From 7c134dbb5dcacb3f72da7bfafbae6fcc0da55196 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Wed, 10 Mar 2021 14:44:44 +0100
Subject: [PATCH] WIP

---
 .../okta_account_lockout_events.yml           |  6 ++++++
 .../application/okta_failed_sso_attempts.yml  |  7 +++++++
 .../okta_user_logins_from_multiple_cities.yml |  6 ++++++
 ...servers_executing_suspicious_processes.yml |  7 +++++++
 ...ormally_high_cloud_instances_destroyed.yml |  7 +++++++
 ...normally_high_cloud_instances_launched.yml |  7 +++++++
 ...mber_of_cloud_infrastructure_api_calls.yml |  5 +++++
 ...mber_of_cloud_security_group_api_calls.yml |  6 ++++++
 ...ctivity_from_previously_unseen_account.yml |  7 +++++++
 ...g_keys_with_encrypt_policy_without_mfa.yml |  8 ++++++++
 ...with_kms_keys_performing_encryption_s3.yml |  9 +++++++++
 ...ntrol_list_created_with_all_open_ports.yml | 12 ++++++++++++
 ...ws_network_access_control_list_deleted.yml |  8 ++++++++
 ..._access_by_provider_user_and_principal.yml | 10 ++++++++++
 .../aws_saml_update_identity_provider.yml     |  9 +++++++++
 ...alls_from_previously_unseen_user_roles.yml |  7 +++++++
 ...ance_created_by_previously_unseen_user.yml |  6 ++++++
 ...ce_created_in_previously_unused_region.yml |  6 ++++++
 ...e_created_with_previously_unseen_image.yml |  6 ++++++
 ...d_with_previously_unseen_instance_type.yml |  6 ++++++
 ...e_modified_with_previously_unseen_user.yml |  8 ++++++++
 ...ovisioning_from_previously_unseen_city.yml |  8 ++++++++
 ...sioning_from_previously_unseen_country.yml |  8 ++++++++
 ...ning_from_previously_unseen_ip_address.yml |  8 ++++++++
 ...isioning_from_previously_unseen_region.yml |  8 ++++++++
 .../detect_aws_console_login_by_new_user.yml  |  4 ++++
 ...ws_console_login_by_user_from_new_city.yml |  5 +++++
 ...console_login_by_user_from_new_country.yml |  5 +++++
 ..._console_login_by_user_from_new_region.yml |  5 +++++
 ...etect_gcp_storage_access_from_a_new_ip.yml |  7 +++++++
 .../detect_new_open_gcp_storage_buckets.yml   | 11 +++++++++++
 .../cloud/detect_new_open_s3_buckets.yml      | 10 ++++++++++
 ...etect_new_open_s3_buckets_over_aws_cli.yml | 13 +++++++++++++
 .../cloud/detect_s3_access_from_a_new_ip.yml  |  5 +++++
 ...s_security_hub_alerts_for_ec2_instance.yml |  9 +++++++++
 ...ke_in_aws_security_hub_alerts_for_user.yml |  5 +++++
 ...blocked_outbound_traffic_from_your_aws.yml |  5 +++++
 .../detect_spike_in_s3_bucket_deletion.yml    |  4 ++++
 ...of_login_failures_from_a_single_source.yml | 12 ++++++++++++
 ...365_add_app_role_assignment_grant_user.yml |  9 +++++++++
 .../cloud/o365_added_service_principal.yml    |  9 +++++++++
 .../cloud/o365_bypass_mfa_via_trusted_ip.yml  | 12 ++++++++++++
 detections/cloud/o365_disable_mfa.yml         |  9 +++++++++
 ...xcessive_authentication_failures_alert.yml |  8 ++++++++
 .../cloud/o365_excessive_sso_logon_errors.yml |  7 +++++++
 .../cloud/o365_new_federated_domain_added.yml | 10 ++++++++++
 detections/cloud/o365_pst_export_alert.yml    |  8 ++++++++
 ...o365_suspicious_admin_email_forwarding.yml |  4 ++++
 .../o365_suspicious_rights_delegation.yml     |  4 ++++
 .../o365_suspicious_user_email_forwarding.yml |  4 ++++
 .../dns_record_changed.yml                    |  2 ++
 ...counts_with_high_risk_roles_by_project.yml |  0
 ...sk_permissions_by_resource_and_account.yml |  0
 .../gcp_detect_oauth_token_abuse.yml          |  0
 .../gcp_kubernetes_cluster_scan_detection.yml |  0
 ...ct_most_active_service_accounts_by_pod.yml |  0
 ..._detect_rbac_authorizations_by_account.yml |  0
 ...tes_aws_detect_sensitive_object_access.yml |  0
 ...netes_aws_detect_sensitive_role_access.yml |  0
 ...vice_accounts_forbidden_failure_access.yml |  0
 ...tive_service_accounts_by_pod_namespace.yml |  0
 ...e_detect_rbac_authorization_by_account.yml |  0
 ...s_azure_detect_sensitive_object_access.yml |  0
 ...tes_azure_detect_sensitive_role_access.yml |  0
 ...vice_accounts_forbidden_failure_access.yml |  0
 ..._azure_detect_suspicious_kubectl_calls.yml |  0
 .../kubernetes_azure_pod_scan_fingerprint.yml |  0
 .../kubernetes_azure_scan_fingerprint.yml     |  0
 ..._detect_RBAC_authorizations_by_account.yml |  0
 ...ct_most_active_service_accounts_by_pod.yml |  0
 ...tes_gcp_detect_sensitive_object_access.yml |  0
 ...netes_gcp_detect_sensitive_role_access.yml |  0
 ...vice_accounts_forbidden_failure_access.yml |  0
 ...es_gcp_detect_suspicious_kubectl_calls.yml |  0
 .../new_container_uploaded_to_aws_ecr.yml     |  3 +++
 ...pectre_and_meltdown_vulnerable_systems.yml |  0
 .../suspicious_email___uba_anomaly.yml        |  2 ++
 .../access_lsass_memory_for_dump_creation.yml |  9 +++++++++
 ..._to_add_certificate_to_untrusted_store.yml |  6 ++++++
 ...ution_policy_to_unrestricted_or_bypass.yml |  6 ++++++
 .../attempt_to_stop_security_service.yml      |  6 ++++++
 ...dential_dump_from_registry_via_reg_exe.yml |  5 +++++
 .../endpoint/batch_file_write_to_system32.yml |  6 ++++++
 .../bcdedit_failure_recovery_modification.yml |  7 +++++++
 .../certutil_exe_certificate_extraction.yml   |  6 ++++++
 .../endpoint/common_ransomware_extensions.yml |  6 ++++++
 .../endpoint/common_ransomware_notes.yml      |  6 ++++++
 ...ate_local_admin_accounts_using_net_exe.yml |  7 +++++++
 ...or_delete_windows_shares_using_net_exe.yml |  7 +++++++
 .../create_remote_thread_into_lsass.yml       |  8 ++++++++
 .../creation_of_lsass_dump_with_taskmgr.yml   |  7 +++++++
 .../endpoint/creation_of_shadow_copy.yml      |  9 +++++++++
 ...f_shadow_copy_with_wmic_and_powershell.yml |  6 ++++++
 ...ping_via_copy_command_from_shadow_copy.yml |  9 +++++++++
 ...ial_dumping_via_symlink_to_shadow_copy.yml |  9 +++++++++
 .../endpoint/deleting_shadow_copies.yml       |  8 ++++++++
 ...ivity_related_to_pass_the_hash_attacks.yml |  8 ++++++++
 ...omputer_changed_with_anonymous_account.yml |  7 +++++++
 ...redential_dumping_through_lsass_access.yml | 10 ++++++++++
 ...cessive_account_lockouts_from_endpoint.yml |  6 ++++++
 ...detect_excessive_user_account_lockouts.yml |  5 +++++
 .../endpoint/detect_html_help_renamed.yml     | 10 ++++++++++
 .../detect_html_help_spawn_child_process.yml  | 10 ++++++++++
 .../detect_html_help_url_in_command_line.yml  |  9 +++++++++
 ...l_help_using_infotech_storage_handlers.yml |  8 ++++++++
 .../detect_mshta_inline_hta_execution.yml     |  8 ++++++++
 detections/endpoint/detect_mshta_renamed.yml  | 10 ++++++++++
 .../detect_mshta_url_in_command_line.yml      |  7 +++++++
 .../detect_new_local_admin_account.yml        |  6 ++++++
 ...nterception_by_creation_of_program_exe.yml |  9 ++++++++-
 ...system_network_configuration_discovery.yml |  7 +++++++
 ...ohibited_applications_spawning_cmd_exe.yml |  7 +++++++
 .../detect_psexec_with_accepteula_flag.yml    |  6 ++++++
 .../endpoint/detect_rare_executables.yml      |  5 +++++
 .../detect_regasm_spawning_a_process.yml      |  9 +++++++++
 .../detect_regasm_with_network_connection.yml | 10 ++++++++++
 ..._regasm_with_no_command_line_arguments.yml | 12 ++++++++++++
 .../detect_regsvcs_spawning_a_process.yml     | 10 ++++++++++
 ...detect_regsvcs_with_network_connection.yml |  9 +++++++++
 ...regsvcs_with_no_command_line_arguments.yml | 13 +++++++++++++
 ...ct_regsvr32_application_control_bypass.yml |  9 +++++++++
 ...2_application_control_bypass___advpack.yml |  6 ++++++
 ..._application_control_bypass___setupapi.yml |  6 ++++++
 ..._application_control_bypass___syssetup.yml |  6 ++++++
 .../detect_rundll32_inline_hta_execution.yml  |  8 ++++++++
 ..._cmd_exe_to_launch_script_interpreters.yml |  8 ++++++++
 .../disabling_remote_user_account_control.yml |  8 ++++++++
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  6 ++++++
 .../endpoint/dump_lsass_via_procdump.yml      |  6 ++++++
 .../dump_lsass_via_procdump_rename.yml        |  8 ++++++++
 ...ution_of_file_with_multiple_extensions.yml |  6 ++++++
 .../endpoint/file_with_samsam_extension.yml   |  6 ++++++
 .../first_time_seen_child_process_of_zoom.yml |  9 +++++++++
 ..._files_and_directories_with_attrib_exe.yml |  7 +++++++
 ...asting_spn_request_with_rc4_encryption.yml |  8 ++++++++
 ...connect_to_internet_with_hidden_window.yml |  7 +++++++
 ...s_powershell_process___encoded_command.yml |  8 ++++++++
 ...hell_process___execution_policy_bypass.yml |  8 ++++++++
 ...ll_process_with_obfuscation_techniques.yml |  8 ++++++++
 ...nitor_registry_keys_for_print_monitors.yml |  8 ++++++++
 .../nltest_domain_trust_discovery.yml         |  9 +++++++++
 detections/endpoint/ntdsutil_export_ntds.yml  |  9 +++++++++
 .../overwriting_accessibility_binaries.yml    |  6 ++++++
 ...eating_lnk_file_in_suspicious_location.yml |  9 +++++++++
 .../endpoint/process_execution_via_wmi.yml    |  7 +++++++
 .../endpoint/processes_launching_netsh.yml    |  8 ++++++++
 ...ulating_windows_services_registry_keys.yml |  8 ++++++++
 ...istry_keys_for_creating_shim_databases.yml |  6 ++++++
 .../registry_keys_used_for_persistence.yml    |  6 ++++++
 ...try_keys_used_for_privilege_escalation.yml |  6 ++++++
 .../remote_process_instantiation_via_wmi.yml  |  7 +++++++
 .../rundll_loading_dll_by_ordinal.yml         |  7 +++++++
 .../endpoint/ryuk_test_files_detected.yml     |  5 +++++
 .../endpoint/samsam_test_file_write.yml       |  6 ++++++
 .../sc_exe_manipulating_windows_services.yml  |  7 +++++++
 ...eduled_task_deleted_or_created_via_cmd.yml |  8 ++++++++
 ...htasks_scheduling_job_on_remote_system.yml |  7 +++++++
 .../schtasks_used_for_forcing_a_reboot.yml    |  7 +++++++
 .../endpoint/script_execution_via_wmi.yml     |  5 +++++
 .../endpoint/shim_database_file_creation.yml  |  6 ++++++
 ...nstallation_with_suspicious_parameters.yml |  6 ++++++
 .../endpoint/short_lived_windows_accounts.yml |  5 +++++
 .../single_letter_process_on_endpoint.yml     |  6 ++++++
 ...ous_microsoft_workflow_compiler_rename.yml | 10 ++++++++++
 ...ious_microsoft_workflow_compiler_usage.yml |  7 +++++++
 .../endpoint/suspicious_msbuild_path.yml      |  8 ++++++++
 .../endpoint/suspicious_msbuild_rename.yml    | 10 ++++++++++
