diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
index f562298c91..0615cc686d 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
@@ -27,6 +27,11 @@ eli5: "This detection identifies use of Mimikatz modules for discovery and acces
 known_false_positives:
   "None identified."
 tags:
+  required_fields:
+    - _time
+    - process
+    - dest_device_id
+    - dest_user_id
   cis20:
     - CIS 16
     - CIS 20