diff --git a/bin/ssa-end-to-end-testing/modules/github_service.py b/bin/ssa-end-to-end-testing/modules/github_service.py
index a7cafc5fef..dec758191d 100644
--- a/bin/ssa-end-to-end-testing/modules/github_service.py
+++ b/bin/ssa-end-to-end-testing/modules/github_service.py
@@ -50,11 +50,12 @@ class GithubService:
 
                 # changed detections
                 if file_path.startswith('detections'):
-                    if os.path.basename(file_path).startswith('ssa'):
-                        file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test'
-                        file_path_new = file_path_base + '.yml'
-                        if file_path_new not in changed_ssa_test_files:
-                            changed_ssa_test_files.append(file_path_new)
+                    if not 'deprecated' in file_path:
+                        if os.path.basename(file_path).startswith('ssa'):
+                            file_path_base = os.path.splitext(file_path)[0].replace('detections', 'tests') + '.test'
+                            file_path_new = file_path_base + '.yml'
+                            if file_path_new not in changed_ssa_test_files:
+                                changed_ssa_test_files.append(file_path_new)
 
                 # changed CI code
                 if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
@@ -76,4 +77,3 @@ class GithubService:
         return changed_ssa_test_files, ci_changes
 
 
-
diff --git a/bin/validate.py b/bin/validate.py
index c26c3f65b5..554a1a5217 100644
--- a/bin/validate.py
+++ b/bin/validate.py
@@ -17,12 +17,24 @@ from pathlib import Path
 from os import path, walk
 
 
-def validate_schema(REPO_PATH, type, objects, verbose):
+def validate_schema(REPO_PATH, detection_type, objects, verbose):
+    #Default regex does NOT match ssa___*.yml files: "^(?!ssa___).*\.yml$"
+    #The following search will match ssa___*.yml files: "^ssa___.*\.yml$"
+    if detection_type.startswith("ba_"):
+        filename_regex = "^ssa___.*\.yml$"
+    else:
+        filename_regex = "^(?!ssa___).*\.yml$"
+        
+    
 
     error = False
     errors = []
 
-    schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + type + '.spec.json')
+    schema_file = path.join(path.expanduser(REPO_PATH), 'spec/' + detection_type + '.spec.json')
+    #remove the prefix if the detection type starts with ba_ so we can
+    #get the files from the proper folders and proceed correctly
+    if detection_type.startswith("ba_"):
+        detection_type = detection_type[3:]
 
     try:
         schema = json.loads(open(schema_file, 'rb').read())
@@ -30,11 +42,10 @@ def validate_schema(REPO_PATH, type, objects, verbose):
         print("ERROR: reading schema file {0}".format(schema_file))
 
     manifest_files = []
-    for root, dirs, files in walk(REPO_PATH + "/" + type):
+    for root, dirs, files in walk(REPO_PATH + "/" + detection_type):
         for file in files:
-            if file.endswith(".yml"):
+            if re.search(filename_regex, path.basename(file)) is not None:
                 manifest_files.append((path.join(root, file)))
-
     for manifest_file in manifest_files:
         if verbose:
             print("processing manifest {0}".format(manifest_file))
@@ -54,13 +65,13 @@ def validate_schema(REPO_PATH, type, objects, verbose):
             errors.append("ERROR: {0} at:\n\t{1}".format(json.dumps(schema_error.message), manifest_file))
             error = True
 
-        if type in objects:
-            objects[type].append(object)
+        if detection_type in objects:
+            objects[detection_type].append(object)
         else:
             arr = []
             arr.append(object)
-            objects[type] = arr
-
+            objects[detection_type] = arr
+    print("***END OF VALIDATE SCHEMA ***")
     return objects, error, errors
 
 
@@ -244,7 +255,8 @@ def validate_tests(REPO_PATH, object):
 
 def main(REPO_PATH, verbose):
 