 .../endpoint/suspicious_msbuild_spawn.yml     |  8 ++++++++
 .../suspicious_mshta_child_process.yml        |  8 ++++++++
 .../endpoint/suspicious_mshta_spawn.yml       |  8 ++++++++
 .../endpoint/suspicious_reg_exe_process.yml   |  9 +++++++++
 ...ious_regsvr32_register_suspicious_path.yml | 10 ++++++++++
 .../suspicious_rundll32_dllregisterserver.yml |  9 +++++++++
 .../endpoint/suspicious_rundll32_rename.yml   | 10 ++++++++++
 .../endpoint/suspicious_rundll32_startw.yml   |  9 +++++++++
 ...undll32_with_no_command_line_arguments.yml | 11 +++++++++++
 .../endpoint/suspicious_wevtutil_usage.yml    |  7 +++++++
 ...spicious_writes_to_windows_recycle_bin.yml | 11 +++++++++++
 ...system_information_discovery_detection.yml |  6 ++++++
 ...rocesses_run_from_unexpected_locations.yml |  9 +++++++++
 .../endpoint/unload_sysmon_filter_driver.yml  |  8 ++++++++
 .../endpoint/unusually_long_command_line.yml  |  6 ++++++
 .../unusually_long_command_line___mltk.yml    |  6 ++++++
 detections/endpoint/usn_journal_deletion.yml  |  8 ++++++++
 .../wbadmin_delete_system_backups.yml         |  7 +++++++
 detections/endpoint/windows_adfind_exe.yml    |  9 +++++++++
 .../endpoint/windows_event_log_cleared.yml    |  8 ++++++--
 ...ndows_security_account_manager_stopped.yml |  6 ++++++
 ..._permanent_event_subscription___sysmon.yml | 10 ++++++++++
 .../detect_new_login_attempts_to_routers.yml  |  5 +++++
 .../email_attachments_with_lots_of_spaces.yml |  7 +++++++
 ...s_sending_high_volume_traffic_to_hosts.yml |  5 +++++
 .../monitor_email_for_brand_abuse.yml         |  5 +++++
 .../no_windows_updates_in_a_time_frame.yml    |  5 +++++
 ...suspicious_email_attachment_extensions.yml |  5 +++++
 .../application/suspicious_java_classes.yml   | 10 ++++++++++
 ..._eks_kubernetes_cluster_scan_detection.yml | 12 ++++++++++++
 ...azon_eks_kubernetes_pod_scan_detection.yml | 13 +++++++++++++
 .../aws_detect_attach_to_role_policy.yml      |  3 +++
 .../aws_detect_permanent_key_creation.yml     | 12 ++++++++++++
 .../cloud/aws_detect_role_creation.yml        | 19 +++++++++++++++++++
 .../aws_detect_sts_assume_role_abuse.yml      | 13 +++++++++++++
 ...aws_detect_sts_get_session_token_abuse.yml | 12 ++++++++++++
 .../cloud/gcp_detect_gcploit_framework.yml    | 10 ++++++++++
 ..._kubernetes_cluster_pod_scan_detection.yml | 10 ++++++++++
 ...es_aws_detect_suspicious_kubectl_calls.yml |  8 ++++++++
 .../child_processes_of_spoolsv_exe.yml        |  9 +++++++++
 .../detect_baron_samedit_cve_2021_3156.yml    |  2 ++
 ...t_baron_samedit_cve_2021_3156_segfault.yml |  3 +++
 ...aron_samedit_cve_2021_3156_via_osquery.yml |  3 +++
 .../detect_oulook_exe_writing_a__zip_file.yml |  8 ++++++++
 .../detection_of_tools_built_by_nirsoft.yml   |  6 ++++++
 ...irst_time_seen_running_windows_service.yml |  5 +++++
 .../macos___re_opened_applications.yml        |  8 ++++++++
 .../processes_tapping_keyboard_events.yml     |  8 ++++++++
 ...mote_desktop_process_running_on_system.yml |  6 ++++++
 .../endpoint/spike_in_file_writes.yml         |  4 ++++
 ...urst_correlation_dll_and_network_event.yml |  5 +++++
 .../wmi_permanent_event_subscription.yml      |  6 ++++++
 .../wmi_temporary_event_subscription.yml      |  5 +++++
 .../network/detect_arp_poisoning.yml          |  9 +++++++++
 .../network/excessive_dns_failures.yml        |  5 +++++
 ...e_of_network_traffic_from_email_server.yml |  5 +++++
 .../large_volume_of_dns_any_queries.yml       |  5 +++++
 .../prohibited_network_traffic_allowed.yml    |  6 ++++++
 .../network/protocol_or_port_mismatch.yml     |  6 ++++++
 ...ls_passing_authentication_in_cleartext.yml |  7 +++++++
 227 files changed, 1502 insertions(+), 3 deletions(-)
 rename detections/{experimental/network => deprecated}/dns_record_changed.yml (98%)
 rename detections/{experimental/cloud => deprecated}/gcp_detect_accounts_with_high_risk_roles_by_project.yml (100%)
 rename detections/{experimental/cloud => deprecated}/gcp_detect_high_risk_permissions_by_resource_and_account.yml (100%)
 rename detections/{experimental/cloud => deprecated}/gcp_detect_oauth_token_abuse.yml (100%)
 rename detections/{experimental/cloud => deprecated}/gcp_kubernetes_cluster_scan_detection.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_aws_detect_rbac_authorizations_by_account.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_aws_detect_sensitive_object_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_aws_detect_sensitive_role_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_rbac_authorization_by_account.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_sensitive_object_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_sensitive_role_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_detect_suspicious_kubectl_calls.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_pod_scan_fingerprint.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_azure_scan_fingerprint.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_sensitive_object_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_sensitive_role_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml (100%)
 rename detections/{experimental/cloud => deprecated}/kubernetes_gcp_detect_suspicious_kubectl_calls.yml (100%)
 rename detections/{cloud => deprecated}/new_container_uploaded_to_aws_ecr.yml (97%)
 rename detections/{experimental/application => deprecated}/spectre_and_meltdown_vulnerable_systems.yml (100%)
 rename detections/{experimental/application => deprecated}/suspicious_email___uba_anomaly.yml (98%)

diff --git a/detections/application/okta_account_lockout_events.yml b/detections/application/okta_account_lockout_events.yml
index 0740c2cf38..9e9fb09806 100644
--- a/detections/application/okta_account_lockout_events.yml
+++ b/detections/application/okta_account_lockout_events.yml
@@ -29,4 +29,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - client.geographicalContext.country
+  - client.geographicalContext.state
+  - client.geographicalContext.city
   security_domain: access
diff --git a/detections/application/okta_failed_sso_attempts.yml b/detections/application/okta_failed_sso_attempts.yml
index 8b5426dcc9..d3657a18aa 100644
--- a/detections/application/okta_failed_sso_attempts.yml
+++ b/detections/application/okta_failed_sso_attempts.yml
@@ -29,4 +29,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - app
+  - user
+  - result
+  - src_ip
   security_domain: access
diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml
index 35dba10164..f9af8ceabf 100644
--- a/detections/application/okta_user_logins_from_multiple_cities.yml
+++ b/detections/application/okta_user_logins_from_multiple_cities.yml
@@ -35,4 +35,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - displayMessage
+  - client.geographicalContext.city
+  - client.geographicalContext.state
+  - user
   security_domain: access
diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml
index b9cceaa60a..0b9aedda13 100644
--- a/detections/application/web_servers_executing_suspicious_processes.yml
+++ b/detections/application/web_servers_executing_suspicious_processes.yml
@@ -39,4 +39,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest_category
+  - Processes.process
+  - Processes.process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml
index c8df0ab4a6..9c63535d48 100644
--- a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml
+++ b/detections/cloud/abnormally_high_cloud_instances_destroyed.yml
@@ -47,6 +47,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 10
diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/cloud/abnormally_high_cloud_instances_launched.yml
index 707441011f..a51da3d794 100644
--- a/detections/cloud/abnormally_high_cloud_instances_launched.yml
+++ b/detections/cloud/abnormally_high_cloud_instances_launched.yml
@@ -48,6 +48,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.object_category
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 40
diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
index c1ff376df3..06fd6b105a 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
@@ -46,6 +46,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.user
+  - All_Changes.status
   risk_object: user
   risk_object_type: user
   risk_score: 25
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
index d0d3e0896f..4aa1e3f506 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
@@ -47,6 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.command
+  - All_Changes.object_category
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 25
diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
index 031dc0314f..c665a5fac0 100644
--- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
+++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
@@ -50,6 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.vendor_account
+  - Authentication.user
+  - Authentication.user_role
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 15
diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
index a4908609fa..13b68bb5cf 100644
--- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
@@ -38,4 +38,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventSource
+  - eventID
+  - awsRegion
+  - requestParameters.policy
+  - userIdentity.principalId
   security_domain: threat
diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
index 4d6aa650a2..1e41b38fcb 100644
--- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
@@ -33,4 +33,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.x-amz-server-side-encryption
+  - requestParameters.bucketName
+  - requestParameters.x-amz-copy-source
+  - requestParameters.key
+  - userAgent
+  - region
   security_domain: threat
diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
index d7139b27ac..83225223b0 100644
--- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
@@ -44,6 +44,18 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.ruleAction
+  - requestParameters.egress
+  - requestParameters.aclProtocol
+  - requestParameters.portRange.to
+  - requestParameters.portRange.from
