From 5a28f4aeaed1dacae3e7bc26100671fa842e3949 Mon Sep 17 00:00:00 2001
From: miskoSplunk <68617976+miskoSplunk@users.noreply.github.com>
Date: Wed, 18 Nov 2020 10:07:53 -0800
Subject: [PATCH] Update
 ssa___assess_credential_strength_via_dsinternals_modules.yml

---
 ...a___assess_credential_strength_via_dsinternals_modules.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 231f85f78b..f0c9285536 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -25,12 +25,12 @@ search: '| from read_ssa_enriched_events()
 eli5: "This detection identifies use of DSInternals modules which assess password strength."
 known_false_positives:
   "None identified."
-required_fields:
+tags:
+  required_fields:
     - _time
     - process
     - dest_device_id
     - dest_user_id
-tags:
   cis20:
     - CIS 16
     - CIS 20