-    validation_objects = ['macros','lookups','stories','detections','deployments', 'tests']
+    validation_objects = ['macros','lookups','stories','detections', 'ba_detections','deployments', 'tests']
+    
 
     objects = {}
     schema_error = False
diff --git a/detections/deprecated/ssa___detect_pass_hash.yml b/detections/deprecated/ssa___detect_pass_hash.yml
index 49ae7ca771..c14864ecab 100644
--- a/detections/deprecated/ssa___detect_pass_hash.yml
+++ b/detections/deprecated/ssa___detect_pass_hash.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-21'
 author: Xiao Lin, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Authentication
 description: This search looks for specific authentication events from the Windows
   Security Event logs to detect potential attempts using Pass-the-Hash technique.
 search: ' | from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
index 01bbe7ab22..493a687f55 100644
--- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following detection identifies the usage of archive tools from the command line.
 search: '| from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
@@ -75,4 +75,4 @@ tags:
   - Processes.parent_process
   risk_score: 42
   security_domain: endpoint
-    
\ No newline at end of file
+    
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index 4beb8f3c3b..36bef2deb7 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
   attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index 5835d34f11..b13f629a0a 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Stolen credentials are applied by methods such as user impersonation,
   credential injection, spoofing of authentication processes or getting hold of critical
   accounts. This detection indicates such activities carried out by PowerSploit exploit
@@ -87,3 +88,4 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+
diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 9fb311d807..d6c3e8f36d 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -4,9 +4,10 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of DSInternals modules that verify password
-  strength, i.e., identify week accounts that would be easily compromised.
+  strength, i.e., identify weak accounts that would be easily compromised.
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 0ad02f089a..05ed99fff6 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint_Processes
 description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
   there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -81,4 +81,4 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index 90206eb92d..f4842b77c4 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint_Processes
 description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
   there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index d9a68ecbaf..3ad5d78231 100644
--- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -4,7 +4,8 @@ version: 1
 date: 2020-6-04
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Monitor for execution of reg.exe with parameters specifying an export
   of keys that contain hashed credentials that attackers may try to crack offline.
 search: '
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
index 5b5086bcea..8bdadd5f6a 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
@@ -5,7 +5,8 @@ version: 1
 date: '2020-10-21'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. DSInternals
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
index ebfa2cf9b0..2ba5dedaa7 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-21'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. DSInternals
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
index 97f3faaa8f..f5fb629e3f 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. FGdump is
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
index cd0b392e95..a8bd8bd421 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. FGdump is
diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
index ee2e8d7e10..b7a1803fe3 100644
--- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
+++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
@@ -5,7 +5,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. PowerSploit
diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
index de232ad83f..578c294d38 100644
--- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
+++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. LaZagne is
diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
index bc0cc3c8a1..28e5ef51b8 100644
--- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-21'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. Mimikatz
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
index 75a194325c..c7e307cdb0 100644
--- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
+++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. Native Microsoft
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
index 3820b3a887..84de6fd615 100644
--- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
+++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-18'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. Native Microsoft
diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
index feca60030d..139002dd9b 100644
--- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-21'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Credential extraction is often an illegal recovery of credential material
   from secured authentication resources and repositories. This process may also involve
   decryption or other transformations of the stored credential material. PowerSploit
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 3e8aa55767..084762220c 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-  - Endpoint
+- Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -86,4 +86,4 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 676ad9ffaf..99f240479b 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -5,7 +5,7 @@ date: '2021-06-14'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic identifies a potential adversary that changes the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 9d797b74ee..8aa246b6b1 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -1,21 +1,24 @@
 name: Detect Dump LSASS Memory using comsvcs
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
-version: 1
+version: 2
 date: '2020-09-15'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This search detects the memory of lsass.exe being dumped for offline
   credential theft attack.
-search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
-  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
-  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
-  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
-  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
-  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events()
+  | where "Endpoint_Processes" IN(_datamodels)
+  | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+    process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
+    timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+    process=lower(ucast(map_get(input_event, "process"), "string", null)),
+    event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
+  | eval body=create_map(["event_id", event_id, "process_name", process_name, "process", process])
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml
index 79d5759281..b1f39df1b7 100644
--- a/detections/endpoint/ssa___detect_kerberoasting.yml
+++ b/detections/endpoint/ssa___detect_kerberoasting.yml
@@ -4,24 +4,28 @@ version: 2
 date: '2020-10-21'
 author: Xiao Lin, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Certificates
 description: This search detects a potential kerberoasting attack via service principal
   name requests
-search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
