diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
index 01bbe7ab22..493a687f55 100644
--- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following detection identifies the usage of archive tools from the command line.
 search: '| from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
@@ -75,4 +75,4 @@ tags:
   - Processes.parent_process
   risk_score: 42
   security_domain: endpoint
-    
\ No newline at end of file
+