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml
index 792518fb8b..a80dd8e2b8 100644
--- a/detections/endpoint/vbscript_execution_using_wscript_app.yml
+++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml
@@ -5,7 +5,7 @@ date: '2021-10-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious wscript commandline to execute
   vbscript. This technique was seen in several malware to execute malicious vbs file
   using wscript application. commonly vbs script is associated to cscript process
@@ -58,14 +58,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml
index 5f85325225..103b742d69 100644
--- a/detections/endpoint/verclsid_clsid_execution.yml
+++ b/detections/endpoint/verclsid_clsid_execution.yml
@@ -5,7 +5,7 @@ date: '2021-09-29'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a possible abuse of verclsid to execute malicious
   file through generate CLSID. This process is a normal application of windows to
   verify the CLSID COM object before it is instantiated by Windows Explorer. This
@@ -61,14 +61,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index b16caaeb08..850cdb5cb6 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -5,7 +5,7 @@ date: '2021-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from
   W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will
   capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs,
@@ -66,14 +66,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index b42d08fdaf..6f5715c80a 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -5,7 +5,7 @@ date: '2021-01-22'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
   Tool) that delete backup files. This is typically used by ransomware to prevent
   recovery.
@@ -56,12 +56,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   risk_score: 15
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml
index 13f5d02823..91f61b3952 100644
--- a/detections/endpoint/wbemprox_com_object_execution.yml
+++ b/detections/endpoint/wbemprox_com_object_execution.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-06-02'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search is designed to detect potential malicious process loading
   COM object to wbemprox.dll,
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll",
diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
index 2495ddddd6..4bd094af25 100644
--- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
+++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search is designed to detect suspicious wermgr.exe process that
   tries to connect to known IP web services. This technique is know for trickbot and
   other trojan spy malware to recon the infected machine and look for its ip address
diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml
index 7a9fd59167..dbcd1ec45c 100644
--- a/detections/endpoint/wermgr_process_create_executable_file.yml
+++ b/detections/endpoint/wermgr_process_create_executable_file.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: this search is designed to detect potential malicious wermgr.exe process
   that drops or create executable file. Since wermgr.exe is an application trigger
   when error encountered in a process, it is really un ussual to this process to drop
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 7b5b9e10cd..371cf2a000 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -5,7 +5,7 @@ date: '2021-04-19'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is designed to detect suspicious cmd and powershell process
   spawned by wermgr.exe process. This suspicious behavior are commonly seen in code
   injection technique technique like trickbot to execute a shellcode, dll modules
@@ -52,16 +52,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml
index 8ab116d0da..4d1a88f5dc 100644
--- a/detections/endpoint/wget_download_and_bash_execution.yml
+++ b/detections/endpoint/wget_download_and_bash_execution.yml
@@ -5,7 +5,7 @@ date: '2021-12-11'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of wget on Linux or MacOS attempting
   to download a file from a remote source and pipe it to bash. This is typically found
   with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
@@ -65,13 +65,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index 4f77508f7b..a4dd560dc1 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -5,7 +5,7 @@ date: '2021-11-03'
 author: Jose Hernandez, Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'This search looks for the execution of `adfind.exe` with command-line
   arguments that it uses by default. Specifically the filter or search functions.
   It also considers the arguments necessary like objectcategory, see readme for more
@@ -49,14 +49,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index cdf3b0533c..5f9705d849 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -5,7 +5,7 @@ date: '2021-10-19'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the use of Windows Curl.exe downloading
   a file to a suspicious location. \
 
@@ -72,15 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index e9b492b579..65afeffe87 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -5,7 +5,7 @@ date: '2021-11-10'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the use of Windows Curl.exe uploading
   a file to a remote destination. \
 
@@ -80,15 +80,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
index d592c7a17e..f3a273dcc7 100644
--- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml
+++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
@@ -5,8 +5,7 @@ date: '2021-11-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic will detect a suspicious process that modify a registry
   related to windows defender exclusion feature. This registry is abused by adversaries,
   malware author and red teams to bypassed Windows Defender Anti-Virus product by
@@ -67,20 +66,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.registry_value_data
   risk_score: 64
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml
index 6e0fb74928..8919734d8e 100644
--- a/detections/endpoint/windows_disable_memory_crash_dump.yml
+++ b/detections/endpoint/windows_disable_memory_crash_dump.yml
@@ -5,8 +5,7 @@ date: '2022-02-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: The following analytic identifies a process that is attempting to disable
   the ability on Windows to generate a memory crash dump. This was recently identified
   being utilized by HermeticWiper. To disable crash dumps, the value must be set to
@@ -81,20 +80,19 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index f080e9860b..62174a5077 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -5,7 +5,7 @@ date: '2021-03-02'
 author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Registry
+- Endpoint
 description: The search looks for the Registry Key DisableAntiSpyware set to disable.