-  EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
-  "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
-  ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
-  "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
-  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
-  AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
-  input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
+search: ' | from read_ssa_enriched_events()
+  | eval _time=map_get(input_event, "_time"),
+    EventCode=map_get(input_event, "event_code"),
+    TicketOptions=map_get(input_event, "ticket_options"),
+    TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
+    ServiceName=map_get(input_event, "service_name"),
+    ServiceID=map_get(input_event, "service_id"),
+    dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+    dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+    event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
+  | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
   | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
-  | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id,
-  "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
-  "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
+  | eval start_time=_time, end_time=_time
+  | eval body=create_map(["event_id", event_id, "EventCode", EventCode, "ServiceName", ServiceName,
+    "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]),
+    entities = mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | select start_time, end_time, entities, body | into write_ssa_detected_events();'
 how_to_implement: The test data is converted from Windows Security Event logs generated
   from Attach Range simulation and used in SPL search and extended to SPL2
 known_false_positives: Older systems that support kerberos RC4 by default NetApp may
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index c9bd61c879..afe79658ab 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -5,7 +5,7 @@ date: '2021-12-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint_Processes
 description: This analytic will identify a suspicious command-line that disables a
   user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
   by the adversaries to interrupt availability of accounts and continue the impact against the organization.
diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 61fe4af67e..570422a521 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -4,7 +4,8 @@ version: 3
 date: 2021-2-1
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This search looks for command-line arguments that use a `/c` parameter
   to execute a command that has not previously been seen. This is an implementation
   on SPL2 of the rule `First time seen command line argument` by @bpatel.
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 2fb386ce14..8356803542 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -5,7 +5,7 @@ date: '2021-06-14'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic identifies potential adversaries that modify the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft, ransomware and coinminer scripts to evade detections and restrict access
diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
index f2d3a42c59..9befd204a2 100644
--- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that enable illegaly
   access user content, such as key logging, audio recording, screenshots, tapping
   into http and RDP sessions, etc.
diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
index 5706bc23ef..bcf6b5a219 100644
--- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that create accounts
   illegaly.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
index 19ddea7678..678bc63e8d 100644
--- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of DSInternals modules that enable or disable
   accounts illegaly.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
index 34cbfa9e81..6841ed4c33 100644
--- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that delete event
   logs.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
index b3d2019c91..8d198b5a65 100644
--- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
@@ -5,7 +5,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of DSInternals modules for illegal management
   of Active Directoty elements and policies.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
index ebebdf9258..34f71e1e74 100644
--- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
@@ -5,7 +5,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that enable illegal
   management of computers and Active Directory elements.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
index 93ebd26c4e..f5a2d2d6bd 100644
--- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that illegaly
   elevate general privileges or ensure persistence, e.g., enable manipulation of registry,
   task scheduling, persistent WMI, access to OS objects under desired identities.
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
index 43af6b051f..d89d0b0125 100644
--- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for illegal privilege
   elevation.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
index 053e04b3ec..80437e3035 100644
--- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for illegal control
   over services and processes, including the authentication service.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
index f1a19ab5ac..7bddc183f8 100644
--- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-09'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that enable illegal
   control of services and processes, such as installing or spoofing of malicious services,
   injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands,
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 4ca2240a8f..872c2a90b7 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -5,7 +5,7 @@ date: '2021-06-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic identifies suspicious modification of ACL permission to
   a files or folder to make it available to everyone or to a specific user. This technique
   may be used by the adversary to evade ACLs or protected files access. This changes
diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
index fc96b2948a..d56fefc09d 100644
--- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-04'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of PowerSploit modules that facilitate
   access probing with admin credentials as well as probing access to system services.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 3c20b25cdb..93fd49f508 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -1,30 +1,30 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
 version: 2
-date: '2021-11-10'
+date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
+datamodel:
+    - Endpoint_Processes
 type: Anomaly
-datamodel: []
-description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.
-During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.'
 search: '| from read_ssa_enriched_events()
-
+  | where "Endpoint_Processes" IN(_datamodels)
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
-  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null)
-
-  | where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
-  | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
-  OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe"
-  OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe"
-  OR field0="java.exe" OR field0="powershell.exe"
-
+  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)),
+  dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event,"event_id"), "string", null)
+  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+  | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe" OR ParentBaseFileName="powerpnt.exe"