+  - requestParameters.cidrBlock
+  - userName
+  - userIdentity.principalId
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 10
diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml
index 8e46d7d836..2316056954 100644
--- a/detections/cloud/aws_network_access_control_list_deleted.yml
+++ b/detections/cloud/aws_network_access_control_list_deleted.yml
@@ -40,6 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.egress
+  - userName
+  - userIdentity.principalId
+  - src
+  - userAgent
   risk_object: userName
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
index 12cbf5c08b..8779e8b718 100644
--- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
@@ -40,4 +40,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - requestParameters.principalArn
+  - requestParameters.roleArn
+  - requestParameters.roleSessionName
+  - recipientAccountId
+  - responseElements.issuer
+  - sourceIPAddress
+  - userAgent
   security_domain: threat
diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml
index dcb2dc6493..fafce5a632 100644
--- a/detections/cloud/aws_saml_update_identity_provider.yml
+++ b/detections/cloud/aws_saml_update_identity_provider.yml
@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - eventType
+  - requestParameters.sAMLProviderArn
+  - userIdentity.sessionContext.sessionIssuer.arn
+  - sourceIPAddress
+  - userIdentity.accessKeyId
+  - userIdentity.principalId
   security_domain: threat
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index 6df67d5086..6e4aee9e77 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -44,6 +44,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - All_Changes.user_type
+  - All_Changes.status
+  - All_Changes.command
+  - All_Changes.object
   risk_object: user
   risk_object_type: user
   risk_score: 25
diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
index 3d7badf4fb..6d8f20e18d 100644
--- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
@@ -42,6 +42,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object
+  - All_Changes.action
+  - All_Changes.user
+  - All_Changes.vendor_region
   risk_object: user
   risk_object_type: user
   risk_score: 20
diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
index 978fde7bf0..5181900d57 100644
--- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
@@ -48,6 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.vendor_region
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
index d0929d8ea7..068b7651d9 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.image_id
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index 4aeac30448..30e8096950 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -43,6 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.Instance_Changes.instance_type
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 20
diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
index aa780adff6..810320d61c 100644
--- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
@@ -43,6 +43,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.command
+  - All_Changes.action
+  - All_Changes.change_type
+  - All_Changes.status
+  - All_Changes.user
   risk_object: user
   risk_object_type: user
   risk_score: 10
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
index 8c643b706c..aa1b0b25d6 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 10
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
index fbb48af47f..daa8caf0d3 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
index e509bcbc4a..b96889ae17 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
@@ -57,6 +57,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.object_id
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
index 20f142f9ab..41446e109c 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
@@ -58,6 +58,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.action
+  - All_Changes.status
+  - All_Changes.src
+  - All_Changes.user
+  - All_Changes.object
+  - All_Changes.command
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index 0aafdb8a6d..22b17e8a28 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -48,6 +48,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
   risk_object: user
   risk_object_type: user
   risk_score: 30
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index f1da78bdcd..bb25888484 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 49329e47c4..fd6b5eb1b2 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index 965ab4d574..a87c40ec8d 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -56,6 +56,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.signature
+  - Authentication.user
+  - Authentication.src
   risk_object: user
   risk_object_type: user
   risk_score: 5
diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
index d5a702a1cb..9d81174150 100644
--- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
+++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
@@ -54,4 +54,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - sc_status_
+  - cs_object_
+  - c_ip_ 
+  - cs_uri_
+  - cs_method_
   security_domain: network
diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml
index cb8dfcf3fe..b014153fc1 100644
--- a/detections/cloud/detect_new_open_gcp_storage_buckets.yml
+++ b/detections/cloud/detect_new_open_gcp_storage_buckets.yml
@@ -42,4 +42,15 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - data.resource.type
+  - data.protoPayload.methodName
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action
+  - data.protoPayload.authenticationInfo.principalEmail
+  - data.protoPayload.resourceLocation.currentLocations{}
+  - data.protoPayload.requestMetadata.callerIp
+  - data.protoPayload.resourceName
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role
+  - data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member
   security_domain: network
diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml
index 7de7edd00e..edfa3321b1 100644
--- a/detections/cloud/detect_new_open_s3_buckets.yml
+++ b/detections/cloud/detect_new_open_s3_buckets.yml
@@ -43,6 +43,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - uri
+  - permission
   risk_object: src
   risk_object_type: system
   risk_score: 20
diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
index 83af071e38..f7fcd7be69 100644
--- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
@@ -44,6 +44,19 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventSource
+  - eventName
+  - requestParameters.accessControlList.x-amz-grant-read-acp
+  - requestParameters.accessControlList.x-amz-grant-write
+  - requestParameters.accessControlList.x-amz-grant-write-acp
+  - requestParameters.accessControlList.x-amz-grant-full-control
+  - requestParameters.bucketName
+  - userName
+  - userIdentity.principalId
+  - userAgent
+  - bucketName
   risk_object: src
   risk_object_type: system
   risk_score: 20
diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml
index 3cf6e5e656..63a3286e81 100644
--- a/detections/cloud/detect_s3_access_from_a_new_ip.yml
+++ b/detections/cloud/detect_s3_access_from_a_new_ip.yml
@@ -43,6 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - http_status
+  - bucket_name
+  - remote_ip
   risk_object: src_ip
   risk_object_type: system
   risk_score: 10
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index f5081516f4..31fe5591f0 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Resources{}.Type
+  - Title
+  - Types{}
+  - vendor_account
+  - vendor_region
+  - severity
+  - dest
   security_domain: network
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
index a2cbabf3fe..9b2b3d0f36 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
@@ -31,4 +31,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - findings{}.Resources{}.Type
+  - indings{}.Resources{}.Id
+  - user
   security_domain: network
diff --git a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
index fbc6eef691..f405807d9d 100644
--- a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
+++ b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
@@ -59,6 +59,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - action
+  - src_ip
+  - dest_ip
   risk_object: src_ip
   risk_object_type: system
   risk_score: 20
diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
index e43dd157f8..905e4f1fc9 100644
--- a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
+++ b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
@@ -52,6 +52,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.arn
   risk_object: user
   risk_object_type: user
   risk_score: 10
diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
index 549076642f..faf0db4630 100644
--- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
+++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
@@ -33,4 +33,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - record_type
+  - app
+  - user
+  - LogonError
+  - authentication_method
+  - signature
+  - UserAgent
+  - src_ip
+  - record_type
   security_domain: threat
diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
index 216d2d9ccd..7ead7f5ed4 100644
--- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml
+++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
@@ -36,4 +36,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Actor{}.ID
+  - Actor{}.Type
+  - ActorIpAddress
+  - dest
+  - ResultStatus
   security_domain: threat
diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml
index 02c1ab2d47..ab9b6d5504 100644
--- a/detections/cloud/o365_added_service_principal.yml
+++ b/detections/cloud/o365_added_service_principal.yml
@@ -39,4 +39,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - signature
+  - Actor{}.ID
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - Target{}.ID
+  - ActorIpAddress
   security_domain: threat
diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
index 068ee74a67..aa8da9e19c 100644
--- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -39,4 +39,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - signature
+  - ModifiedProperties{}.Name
