diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 231f85f78b..f0c9285536 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -25,12 +25,12 @@ search: '| from read_ssa_enriched_events()
 eli5: "This detection identifies use of DSInternals modules which assess password strength."
 known_false_positives:
   "None identified."
-required_fields:
+tags:
+  required_fields:
     - _time
     - process
     - dest_device_id
     - dest_user_id
-tags:
   cis20:
     - CIS 16
     - CIS 20