diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 126120fd65..4c5b3c4244 100644
--- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -5,7 +5,7 @@ date: '2022-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic is to detect a suspicious child process of MSBuild spawned
   by Windows Script Host - cscript or wscript. This behavior or event are commonly
   seen and used by malware or adversaries to execute malicious msbuild process using
diff --git a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
index 05fa27458f..eb1dd3eca9 100644
--- a/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -5,7 +5,7 @@ date: '2022-03-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
   This behavior is indicative of a COM object being utilized to spawn msbuild from
   wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using