+  - ModifiedProperties{}.NewValue
+  - ModifiedProperties{}.OldValue
+  - user
+  - vendor_product
+  - vendor_account
+  - status
+  - user_id
+  - action
   security_domain: threat
diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml
index 6f2bafe120..609709daf6 100644
--- a/detections/cloud/o365_disable_mfa.yml
+++ b/detections/cloud/o365_disable_mfa.yml
@@ -32,4 +32,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - UserType
+  - user
+  - status
+  - signature
+  - dest
+  - ResultStatus
   security_domain: threat
diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index 7bed02ff02..4b74f9b26f 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - UserAuthenticationMethod
+  - status
+  - UserAgent
+  - src_ip
+  - user
   security_domain: threat
diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml
index cb3a984dda..1fcf85f297 100644
--- a/detections/cloud/o365_excessive_sso_logon_errors.yml
+++ b/detections/cloud/o365_excessive_sso_logon_errors.yml
@@ -34,4 +34,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - LogonError
+  - ActorIpAddress
+  - UserAgent
+  - UserId
   security_domain: threat
diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml
index 9de591d753..0e656e7e1b 100644
--- a/detections/cloud/o365_new_federated_domain_added.yml
+++ b/detections/cloud/o365_new_federated_domain_added.yml
@@ -38,4 +38,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Workload
+  - Operation
+  - Parameters{}.Value
+  - ObjectId
+  - OrganizationName
+  - OriginatingServer
+  - UserId
+  - UserKey
   security_domain: threat
diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml
index ff9b4fdc02..420be7017e 100644
--- a/detections/cloud/o365_pst_export_alert.yml
+++ b/detections/cloud/o365_pst_export_alert.yml
@@ -33,4 +33,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Category
+  - Name
+  - Source
+  - Severity
+  - AlertEntityId
+  - Operation
   security_domain: threat
diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml
index 0b68dd9f0f..f418add03f 100644
--- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml
+++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml
@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat
diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml
index 7c149be71d..f0c22f923a 100644
--- a/detections/cloud/o365_suspicious_rights_delegation.yml
+++ b/detections/cloud/o365_suspicious_rights_delegation.yml
@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat
diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml
index 11df462b65..a4ec07f404 100644
--- a/detections/cloud/o365_suspicious_user_email_forwarding.yml
+++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml
@@ -35,4 +35,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Operation
+  - Parameters
   security_domain: threat
diff --git a/detections/experimental/network/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml
similarity index 98%
rename from detections/experimental/network/dns_record_changed.yml
rename to detections/deprecated/dns_record_changed.yml
index 4815f3310d..e39eb441f7 100644
--- a/detections/experimental/network/dns_record_changed.yml
+++ b/detections/deprecated/dns_record_changed.yml
@@ -57,4 +57,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: network
diff --git a/detections/experimental/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml
similarity index 100%
rename from detections/experimental/cloud/gcp_detect_accounts_with_high_risk_roles_by_project.yml
rename to detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml
diff --git a/detections/experimental/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml
similarity index 100%
rename from detections/experimental/cloud/gcp_detect_high_risk_permissions_by_resource_and_account.yml
rename to detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml
diff --git a/detections/experimental/cloud/gcp_detect_oauth_token_abuse.yml b/detections/deprecated/gcp_detect_oauth_token_abuse.yml
similarity index 100%
rename from detections/experimental/cloud/gcp_detect_oauth_token_abuse.yml
rename to detections/deprecated/gcp_detect_oauth_token_abuse.yml
diff --git a/detections/experimental/cloud/gcp_kubernetes_cluster_scan_detection.yml b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml
similarity index 100%
rename from detections/experimental/cloud/gcp_kubernetes_cluster_scan_detection.yml
rename to detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
rename to detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml b/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml
rename to detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_aws_detect_sensitive_object_access.yml
rename to detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_aws_detect_sensitive_role_access.yml
rename to detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
rename to detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
rename to detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml
rename to detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_sensitive_object_access.yml
rename to detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_sensitive_role_access.yml
rename to detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
rename to detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml
rename to detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_pod_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_pod_scan_fingerprint.yml
rename to detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml
diff --git a/detections/experimental/cloud/kubernetes_azure_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_azure_scan_fingerprint.yml
rename to detections/deprecated/kubernetes_azure_scan_fingerprint.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml b/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
rename to detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
rename to detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_sensitive_object_access.yml
rename to detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_sensitive_role_access.yml
rename to detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
rename to detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
diff --git a/detections/experimental/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml
similarity index 100%
rename from detections/experimental/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml
rename to detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml
diff --git a/detections/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/deprecated/new_container_uploaded_to_aws_ecr.yml
similarity index 97%
rename from detections/cloud/new_container_uploaded_to_aws_ecr.yml
rename to detections/deprecated/new_container_uploaded_to_aws_ecr.yml
index 0ce8471f56..8029f49b61 100644
--- a/detections/cloud/new_container_uploaded_to_aws_ecr.yml
+++ b/detections/deprecated/new_container_uploaded_to_aws_ecr.yml
@@ -30,4 +30,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - 
   security_domain: threat
diff --git a/detections/experimental/application/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml
similarity index 100%
rename from detections/experimental/application/spectre_and_meltdown_vulnerable_systems.yml
rename to detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml
diff --git a/detections/experimental/application/suspicious_email___uba_anomaly.yml b/detections/deprecated/suspicious_email___uba_anomaly.yml
similarity index 98%
rename from detections/experimental/application/suspicious_email___uba_anomaly.yml
rename to detections/deprecated/suspicious_email___uba_anomaly.yml
index 55ce9bdb67..8bf169bd00 100644
--- a/detections/experimental/application/suspicious_email___uba_anomaly.yml
+++ b/detections/deprecated/suspicious_email___uba_anomaly.yml
@@ -41,4 +41,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: threat
diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
index 8e56001e02..eadbd405d5 100644
--- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
@@ -40,4 +40,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
   security_domain: endpoint
diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
index 6b85704d5b..0f93f1c1b7 100644
--- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index a3db88ef9d..7b14e55cf7 100644
--- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
   security_domain: endpoint
diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index aeda81bccd..d20d1cc89a 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -52,4 +52,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index 073111e911..2858b9f883 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -42,4 +42,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 831414fdba..c5ce575bf0 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -46,4 +46,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.user
+  - Filesystem.file_path
   security_domain: endpoint
diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml
index 9677362866..505506d6dd 100644
--- a/detections/endpoint/bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml
@@ -41,4 +41,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index ec5e0c3d65..f26bdc96b6 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -33,4 +33,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index ff222a7ad4..d50b678607 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -57,4 +57,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   security_domain: endpoint
diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml
index a5804398ae..1f553a2cff 100644
--- a/detections/endpoint/common_ransomware_notes.yml
+++ b/detections/endpoint/common_ransomware_notes.yml
@@ -43,4 +43,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   security_domain: endpoint
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index a5ce2ba435..84f445454c 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -44,4 +44,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index e6a41509ee..e397763cf0 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -43,4 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.parent_process
