From 87f62f2177cc1e97fd1ef204e72e53d1f511efae Mon Sep 17 00:00:00 2001
From: David Dorsey <davidd@splunk.com>
Date: Tue, 30 Nov 2021 22:23:31 -0600
Subject: [PATCH] Fixed data model

---
 .../endpoint/ssa___anomalous_usage_of_archive_tools.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
index 01bbe7ab22..493a687f55 100644
--- a/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+++ b/detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
@@ -5,7 +5,7 @@ date: '2021-11-22'
 author: Patrick Bareiss, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following detection identifies the usage of archive tools from the command line.
 search: '| from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
@@ -75,4 +75,4 @@ tags:
   - Processes.parent_process
   risk_score: 42
   security_domain: endpoint
-    
\ No newline at end of file
+