   This is consistent with Ryuk infections across a fleet of endpoints. This particular
   behavior is typically executed when an ransomware actor gains access to an endpoint
@@ -60,12 +60,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
   risk_score: 24
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml
index 0d2299b789..930e28b5db 100644
--- a/detections/endpoint/windows_diskcryptor_usage.yml
+++ b/detections/endpoint/windows_diskcryptor_usage.yml
@@ -5,7 +5,7 @@ date: '2021-11-15'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies DiskCryptor  process name of dcrypt.exe
   or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt
   disks manually during an operation. In addition, during install, a dcrypt.sys driver
@@ -67,14 +67,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml
index 9b7a1f75c8..e14b14e20f 100644
--- a/detections/endpoint/windows_diskshadow_proxy_execution.yml
+++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml
@@ -5,7 +5,7 @@ date: '2022-02-15'
 author: Lou Stella, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
   It has a scripting mode intended for complex scripted backup operations. This feature
   also allows for execution of arbitrary unsigned code. This analytic looks for the
@@ -57,13 +57,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.process
+  - Porcesses.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.original_file_name
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
index ad638aa9ca..9cc4c5bafe 100644
--- a/detections/endpoint/windows_dism_remove_defender.yml
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -5,7 +5,7 @@ date: '2021-11-17'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of the Windows Disk Image Utility,
   `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable
   Defender before completing their objective.
@@ -65,15 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: access
   supported_tas:
diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index 24211f4f78..cb6ed79777 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -5,7 +5,7 @@ date: '2022-01-19'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies native .net binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
   The analytic identifies the .net binary by using a lookup and compares the process
@@ -81,16 +81,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml
index 8795ebbe6f..58405c141f 100644
--- a/detections/endpoint/windows_event_for_service_disabled.yml
+++ b/detections/endpoint/windows_event_for_service_disabled.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-02-23'
 author: Teoderick Contreras, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will identify suspicious system event of services that
   was modified from start to disabled. This technique is seen where the adversary
   attempts to disable security app services, other malware services to evade the defense
diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml
index 8105917a5c..35816e80a5 100644
--- a/detections/endpoint/windows_excessive_disabled_services_event.yml
+++ b/detections/endpoint/windows_excessive_disabled_services_event.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-02-23'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic will identify suspicious excessive number of system events
   of services that was modified from start to disabled. This technique is seen where
   the adversary attempts to disable security app services, other malware services
diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
index 1a58b570bf..971856d53c 100644
--- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
@@ -5,8 +5,7 @@ date: '2022-02-25'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Endpoint.Filesystem
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for suspicious file creation in the critical
   folder like "System32\Drivers" folder without file extension. This artifacts was
   seen in latest hermeticwiper where it drops its driver component in Driver Directory
@@ -63,16 +62,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Filesystem.dest
-  - Endpoint.Filesystem.file_create_time
-  - Endpoint.Filesystem.file_name
-  - Endpoint.Filesystem.file_path
-  - Endpoint.Filesystem.process_guid
-  - Endpoint.Filesystem.user
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Filesystem.file_create_time
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Processes.process_name
+  - Processes.dest
+  - Processes.process_guid
+  - Processes.user
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml
index ec2356d4a6..046a58314f 100644
--- a/detections/endpoint/windows_high_file_deletion_frequency.yml
+++ b/detections/endpoint/windows_high_file_deletion_frequency.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-03-16'
 author: Teoderick Contreras
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This search looks for high frequency of file deletion relative to process
   name and process id. These events usually happen when the ransomware tries to encrypt
   the files with the ransomware file extensions and sysmon treat the original files
diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml
index 8cd2bba8c2..3fb5c0f1e1 100644
--- a/detections/endpoint/windows_installutil_credential_theft.yml
+++ b/detections/endpoint/windows_installutil_credential_theft.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-11-12'
 author: Michael Haag, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code
   to bypassing application control and capture credentials by utilizing a tool like
@@ -75,6 +76,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index f86157ff3a..1179c42ae8 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -5,7 +5,7 @@ date: '2022-01-19'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the Windows binary InstallUtil.exe
   running from a non-standard location. The analytic utilizes a macro for InstallUtil
   and identifies both the process_name and original_file_name.
