From 5cd3af9fd0f7c1df301481fc9e305cd2c21998e1 Mon Sep 17 00:00:00 2001
From: miskoSplunk <68617976+miskoSplunk@users.noreply.github.com>
Date: Wed, 18 Nov 2020 10:20:56 -0800
Subject: [PATCH] Update ssa___recon_and_use_shares_via_mimikatz_modules.yml

---
 .../ssa___recon_and_use_shares_via_mimikatz_modules.yml      | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
index f562298c91..0615cc686d 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
@@ -27,6 +27,11 @@ eli5: "This detection identifies use of Mimikatz modules for discovery and acces
 known_false_positives:
   "None identified."
 tags:
+  required_fields:
+    - _time
+    - process
+    - dest_device_id
+    - dest_user_id
   cis20:
     - CIS 16
     - CIS 20