+  OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe" OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe"
+  OR ParentBaseFileName="iexplore.exe" OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
+  OR ParentBaseFileName="java.exe" OR ParentBaseFileName="powershell.exe"
+  OR (ParentBaseFileName="chrome.exe" AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
-  "parent_process_name", parent_process]) | into write_ssa_detected_events();'
+  "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
 known_false_positives: There are circumstances where an application may legitimately
@@ -76,4 +76,4 @@ tags:
   - dest_user_id
   risk_score: 35
   risk_severity: low
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index 9559097edf..510598c50d 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -4,13 +4,16 @@ version: 2
 date: '2021-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
   exploits. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by a detination device.
-search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
+search: '| from read_ssa_enriched_events()
+  | where "Authentication" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+    dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
   "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string",
   null), dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string",
   null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string",
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index e97575e56e..7edffc64c4 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -4,13 +4,17 @@ version: 2
 date: '2021-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
   exploits. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by an event-collecting device (i.e., a specific domain controller or an endpoint
   destination).
-search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
+search: '| from read_ssa_enriched_events()
+  | where "Authentication" IN(_datamodels)
+
+  | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
   "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string",
   null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string",
diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
index 825ce7954e..4d135c38f7 100644
--- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2021-05-20'
 author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: An attacker may use LOLBAS tools spawned from vulnerable applications
   not typically used by system administrators. This search leverages the Splunk Streaming
   ML DSP plugin to find rare parent/child relationships. The list of application has
diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
index 9098776ffb..1220488336 100644
--- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of PowerSploit modules that discover opportunities
   for malicious access and persistence. Some examples include access to admin accounts,
   weak access control policies, landing paths for dropping malicious software or data
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
index 151bdea120..955e2011b2 100644
--- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that discover
   accounts, groups and policies that can be accessed or taken over.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
index 14322b2d3e..6ead00797b 100644
--- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for discovery of accounts
   and groups and access to them.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
index 7248a1482a..7640624a38 100644
--- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
@@ -5,7 +5,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules for reconnaissance
   and access to elements of Active Directory infrastructure, such as domain identifiers,
   AD sites and forests, and trust relations.
diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
index c22a323921..6a9ca39b93 100644
--- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that discover
   computers, servers and domains that can be accessed or taken over.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
index 2a409ce088..b3ee75ead1 100644
--- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for discovery of computers
   and servers and access to them.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
index a63cfbbb23..5003ff7b4a 100644
--- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that discover
   and access operating system elements, such as processes, services, registry locations,
   security packages and files.
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
index 66d177f48b..e5e30ad1d0 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for discovery and access
   to network shares.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
index c98b38ae46..0bab24786a 100644
--- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules that discover
   and access network and distributed file system shares.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
index 8fe5b4980a..e809ea0f63 100644
--- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies access to PowerSploit modules for reconnaissance
   of connectivity.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
index 84eef9576b..0272d86045 100644
--- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies reconnaissance of credential stores and use
   of CryptoAPI services by Mimikatz modules.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
index 511a1cb7c0..c3006e4aa4 100644
--- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of PowerSploit modules for assessment of
   presence of defensive tools.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
index 1e8f9fded4..155c209444 100644
--- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of PowerSploit modules for assessment of
   privilege escalation opportunities.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
index d2598550e5..78869cc780 100644
--- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for discovery of process
   or service hijacking opportunities via Microsoft Detours compatibility. Microsoft
   Detours is an open source library for intercepting, monitoring and instrumenting
diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
index 0a785c034c..40a29f5cb9 100644
--- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-06'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies use of Mimikatz modules for discovery and access
   to services and processes.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 6a960b11be..c89f50b7e2 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -5,9 +5,13 @@ date: '2021-06-21'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
-description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
-  and a precursor to deleting the shadowstorage. 
+- Endpoint_Processes
+description: The following analytics identifies the resizing of shadowstorage by ransomware
+  malware to avoid the shadow volumes being made again. this technique is an alternative
+  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
+  team. one example of ransomware that use this technique is CLOP ransomware where
+  it drops a .bat file that will resize the shadowstorage to minimum size as much
+  as possible
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml
index 032a4ca12f..93ed90441a 100644
--- a/detections/endpoint/ssa___sdelete_application_execution.yml
+++ b/detections/endpoint/ssa___sdelete_application_execution.yml
@@ -5,7 +5,7 @@ date: '2021-11-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
   that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
   meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
@@ -84,4 +84,4 @@ tags:
     role:
     - Child Process
     