+  - Processs.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml
index f169cc8f10..d2e325f42f 100644
--- a/detections/endpoint/create_remote_thread_into_lsass.yml
+++ b/detections/endpoint/create_remote_thread_into_lsass.yml
@@ -40,4 +40,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - TargetImage
+  - Computer
+  - EventCode
+  - TargetImage
+  - TargetProcessId
   security_domain: endpoint
diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index 40d59d147a..97bc078628 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -46,4 +46,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - TargetFilename
+  - Computer
+  - object_category
   security_domain: endpoint
diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index 351f023936..7b2fdfb622 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -43,4 +43,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 4beda2d029..a61e3fdb17 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -39,4 +39,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index 19a4843bc4..7653ea932e 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -42,4 +42,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index 120f0c6a62..3a7d2528de 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -40,4 +40,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index 30bc424e63..3edefd7369 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -48,4 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
index 059103aaf6..27c04e1afd 100644
--- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
+++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
@@ -41,4 +41,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Logon_Process
+  - WorkstationName
+  - user
+  - dest
   security_domain: access
diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
index acc30daf08..2cd5d2de88 100644
--- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
+++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
@@ -37,4 +37,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetUserName
+  - LogonType
+  - TargetDomainName
+  - user
   security_domain: endpoint
diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
index 731bfccaa9..2c29b0c714 100644
--- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
+++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
@@ -47,4 +47,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - GrantedAccess
+  - Computer
+  - SourceImage
+  - SourceProcessId
+  - TargetImage
+  - TargetProcessId
   security_domain: endpoint
diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index 042c679c5f..1c1581db8c 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -49,4 +49,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.user
+  - nodename
+  - All_Changes.result
+  - All_Changes.dest
   security_domain: access
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index d2cc17c408..087893be3e 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -38,4 +38,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.result
+  - nodename
+  - All_Changes.user
   security_domain: access
diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 22253f2252..80bb170475 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -50,4 +50,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
   security_domain: endpoint
diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml
index cc5e047ef1..979134d257 100644
--- a/detections/endpoint/detect_html_help_spawn_child_process.yml
+++ b/detections/endpoint/detect_html_help_spawn_child_process.yml
@@ -53,4 +53,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index 794e909fe2..f7cf29ee5f 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -55,4 +55,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 93e7d38421..484268fc4a 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -57,4 +57,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 1418a13549..cf0143c90f 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -47,4 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index eb067a7225..aef56a74f1 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -43,4 +43,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 7d03e42ed7..26183d67d0 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -48,4 +48,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml
index 0cb8e5f687..ad7abf7315 100644
--- a/detections/endpoint/detect_new_local_admin_account.yml
+++ b/detections/endpoint/detect_new_local_admin_account.yml
@@ -41,4 +41,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Group_Name
+  - member_id
+  - dest
   security_domain: access
diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
index 6124939409..858e19dd19 100644
--- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
@@ -11,7 +11,7 @@ description: 'The detection Detect Path Interception By Creation Of program exe
   privilege escalation. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe
-  by Processes.user Processes.process_name Processes.process Processes.dest index
+  by Processes.user Processes.process_name Processes.process Processes.dest
   | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?<service_process>[^\\\\]*\.(?:exe|bat|com|ps1))"
   | eval process_name = lower(process_name) | eval service_process = lower(service_process)
   | where process_name != service_process | `security_content_ctime(firstTime)` |
@@ -44,4 +44,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
index c1e2159084..cf874d103c 100644
--- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
@@ -47,4 +47,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.dest
+  - Processes.process_name
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
index 509d2c5873..8a44760b4b 100644
--- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -45,4 +45,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 1750a7346a..dea35fd5cd 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -50,4 +50,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.dest
+  - Processes.parent_process_name
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml
index edb7bb1b93..f401c5ef16 100644
--- a/detections/endpoint/detect_rare_executables.yml
+++ b/detections/endpoint/detect_rare_executables.yml
@@ -50,4 +50,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
index a00804b246..b98d0fe9f8 100644
--- a/detections/endpoint/detect_regasm_spawning_a_process.yml
+++ b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -50,4 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index 0af1359b18..cb935b0f85 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -50,4 +50,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - dest_ip
+  - process_name
+  - Computer
+  - User
+  - src_ip
+  - dest_host
+  - dest_ip
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index 96ca12e9ba..37cce4746c 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -47,4 +47,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - OriginalFileName
+  - CommandLine
+  - dest
+  - User
+  - ParentImage
+  - ParentCommandLine
+  - process_path
+  - Computer
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
index bf9ff231cd..852c8379c1 100644
--- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml
+++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
@@ -49,4 +49,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 8201d1ffea..f58d167364 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -50,4 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - dest_ip
+  - process_name
+  - Computer
+  - User
+  - src_ip
+  - dest_host
   security_domain: Endpoint
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index bb3be4d732..47bbffd0a1 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -47,4 +47,17 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - OriginalFileName
+  - CommandLine
+  - dest
+  - User
+  - ParentImage
+  - ParentCommandLine
+  - OriginalFileName
+  - process_path
+  - Computer
   security_domain: endpoint
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index bb8e357082..10939f9875 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -53,4 +53,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index 5c0b460a46..ededc6777c 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -51,4 +51,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index 274bf9990e..ef478ee546 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -51,4 +51,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index 442b6b21b4..03925c4d56 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -51,4 +51,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 0bf9d3d37a..4e30798fa7 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -49,4 +49,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
   security_domain: endpoint
diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
index d2323a96f4..a437f2bc42 100644
--- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
@@ -43,4 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml
index 42a31fc477..7983188c01 100644
--- a/detections/endpoint/disabling_remote_user_account_control.yml
+++ b/detections/endpoint/disabling_remote_user_account_control.yml
@@ -42,4 +42,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.registry_key_name
+  - Registry.user
+  - Registry.action
   security_domain: endpoint
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index 7c2425cc66..bd590f70b2 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 168bf52b29..57773b1946 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -50,4 +50,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml
index a3134f16e9..4f027eacb1 100644
--- a/detections/endpoint/dump_lsass_via_procdump_rename.yml
+++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml
@@ -48,4 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - OriginalFileName
+  - process_name
+  - EventID
+  - CommandLine
+  - Computer