@@ -76,17 +76,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_hash
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml
index 35296482d2..74868751a9 100644
--- a/detections/endpoint/windows_installutil_remote_network_connection.yml
+++ b/detections/endpoint/windows_installutil_remote_network_connection.yml
@@ -5,8 +5,7 @@ date: '2021-11-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   making a remote network connection. This technique may be used to download and execute
   code while bypassing application control. \
@@ -81,16 +80,20 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml
index 314ca9c18f..98a9002831 100644
--- a/detections/endpoint/windows_installutil_uninstall_option.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the Windows InstallUtil.exe binary.
   This will execute code while bypassing application control using the `/u` (uninstall)
   switch. \
@@ -82,15 +82,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
index e18e036555..039a92f7d1 100644
--- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
@@ -5,8 +5,7 @@ date: '2021-11-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Ports
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   making a remote network connection. This technique may be used to download and execute
   code while bypassing application control using the `/u` (uninstall) switch. \
@@ -88,15 +87,20 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Ports.dest
-  - Endpoint.Ports.dest_port
-  - Endpoint.Ports.process_guid
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Ports.process_guid
+  - Ports.dest
+  - Ports.dest_port
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml
index 975ea9e040..b6958ef7af 100644
--- a/detections/endpoint/windows_installutil_url_in_command_line.yml
+++ b/detections/endpoint/windows_installutil_url_in_command_line.yml
@@ -5,7 +5,7 @@ date: '2021-11-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   passing a HTTP request on the command-line. This technique may be used to download
   and execute code while bypassing application control. \
@@ -78,15 +78,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
index 8cffa29a86..cfc476d77f 100644
--- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
@@ -5,8 +5,7 @@ date: '2022-03-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to look for suspicious registry modification related
   to file compression color and information tips. This IOC was seen in hermetic wiper
   where it has a thread that will create this registry entry to change the color of
@@ -65,19 +64,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index fbf888c7a2..15669cf7d5 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -5,7 +5,7 @@ date: '2022-01-21'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe
   has similar capabilities as other remote programs like psexec. AdvancedRun may also
   ingest a configuration file with all settings defined and perform its activity.
@@ -69,15 +69,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 60
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 4efe7f0565..1fd0c7eb76 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -5,7 +5,7 @@ date: '2022-01-24'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following hunting analytic assists with identifying the proces execution
   of commonly used utilities from NirSoft. Potentially not adversary behavior, but
   worth identifying to know if the software is present and being used.
@@ -65,15 +65,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
index 76b693166e..5555c3942c 100644
--- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml
+++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
@@ -5,7 +5,7 @@ date: '2022-02-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for process commandline that contains named
   pipe. This technique was seen in some adversaries, threat actor and malware like
   olympic destroyer to communicate to its other child processes after process injection
@@ -60,18 +60,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.parent_process_path
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
index f7d32f04b6..e442e6221c 100644
--- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -5,7 +5,7 @@ date: '2021-12-07'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the Raccine Rules Updater scheduled
   task being deleted. Adversaries may attempt to remove this task in order to prevent
   the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher
@@ -65,15 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index 74a71931f8..1478210a41 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -5,7 +5,7 @@ date: '2022-02-15'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the Windows Windows Remote Auto Dialer,
   rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
   shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
@@ -64,14 +64,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
index 34ec4e85fb..0ab9bf0c5b 100644
--- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic is to look for suspicious raw access read to device disk
   partition of the host machine. This technique was seen in several attacks by adversaries
   or threat actor to wipe, encrypt or overwrite the boot sector of each partition
diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
index 6db5511392..24a1beac4a 100644
--- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2022-02-17'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic is to look for suspicious raw access read to drive where
   the master boot record is placed. This technique was seen in several attacks by
   adversaries or threat actor to wipe, encrypt or overwrite the master boot record
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index aaaca39e14..723eeca63c 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -5,7 +5,7 @@ date: '2022-02-07'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies the use of Microsoft Remote Assistance,
   msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default
   has no command-line arguments and typically spawns itself. It will generate a network
@@ -61,14 +61,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index 96f26939a7..aa37903127 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -5,7 +5,7 @@ date: '2022-02-07'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies Schtasks.exe creating a new task to
   start and run as an elevated user - SYSTEM. This is commonly used by adversaries
   to spawn a process in an elevated state.