-    
\ No newline at end of file
+    
diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
index f53e3f8990..697b250fe7 100644
--- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies illegal setting of credentials via DSInternals
   modules.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
index 2b1e4255b0..ef80f5b9eb 100644
--- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies illegal setting of credentials via Mimikatz
   modules.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
index 5475eddbd4..e2f66546c1 100644
--- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-11-03'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: This detection identifies illegal setting of credentials via PowerSploit
   modules.
 search: '| from read_ssa_enriched_events()
diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
index dc69941b24..3d3f090355 100644
--- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
@@ -4,7 +4,8 @@ version: 3
 date: '2020-08-25'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: An attacker tries might try to use different version of a system command
   without overriding original, or they might try to avoid some detection running the
   process from a different folder. This detection checks that a list of system processes
diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
index 63ec825a35..2ff4dfa4cd 100644
--- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
@@ -4,7 +4,8 @@ version: 2
 date: '2020-08-25'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Attacker activity may compromise executing several LOLBAS applications
   in conjunction to accomplish their objectives. We are looking for more than usual
   LOLBAS applications over a window of time, by building profiles per machine.
diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml
index 7f48539c86..526516edc2 100644
--- a/detections/endpoint/ssa___unusually_long_command_line.yml
+++ b/detections/endpoint/ssa___unusually_long_command_line.yml
@@ -4,7 +4,8 @@ version: 1
 date: '2020-10-06'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel: []
+datamodel: 
+- Endpoint_Processes
 description: Command lines that are extremely long may be indicative of malicious
   activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
   to help identify command lines with lengths that are unusual for a given user. This
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index 0ff21233b6..f6bbea100e 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -5,23 +5,26 @@ date: '2021-06-15'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The wevtutil.exe application is the windows event log utility. This searches
   for wevtutil.exe with parameters for clearing the application, security, setup,
   powershell, sysmon, or system event logs.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
-  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
-  "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
-  /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
-  /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
-  /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+search: '| from read_ssa_enriched_events()
+  | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+    cmd_line=ucast(map_get(input_event, "process"), "string", null),
+    process_name=ucast(map_get(input_event, "process_name"), "string", null),
+    process_path=ucast(map_get(input_event, "process_path"), "string", null),
+    parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
+    event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %")
+    AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
+    /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
+    /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
+  | eval start_time=timestamp, end_time=timestamp,
+    entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+    "parent_process_name", parent_process_name, "process_path", process_path])
   | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -79,3 +82,4 @@ tags:
   risk_score: 63
   risk_severity: medium
   security_domain: endpoint
+
diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index 17b950bb38..c3ce140ea7 100644
--- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -5,21 +5,24 @@ date: '2021-06-15'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This search is to detect execution of wevtutil.exe to disable logs. This
   technique was seen in several ransomware to disable the event logs to evade alerts
   and detections in compromised host.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
-  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
-  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
-  "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line,
-  "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
-  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
-  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
-  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
-  "process_path", process_path]) | into write_ssa_detected_events();'
+search: '| from read_ssa_enriched_events()
+  | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+    cmd_line=ucast(map_get(input_event, "process"), "string", null),
+    process_name=ucast(map_get(input_event, "process_name"), "string", null),
+    process_path=ucast(map_get(input_event, "process_path"), "string", null),
+    parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
+    event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe"
+  | eval start_time=timestamp, end_time=timestamp,
+    entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
+  | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+    "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
diff --git a/spec/ba_detections.spec.json b/spec/ba_detections.spec.json
new file mode 100644
index 0000000000..884621de9f