+  - parent_process_name
   security_domain: endpoint
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index 633473b006..4f8ff42723 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -43,4 +43,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
   security_domain: endpoint
diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml
index 1f28151793..95afab45cc 100644
--- a/detections/endpoint/file_with_samsam_extension.yml
+++ b/detections/endpoint/file_with_samsam_extension.yml
@@ -40,4 +40,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
   security_domain: endpoint
diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
index ed2f96bb2f..60eac8677a 100644
--- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml
+++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
@@ -52,4 +52,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.parent_process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
index 04875404b5..072f27287d 100644
--- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
@@ -43,4 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 68e3409ef1..2ccaa299d6 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -38,4 +38,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - service
+  - service_id
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
index 1ca64442d6..ebf15e0cc5 100644
--- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
@@ -52,4 +52,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index ae5c7cde68..9d6b5b33b3 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -47,4 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process_id
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index ce4c1b25d8..ee4d53f54f 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -49,4 +49,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index 84b9ad0d70..9da3b6a47f 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -48,4 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
index 28370f53e5..836a01c18d 100644
--- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
@@ -47,4 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.action
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.registry_key_name
+  - Registry.user
+  - Registry.registry_value_name
   security_domain: endpoint
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 86d04768fb..e6e45673e1 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -50,4 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 850fadeee6..8f55ab23c1 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -54,4 +54,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml
index f7d474c40e..f61e5c188d 100644
--- a/detections/endpoint/overwriting_accessibility_binaries.yml
+++ b/detections/endpoint/overwriting_accessibility_binaries.yml
@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.dest
   security_domain: endpoint
diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 0fb2843236..bd62631195 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -50,4 +50,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Filesystem.file_hash
+  - Filesystem.user
   security_domain: network
diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index 1de8f1b1ed..56fa715b55 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -41,4 +41,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
   security_domain: endpoint
diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index 885bcbb14d..b82217f196 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -45,4 +45,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index 75a4f307c7..a37c5aea78 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -51,4 +51,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.user
+  - Processes.process
+  - Processes.process_id
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
index 08e0a43252..33f0d5de1f 100644
--- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml
+++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
@@ -41,4 +41,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
   security_domain: endpoint
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 4fd1b76902..9bef6ba923 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -53,4 +53,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
   security_domain: endpoint
diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
index 3eb1f7ebcb..970bc182ac 100644
--- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
@@ -46,4 +46,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.dest
+  - Registry.user
   security_domain: endpoint
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 8730f187a9..74922eb617 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -47,4 +47,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 365530006f..7e143128e2 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -44,4 +44,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml
index 2b3e7386f4..73ccf05ea2 100644
--- a/detections/endpoint/ryuk_test_files_detected.yml
+++ b/detections/endpoint/ryuk_test_files_detected.yml
@@ -38,4 +38,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.dest
+  - Filesystem.user
   security_domain: endpoint
diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml
index 19c7c97446..98742610b0 100644
--- a/detections/endpoint/samsam_test_file_write.yml
+++ b/detections/endpoint/samsam_test_file_write.yml
@@ -39,4 +39,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.user
+  - Filesystem.dest
+  - Filesystem.file_name
+  - Filesystem.file_path
   security_domain: endpoint
diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml
index 1d634d0a46..9c8e85641d 100644
--- a/detections/endpoint/sc_exe_manipulating_windows_services.yml
+++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml
@@ -51,4 +51,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 6041f950c7..89a5b7b3b1 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -42,4 +42,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index 445e44861c..b7e5eac5c3 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -43,4 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index c6c443a99e..86ffdcc0d3 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -40,4 +40,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index f871561958..572bca9e10 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -41,4 +41,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.user
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml
index 942141552a..6858157758 100644
--- a/detections/endpoint/shim_database_file_creation.yml
+++ b/detections/endpoint/shim_database_file_creation.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_hash
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.dest
   security_domain: endpoint
diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
index 0ab6149713..59318c5087 100644
--- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
+++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml
index 01b6224326..81a9ef2239 100644
--- a/detections/endpoint/short_lived_windows_accounts.yml
+++ b/detections/endpoint/short_lived_windows_accounts.yml
@@ -40,4 +40,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Changes.result_id
+  - All_Changes.user
+  - All_Changes.dest
   security_domain: access
diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml
index b9e1602470..826f6d6855 100644
--- a/detections/endpoint/single_letter_process_on_endpoint.yml
+++ b/detections/endpoint/single_letter_process_on_endpoint.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.process
+  - Processes.process_name
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 4252a742a7..dd8a0cb457 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -45,4 +45,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 24cdd929a4..5eefa64853 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -43,4 +43,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index 21360144b3..fbb018d544 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -48,4 +48,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_path
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index d1144fcfc8..ce9b5aac2d 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -45,4 +45,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index 76fea9f03c..fbfc02af18 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -47,4 +47,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 5a9df018d5..9d75f7b3d7 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -49,4 +49,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index 1b379e204f..d3d9a537ce 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -45,4 +45,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index 0ac5e11eae..d90df61adc 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -49,4 +49,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index c0e07b6608..6d00c6edeb 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -50,4 +50,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index cf186d2108..efceda4b73 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -53,4 +53,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index 86a5d478f8..c1946a3499 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -47,4 +47,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - OriginalFileName
+  - process_name
+  - Computer
+  - User
+  - parent_process_name
+  - process_path
+  - CommandLine
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index 7ea978a948..b5846eae39 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -53,4 +53,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index 7c062b319c..5da7958885 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -48,4 +48,15 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventID
+  - process_name
+  - OriginalFileName
+  - CommandLine
+  - dest
+  - User
+  - ParentImage
+  - ParentCommandLine
+  - process_path
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml
index d38a7b7e54..3b0d69d03f 100644
--- a/detections/endpoint/suspicious_wevtutil_usage.yml