@@ -58,14 +58,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 48
   security_domain: endpoint
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index f5a94ddc3e..ef4c22c956 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -4,13 +4,12 @@ version: 1
 date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint.Processes
+datamodel: []
 description: The search looks for a Windows Security Account Manager (SAM) was stopped
   via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net*.exe"
-  Processes.process="*stop \"samss\"*") BY Processes.dest, Processes.user, Processes.process
+  as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe"
+  "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process"
   | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `windows_security_account_manager_stopped_filter`'
 how_to_implement: You must be ingesting data that records the process-system activity
@@ -63,5 +62,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index cda0072b18..e7ee7f4898 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -5,7 +5,7 @@ date: '2021-11-10'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `sc.exe` with command-line arguments
   utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries
   alike may abuse the Service Control Manager for lateral movement and remote code
@@ -53,15 +53,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml
index fa6abaa8de..d9f96b763b 100644
--- a/detections/endpoint/windows_service_creation_using_registry_entry.yml
+++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml
@@ -5,8 +5,7 @@ date: '2022-02-23'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This analytic is to look for suspicious modification or creation of registry
   to have service entry. This technique is abused by adversaries or threat actor to
   persist, gain privileges in the machine or even lateral movement. This technique
@@ -69,19 +68,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index 398fd2aa9a..fe79ffa24e 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -5,7 +5,7 @@ date: '2021-11-10'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic looks for the execution of `sc.exe` with command-line arguments
   utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries
   alike may abuse the Service Control Manager for lateral movement and remote code
@@ -51,15 +51,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml
index 730a2a3e4f..c8d4f71a4d 100644
--- a/detections/endpoint/windows_wmi_process_call_create.yml
+++ b/detections/endpoint/windows_wmi_process_call_create.yml
@@ -5,7 +5,7 @@ date: '2022-02-22'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to look for wmi commandlines to execute or create process.
   This technique was used by adversaries or threat actor to execute their malicious
   payload in local or remote host. This hunting query is a good pivot to start to
@@ -62,18 +62,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.parent_process_path
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.process_path
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  - Processes.process_guid
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 531cec81c3..3f135b0e36 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -77,9 +77,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Command
-  - Task_Name
   - _time
   - dest
+  - Task_Name
+  - Description
+  - Command
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 04477c3e63..ff59f2304b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -79,9 +79,10 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Command
-  - Task_Name
   - _time
   - dest
+  - Task_Name
+  - Description
+  - Command
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index e1f3dc6e0b..8b49efca42 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-10-19'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel: []
+datamodel:
+- Endpoint
 description: The following hunting analytic assists with identifying suspicious tasks
   that have been registered and ran in Windows using EventID 200 (action run) and
   201 (action completed). It is recommended to filter based on ActionName by specifying
@@ -54,6 +55,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - TaskName
+  - ActionName
+  - EventID
   - dest
+  - ProcessID
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml
index 42b217dc0e..94331c9531 100644
--- a/detections/endpoint/winhlp32_spawning_a_process.yml
+++ b/detections/endpoint/winhlp32_spawning_a_process.yml
@@ -5,7 +5,7 @@ date: '2021-10-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
   spawning a child process that loads a file out of appdata, programdata, or temp.
   Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added
@@ -72,15 +72,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml
index 292ef12ac2..6edb916edb 100644
--- a/detections/endpoint/winword_spawning_cmd.yml
+++ b/detections/endpoint/winword_spawning_cmd.yml
@@ -5,7 +5,7 @@ date: '2021-04-22'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Microsoft Word spawning `cmd.exe`.
   Typically, this is not common behavior and not default with winword.exe. Winword.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -65,16 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml
index 313637d549..46c8cb7d5a 100644
--- a/detections/endpoint/winword_spawning_powershell.yml
+++ b/detections/endpoint/winword_spawning_powershell.yml
@@ -5,7 +5,7 @@ date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Microsoft Word spawning PowerShell.