--- /dev/null
+++ b/spec/ba_detections.spec.json
@@ -0,0 +1,203 @@
+{
+    "$id": "http://example.com/example.json",
+    "$schema": "http://json-schema.org/draft-07/schema",
+    "additionalProperties": true,
+    "description": "schema for detections",
+    "properties": {
+      "author": {
+        "$id": "#/properties/author",
+        "default": "",
+        "description": "Author of the detection",
+        "examples": [
+          "Patrick Bareiss, Splunk"
+        ],
+        "type": "string"
+      },
+      "date": {
+        "$id": "#/properties/date",
+        "default": "",
+        "description": "date of creation or modification, format yyyy-mm-dd",
+        "examples": [
+          "2019-12-06"
+        ],
+        "type": "string"
+      },
+      "description": {
+        "$id": "#/properties/description",
+        "default": "",
+        "description": "A detailed description of the detection",
+        "examples": [
+          "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
+        ],
+        "type": "string"
+      },
+      "how_to_implement": {
+        "$id": "#/properties/how_to_implement",
+        "default": "",
+        "description": "information about how to implement. Only needed for non standard implementations.",
+        "examples": [
+          "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+        ],
+        "type": "string"
+      },
+      "id": {
+        "$id": "#/properties/id",
+        "default": "",
+        "description": "UUID as unique identifier",
+        "examples": [
+          "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+        ],
+        "type": "string"
+      },
+      "known_false_positives": {
+        "$id": "#/properties/knwon_false_positives",
+        "default": "",
+        "description": "known false postives",
+        "examples": [
+          "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
+        ],
+        "type": "string"
+      },
+      "name": {
+        "$id": "#/properties/name",
+        "default": "",
+        "examples": [
+          "Access LSASS Memory for Dump Creation"
+        ],
+        "title": "Name of detection",
+        "type": "string"
+      },
+      "references": {
+        "$id": "#/properties/references",
+        "additionalItems": true,
+        "default": [],
+        "description": "A list of references for this detection",
+        "examples": [
+          [
+            "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+          ]
+        ],
+        "items": {
+          "$id": "#/properties/references/items",
+          "default": "",
+          "description": "An explanation about the purpose of this instance.",
+          "examples": [
+            "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+          ],
+          "title": "The Items Schema",
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "search": {
+        "$id": "#/properties/search",
+        "default": "",
+        "description": "The Splunk search for the detection",
+        "examples": [
+          "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
+        ],
+        "type": "string"
+      },
+      "tags": {
+        "$id": "#/properties/tags",
+        "additionalProperties": true,
+        "default": {},
+        "description": "An array of key value pairs for tagging",
+        "examples": [
+          {
+            "analytic_story": "credential_dumping",
+            "kill_chain_phases": "Action on Objectives",
+            "mitre_attack_id": "T1078.004",
+            "cis20": "CIS 13",
+            "nist": "DE.DP",
+            "security domain": "network",
+            "asset_type": "AWS Instance",
+            "risk_object": "user",
+            "risk_object_type": "network_artifacts",
+            "risk score": "60",
+            "custom_key": "custom_value"
+          }
+        ],
+        "minItems": 1,
+        "type": "object",
+        "uniqueItems": true
+      },
+      "type": {
+        "$id": "#/properties/type",
+        "default": "",
+        "description": "type of detection",
+        "examples": [
+          "Anomaly"
+        ],
+        "items": {
+          "enum": [
+            "TTP",
+            "Anomaly",
+            "Hunting",
+            "Baseline",
+            "Investigation",
+            "Correlation"
+          ],
+          "type": "string"
+        },
+        "type": "string"
+      },
+      "datamodel": {
+        "$id": "#/properties/datamodel",
+        "default": "",
+        "description": "datamodel used in the search",
+        "examples": [
+          "Endpoint_Processes"
+        ],
+        "items": {
+          "enum": [
+            "Alerts",
+            "Authentication",
+            "Certificates",
+            "Data Loss Prevention",
+            "Email",
+            "Endpoint_AccountManagement",
+            "Endpoint_Filesystem",
+            "Endpoint_Processes",
+            "Endpoint_Registry",
+            "Endpoint_ResourceAccess",
+            "Intrusion_Detection",
+            "Inventory_User",
+            "Malware_Attacks",
+            "Network_Traffic",
+            "Network_Sessions",
+            "Network_Resolution",
+            "Web",
+            "Web.Proxy"
+          ],
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "version": {
+        "$id": "#/properties/version",
+        "default": 0,
+        "description": "version of detection, e.g. 1 or 2 ...",
+        "examples": [
+          2
+        ],
+        "type": "integer"
+      }
+    },
+    "required": [
+      "name",
+      "id",
+      "version",
+      "date",
+      "datamodel",
+      "description",
+      "type",
+      "author",
+      "search",
+      "known_false_positives",
+      "tags"
+    ],
+    "title": "Detection Schema",
+    "type": "object"
+  }
+  
\ No newline at end of file