ssa detection testing

tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml

@@ -5,5 +5,8 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test credential dumping detections
     attack_data:
-      - file_name: windows-security-events_ssa.log
-        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log
+      - file_name: windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+        source: WinEventLog:Security
+        sourcetype: xmlwineventlog
+        update_timestamp: True