   Typically, this is not common behavior and not default with winword.exe. Winword.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -67,16 +67,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml
index dee31f18b1..005936b001 100644
--- a/detections/endpoint/winword_spawning_windows_script_host.yml
+++ b/detections/endpoint/winword_spawning_windows_script_host.yml
@@ -5,7 +5,7 @@ date: '2021-04-12'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following detection identifies Microsoft Winword.exe spawning Windows
   Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior
   and not default with Winword.exe. Winword.exe will generally be found in the following
@@ -64,20 +64,12 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
-  - dest
-  - parent_process_id
-  - parent_process_name
-  - process_id
   - process_name
+  - process_id
+  - parent_process_name
+  - dest
   - user
+  - parent_process_id
   risk_score: 70
   security_domain: endpoint
diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml
index 4c09439556..67ccbb4fcb 100644
--- a/detections/endpoint/wmic_group_discovery.yml
+++ b/detections/endpoint/wmic_group_discovery.yml
@@ -5,7 +5,7 @@ date: '2021-09-14'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating
   local groups on the endpoint. \
 
@@ -60,14 +60,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index c26a0f6bad..2f80fb1d75 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -5,7 +5,7 @@ date: '2021-10-20'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic is to detect a suspicious wmic commandlined that uninstall
   application non interactively. This technique was seen in IceID to uninstall av
   products to the compromised host to bypassed and evade detections. This Hunting
@@ -63,14 +63,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml
index c042ea3c73..06690c892a 100644
--- a/detections/endpoint/wmic_xsl_execution_via_url.yml
+++ b/detections/endpoint/wmic_xsl_execution_via_url.yml
@@ -5,7 +5,7 @@ date: '2021-11-11'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible
   Stylesheet Language) script. This originally was identified by Casey Smith, dubbed
   Squiblytwo, as an application control bypass. Many adversaries will utilize this
@@ -70,15 +70,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.original_file_name
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index 1a048bede8..1460ebef98 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
   Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
@@ -64,15 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
index 6bb75086ab..af04695147 100644
--- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
@@ -5,7 +5,7 @@ date: '2021-10-06'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This analytic identifies a suspicious spawned process by WScript or CScript
   process. This technique was a common technique used by adversaries and malware to
   execute different LOLBIN, other scripts like PowerShell or spawn a suspended process
@@ -64,15 +64,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index 188c711ab3..a459e91554 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS
   execution process. When adversaries execute code on remote endpoints abusing the
   Windows Remote Management (WinRm) protocol, the executed command is spawned as a
@@ -65,15 +65,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_id
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index c41fe22d36..b436925676 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -5,8 +5,7 @@ date: '2020-01-28'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
-- Endpoint.Registry
+- Endpoint
 description: This search is to detect a suspicious modification of registry related
   to UAC bypass. This technique is to modify the registry in this detection, create
   a registry value with the path of the payload and run WSreset.exe to bypass User
@@ -65,21 +64,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_guid
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Registry.dest
-  - Endpoint.Registry.process_guid
-  - Endpoint.Registry.registry_key_name
-  - Endpoint.Registry.registry_path
-  - Endpoint.Registry.registry_value_data
-  - Endpoint.Registry.registry_value_name
-  - Endpoint.Registry.user
   - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml
index 898fc4e5fb..acadcdf186 100644
--- a/detections/endpoint/xmrig_driver_loaded.yml
+++ b/detections/endpoint/xmrig_driver_loaded.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-29'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Endpoint
 description: This analytic identifies XMRIG coinminer driver installation on the system.
   The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open
   source project that is commonly abused by adversaries to infect and mine bitcoin.
diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml
index 4b642db4e2..0d1b86a632 100644
--- a/detections/endpoint/xsl_script_execution_with_wmic.yml
+++ b/detections/endpoint/xsl_script_execution_with_wmic.yml
@@ -5,7 +5,7 @@ date: '2021-09-13'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint.Processes
+- Endpoint
 description: This search is to detect a suspicious wmic.exe process or renamed wmic
   process to execute malicious xsl file. This technique was seen in FIN7 to execute
   its malicous jscript using the .xsl as the loader with the help of wmic.exe process.
@@ -67,14 +67,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.parent_process
-  - Endpoint.Processes.parent_process_name
-  - Endpoint.Processes.process
-  - Endpoint.Processes.process_id
-  - Endpoint.Processes.process_name
-  - Endpoint.Processes.user
   - _time
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
index 21b61395b5..7b385820f2 100644
--- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
@@ -5,7 +5,7 @@ date: '2021-01-14'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
-- Network_Resolution.DNS
+- Network_Resolution
 description: Malicious actors often abuse legitimate Dynamic DNS services to host
   malicious payloads or interactive command and control nodes. Attackers will automate
   domain resolution changes by routing dynamic domains to countless IP addresses to
@@ -13,9 +13,8 @@ description: Malicious actors often abuse legitimate Dynamic DNS services to hos
   analytic and investigative processes. This search will look for DNS queries made
   from within your infrastructure to suspicious dynamic domains.