+++ b/detections/endpoint/suspicious_wevtutil_usage.yml
@@ -51,4 +51,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
index 6336a4a2c5..e6e52c0c47 100644
--- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
+++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
@@ -40,4 +40,15 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.file_name
+  - Filesystem.process_id
+  - Filesystem.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.process_id
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index 7ccc22413b..55304c3f96 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.user
+  - Processes.process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index 7d96db24b9..832c8ad50a 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -41,4 +41,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_path
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_name
+  - Processes.process_hash
   security_domain: endpoint
diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml
index 051223669f..766fd5d2fd 100644
--- a/detections/endpoint/unload_sysmon_filter_driver.yml
+++ b/detections/endpoint/unload_sysmon_filter_driver.yml
@@ -43,4 +43,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml
index f7d114d917..9cecb80c5c 100644
--- a/detections/endpoint/unusually_long_command_line.yml
+++ b/detections/endpoint/unusually_long_command_line.yml
@@ -42,4 +42,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
+  - Processes.process
   security_domain: endpoint
diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml
index 458754720a..67c273e04e 100644
--- a/detections/endpoint/unusually_long_command_line___mltk.yml
+++ b/detections/endpoint/unusually_long_command_line___mltk.yml
@@ -52,4 +52,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.user
+  - Processes.dest
+  - Processes.process_name
+  - Processes.process
   security_domain: endpoint
diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml
index b0a5d88e99..d994117bba 100644
--- a/detections/endpoint/usn_journal_deletion.yml
+++ b/detections/endpoint/usn_journal_deletion.yml
@@ -49,4 +49,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: endpoint
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index 5c47434d89..c8a5890ee4 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -44,4 +44,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index d83a5319bc..5fbf2501ab 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -46,4 +46,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.dest
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process
+  - Processes.process_id
+  - Processes.parent_process_id
   security_domain: endpoint
diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 4551e47785..97ffdf278f 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -7,10 +7,10 @@ type: batch
 datamodel: []
 description: This search looks for Windows events that indicate one of the Windows
   event logs has been purged.
-search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system`
+search: '(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system`
   EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
   dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_event_log_cleared_filter`
+  | `windows_event_log_cleared_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts.
 known_false_positives: It is possible that these logs may be legitimately cleared
@@ -43,4 +43,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - dest
   security_domain: endpoint
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index b0e0e01abf..fef52f7f43 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -40,4 +40,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index bdf3982186..02ea4b7c39 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -38,4 +38,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - host
+  - user
+  - Operation
+  - EventType
+  - Query
+  - Consumer
+  - Filter
   security_domain: endpoint
diff --git a/detections/experimental/application/detect_new_login_attempts_to_routers.yml b/detections/experimental/application/detect_new_login_attempts_to_routers.yml
index dcb8aa1b6b..64c82afde4 100644
--- a/detections/experimental/application/detect_new_login_attempts_to_routers.yml
+++ b/detections/experimental/application/detect_new_login_attempts_to_routers.yml
@@ -36,4 +36,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.dest_category
+  - Authentication.dest
+  - Authentication.user
   security_domain: network
diff --git a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml
index b13ccb80ee..41756c1e47 100644
--- a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml
+++ b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml
@@ -45,4 +45,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Email.recipient
+  - All_Email.file_name
+  - All_Email.src_user
+  - All_Email.file_name
+  - All_Email.message_id
   security_domain: network
diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
index e829ed6c99..47b1b30839 100644
--- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
+++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
@@ -52,4 +52,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.bytes_out
+  - All_Traffic.src_category
+  - All_Traffic.dest_ip
   security_domain: network
diff --git a/detections/experimental/application/monitor_email_for_brand_abuse.yml b/detections/experimental/application/monitor_email_for_brand_abuse.yml
index b90a8c2d05..bb4e5c8f99 100644
--- a/detections/experimental/application/monitor_email_for_brand_abuse.yml
+++ b/detections/experimental/application/monitor_email_for_brand_abuse.yml
@@ -36,4 +36,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Email.recipient
+  - All_Email.src_user
+  - All_Email.message_id
   security_domain: network
diff --git a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml
index 260866e37a..436ad2e90a 100644
--- a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml
+++ b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml
@@ -39,4 +39,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Updates.status
+  - Updates.vendor_product
+  - Updates.dest
   security_domain: endpoint
diff --git a/detections/experimental/application/suspicious_email_attachment_extensions.yml b/detections/experimental/application/suspicious_email_attachment_extensions.yml
index a5ddc04ec4..0dd5924c4e 100644
--- a/detections/experimental/application/suspicious_email_attachment_extensions.yml
+++ b/detections/experimental/application/suspicious_email_attachment_extensions.yml
@@ -47,4 +47,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Email.file_name
+  - All_Email.src_user
+  - All_Email.message_id
   security_domain: network
diff --git a/detections/experimental/application/suspicious_java_classes.yml b/detections/experimental/application/suspicious_java_classes.yml
index 20b9f4c9a4..71b239ab65 100644
--- a/detections/experimental/application/suspicious_java_classes.yml
+++ b/detections/experimental/application/suspicious_java_classes.yml
@@ -33,4 +33,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - http_method
+  - http_content_length
+  - src_ip
+  - url
+  - status
+  - http_user_agent
+  - src
+  - dest
   security_domain: threat
diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
index 17fc6b562d..f480552aaf 100644
--- a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
+++ b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
@@ -31,4 +31,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - user.username
+  - userAgent
+  - sourceIPs{}
+  - responseStatus.reason
+  - source
+  - responseStatus.code
+  - verb
+  - requestURI
+  - src_ip
+  - user.groups{}
   security_domain: threat
diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
index 7ec567a60c..b08c483e37 100644
--- a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
+++ b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
@@ -32,4 +32,17 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - user.username
+  - verb
+  - objectRef.resource
+  - requestURI
+  - source
+  - sourceIPs{}
+  - responseStatus.reason
+  - responseStatus.code
+  - userAgent
+  - src_ip
+  - user.groups{}
   security_domain: threat
diff --git a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml
index ec33f24fd2..dccf43f830 100644
--- a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml
+++ b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml
@@ -30,4 +30,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - requestParameters.policyArn
   security_domain: threat
diff --git a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml
index 80b079210e..fa9d678c60 100644
--- a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml
+++ b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml
@@ -29,4 +29,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userIdentity.type
+  - sourceIPAddress
+  - userName userIdentity.type
+  - userAgent
+  - action
+  - status
+  - responseElements.accessKey.createDate
+  - esponseElements.accessKey.status
+  - responseElements.accessKey.accessKeyId
   security_domain: threat
diff --git a/detections/experimental/cloud/aws_detect_role_creation.yml b/detections/experimental/cloud/aws_detect_role_creation.yml
index 1841b3f6e5..65da0b3a02 100644
--- a/detections/experimental/cloud/aws_detect_role_creation.yml
+++ b/detections/experimental/cloud/aws_detect_role_creation.yml
@@ -32,4 +32,23 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - event_name
+  - action
+  - userIdentity.type
+  - requestParameters.description
+  - sourceIPAddress
+  - userIdentity.principalId
+  - userIdentity.arn
+  - action
+  - event_name
+  - awsRegion
+  - http_user_agent
+  - mfa_auth
+  - msg
+  - requestParameters.roleName
+  - requestParameters.description
+  - responseElements.role.arn
+  - responseElements.role.createDate
   security_domain: threat
diff --git a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml
index 99799e92b2..900f611b9d 100644
--- a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml
