From 9dc8da332fe2a1a2fbdfa0eecee9e58d6620f66b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 11 Mar 2022 11:49:22 -0800
Subject: [PATCH] Updating more missing datasets

---
 detections/cloud/aws_ecr_container_scanning_findings_high.yml | 2 ++
 detections/endpoint/sam_database_file_access_attempt.yml      | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index 9a9eeb3114..87d84d5761 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -31,6 +31,8 @@ tags:
   confidence: 100
   deployments:
   - Slack Alert
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml
index c53d34754b..4df51115be 100644
--- a/detections/endpoint/sam_database_file_access_attempt.yml
+++ b/detections/endpoint/sam_database_file_access_attempt.yml
@@ -37,6 +37,8 @@ tags:
   - Stage:Credential Access
   cve:
   - CVE-2021-36934
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-security.log
   impact: 80
   kill_chain_phases:
   - Exploitation