 search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
-  min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host
-  | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers`
-  | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
+  min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")`
+  | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
 how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This
   can be done by ingesting logs from your server or data, collected passively by Splunk
   Stream or a similar solution. Specifically, data that contains the domain that is
@@ -92,9 +91,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Network_Resolution.DNS.answer
-  - Network_Resolution.DNS.query
   - _time
+  - DNS.answer
+  - DNS.query
   - host
   risk_score: 56
   security_domain: network
diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml
index 57f0a8eb9c..97ca0cb956 100644
--- a/detections/network/detect_outbound_ldap_traffic.yml
+++ b/detections/network/detect_outbound_ldap_traffic.yml
@@ -5,7 +5,7 @@ date: '2021-12-13'
 author: Bhavin Patel, Johan Bjerke, Splunk
 type: Hunting
 datamodel:
-- Network_Traffic.All_Traffic
+- Network_Traffic
 description: Malicious actors often abuse misconfigured LDAP servers or applications
   that use the LDAP servers in organizations. Outbound LDAP traffic should not be
   allowed outbound through your perimeter firewall.  This search will help determine
@@ -70,9 +70,9 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Network_Traffic.All_Traffic.dest_ip
-  - Network_Traffic.All_Traffic.dest_port
-  - Network_Traffic.All_Traffic.src_ip
   - _time
+  - All_Traffic.dest_ip
+  - All_Traffic.dest_port
+  - All_Traffic.src_ip
   risk_score: 56
   security_domain: network
diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml
index 2ba090afaa..2474317aac 100644
--- a/detections/network/dns_query_length_with_high_standard_deviation.yml
+++ b/detections/network/dns_query_length_with_high_standard_deviation.yml
@@ -5,7 +5,7 @@ date: '2021-10-06'
 author: Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
-- Network_Resolution.DNS
+- Network_Resolution
 description: This search allows you to identify DNS requests and compute the standard
   deviation on the length of the names being resolved, then filter on two times the
   standard deviation to show you those queries that are unusually large for your environment.
@@ -62,8 +62,8 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Network_Resolution.DNS.message_type
-  - Network_Resolution.DNS.query
+  - _time
+  - DNS.query
   risk_score: 56
   security_domain: network
   supported_tas:
diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml
index 7d5495426e..5fb5ffc2ba 100644
--- a/detections/network/multiple_archive_files_http_post_traffic.yml
+++ b/detections/network/multiple_archive_files_http_post_traffic.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-21'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Network_Traffic
 description: This search is designed to detect high frequency of archive files data
   exfiltration through HTTP POST method protocol. This are one of the common techniques
   used by APT or trojan spy after doing the data collection like screenshot, recording,
diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml
index 60d044f7bc..3716f34a17 100644
--- a/detections/network/plain_http_post_exfiltrated_data.yml
+++ b/detections/network/plain_http_post_exfiltrated_data.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-04-22'
 author: Teoderick Contreras, Splunk
 type: TTP
-datamodel: []
+datamodel:
+- Network_Traffic
 description: This search is to detect potential plain HTTP POST method data exfiltration.
   This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary
   where arguments or commands are sent in plain text to the remote C2 server using
diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml
index 49b356257e..e7b549f675 100644
--- a/detections/web/log4shell_jndi_payload_injection_attempt.yml
+++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml
@@ -5,7 +5,7 @@ date: '2021-12-13'
 author: Jose Hernandez
 type: Anomaly
 datamodel:
-- Web.Web
+- Web
 description: CVE-2021-44228 Log4Shell payloads can be injected via various methods,
   but on of the most common vectors injection is via Web calls. Many of the vulnerable
   java web applications that are using log4j have a web component to them are specially
diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
index 935998659d..0e781ffc20 100644
--- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
+++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
@@ -5,8 +5,8 @@ date: '2021-12-13'
 author: Jose Hernandez
 type: Anomaly
 datamodel:
-- Network_Traffic.All_Traffic
-- Web.Web
+- Network_Traffic
+- Web
 description: CVE-2021-44228 Log4Shell payloads can be injected via various methods,
   but on of the most common vectors injection is via Web calls. Many of the vulnerable
   java web applications that are using log4j have a web component to them are specially
@@ -69,7 +69,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Network_Traffic.All_Traffic.dest
   - action
   - category
   - dest