+++ b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml
@@ -30,4 +30,17 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - user_type
+  - userIdentity.sessionContext.sessionIssuer.type
+  - sourceIPAddress
+  - userIdentity.arn
+  - user_agent
+  - user_access_key
+  - status
+  - action
+  - requestParameters.roleName
+  - esponseElements.role.roleName
+  - esponseElements.role.createDate
   security_domain: threat
diff --git a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml
index a3c5eb90ee..29e4b18515 100644
--- a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml
+++ b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml
@@ -30,4 +30,16 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userIdentity.type
+  - eventName
+  - sourceIPAddress
+  - eventTime
+  - userIdentity.arn
+  - userName
+  - userAgent
+  - user_type
+  - status
+  - region
   security_domain: threat
diff --git a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml
index 7d112319e1..55602d3497 100644
--- a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml
+++ b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml
@@ -32,4 +32,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - data.protoPayload.request.function.timeout
+  - src
+  - src_user
+  - data.resource.labels.project_id
+  - data.protoPayload.request.function.serviceAccountEmail
+  - data.protoPayload.authorizationInfo{}.permission
+  - data.protoPayload.request.location
+  - http_user_agent
   security_domain: threat
diff --git a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
index 09d4e4b55d..8c87e69ddf 100644
--- a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
+++ b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
@@ -27,4 +27,14 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - category
+  - responseStatus.code
+  - sourceIPs{}
+  - userAgent
+  - verb
+  - requestURI
+  - responseStatus.reason
+  - properties.pod
   security_domain: threat
diff --git a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
index ff8cba3f9e..68ee00b79c 100644
--- a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
+++ b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
@@ -26,4 +26,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - userAgent
+  - sourceIPs{}
+  - src_user
+  - src_ip
+  - verb
+  - requestURI
   security_domain: threat
diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml
index 21247f7933..390555875e 100644
--- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml
+++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml
@@ -44,4 +44,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml
index 42553d4a4b..23777f2158 100644
--- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml
+++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml
@@ -32,4 +32,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
index 523180408b..f5106efba1 100644
--- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
+++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
@@ -35,4 +35,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - host
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
index bdaa20f495..f3f44fa477 100644
--- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
+++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
@@ -32,4 +32,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - columns.cmdline
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml
index 119e697c68..c2e7d3d4f0 100644
--- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml
+++ b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml
@@ -49,4 +49,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.parent_process_id
+  - Processes.process_id
+  - Processes.dest
+  - Processes.parent_process_name
+  -  Processes.user
   security_domain: network
diff --git a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml
index 739c1d5904..796d911a53 100644
--- a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml
+++ b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml
@@ -38,4 +38,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml
index 4e96c879de..4f086ab7ba 100644
--- a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml
+++ b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml
@@ -47,4 +47,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - dest
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/macos___re_opened_applications.yml b/detections/experimental/endpoint/macos___re_opened_applications.yml
index 20dfa8b493..983e1f6686 100644
--- a/detections/experimental/endpoint/macos___re_opened_applications.yml
+++ b/detections/experimental/endpoint/macos___re_opened_applications.yml
@@ -41,4 +41,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.parent_process
+  - Processes.user
+  - Processes.process_name
+  - Processes.parent_process_name
+  - Processes.dest
   security_domain: threat
diff --git a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml
index d94c514f67..6582417e65 100644
--- a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml
+++ b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml
@@ -37,4 +37,12 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - app
+  - name
+  - columns.cmdline
+  - columns.name
+  - columns.pid
+  - host
   security_domain: threat
diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
index c00b9a83c9..29f2055d0b 100644
--- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
+++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
@@ -46,4 +46,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process
+  - Processes.dest_category
+  - Processes.dest
+  - Processes.user
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/spike_in_file_writes.yml b/detections/experimental/endpoint/spike_in_file_writes.yml
index 5a61580b9d..38d9e00271 100644
--- a/detections/experimental/endpoint/spike_in_file_writes.yml
+++ b/detections/experimental/endpoint/spike_in_file_writes.yml
@@ -39,4 +39,8 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.action
+  - Filesystem.dest
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml
index fac0c15d6f..172a506777 100644
--- a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml
+++ b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml
@@ -38,4 +38,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ImageLoaded
+  - QueryName
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml
index a35567f023..d2ae61da94 100644
--- a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml
+++ b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml
@@ -37,4 +37,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - consumer
+  - ComputerName
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml
index 6ba11f0709..0e0f55805d 100644
--- a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml
+++ b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml
@@ -40,4 +40,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - query
   security_domain: endpoint
diff --git a/detections/experimental/network/detect_arp_poisoning.yml b/detections/experimental/network/detect_arp_poisoning.yml
index 0be208ae0e..e0449004d5 100644
--- a/detections/experimental/network/detect_arp_poisoning.yml
+++ b/detections/experimental/network/detect_arp_poisoning.yml
@@ -45,4 +45,13 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - facility
+  - mnemonic
+  - disable_cause
+  - src_int_prefix_long
+  - src_int_suffix
+  - host
+  - src_interface
   security_domain: network
diff --git a/detections/experimental/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml
index b000a4f436..ec0e5764bf 100644
--- a/detections/experimental/network/excessive_dns_failures.yml
+++ b/detections/experimental/network/excessive_dns_failures.yml
@@ -42,4 +42,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.query
+  - DNS.reply_code
+  - DNS.src
   security_domain: network
diff --git a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
index 3f274315f2..21cfde7487 100644
--- a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
+++ b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
@@ -52,4 +52,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.bytes_in
+  - All_Traffic.dest_category
+  - All_Traffic.src_ip
   security_domain: network
diff --git a/detections/experimental/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml
index 2cd258a8fe..eb86051009 100644
--- a/detections/experimental/network/large_volume_of_dns_any_queries.yml
+++ b/detections/experimental/network/large_volume_of_dns_any_queries.yml
@@ -36,4 +36,9 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.message_type
+  - DNS.record_type
+  - DNS.dest
   security_domain: network
diff --git a/detections/experimental/network/prohibited_network_traffic_allowed.yml b/detections/experimental/network/prohibited_network_traffic_allowed.yml
index cae48f8216..970f4ec790 100644
--- a/detections/experimental/network/prohibited_network_traffic_allowed.yml
+++ b/detections/experimental/network/prohibited_network_traffic_allowed.yml
@@ -44,4 +44,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.action
+  - All_Traffic.src_ip
+  - All_Traffic.dest_ip
+  - All_Traffic.dest_port
   security_domain: network
diff --git a/detections/experimental/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml
index 2b8ef78736..4b906ec85f 100644
--- a/detections/experimental/network/protocol_or_port_mismatch.yml
+++ b/detections/experimental/network/protocol_or_port_mismatch.yml
@@ -45,4 +45,10 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.app
+  - All_Traffic.dest_port
+  - All_Traffic.src_ip
+  - All_Traffic.dest_ip
   security_domain: network
diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml
index 5c54766ef7..24a747ac9e 100644
--- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml
+++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml
@@ -40,4 +40,11 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Traffic.transport
+  - All_Traffic.dest_port
+  - All_Traffic.user
+  - All_Traffic.src
+  - All_Traffic.dest
   security_domain: network