From 6952b99ea4ce7549fc488f584e996e7181bdc01c Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 2 Mar 2021 10:53:49 -0700
Subject: [PATCH] Update windows_disableantispyware_reg.yml

---
 detections/endpoint/windows_disableantispyware_reg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index 078e2580fc..dd74a83540 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since
   it is a default security control, although it is not rare for some policies to disable
   it. Although no false positives have been identified, use the provided filter macro