diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
similarity index 98%
rename from detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
rename to detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index 566f03c8a9..cba0a58be3 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -4,10 +4,7 @@ version: 1
 date: '2021-08-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
+datamodel: []
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
   This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
   send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
similarity index 98%
rename from detections/endpoint/gsuite_suspicious_shared_file_name.yml
rename to detections/cloud/gsuite_suspicious_shared_file_name.yml
index dda923e569..9b7bd30b24 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -4,9 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
+datamodel: []
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
similarity index 87%
rename from tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
rename to tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
index c3cb0a32c8..bd6e1a260c 100644
--- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
similarity index 89%
rename from tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
rename to tests/cloud/gsuite_suspicious_shared_file_name.test.yml
index a59374a794..70297baf7d 100644
--- a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
+++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Suspicious Shared File Name Unit Test
 tests:
 - name: Gsuite Suspicious Shared File Name
-  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  file: cloud/gsuite_suspicious_shared_file_name.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'