diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
index d2c3c44e8f..2284481ef6 100644
--- a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
@@ -39,7 +39,7 @@ tags:
   - Source:Endpoint
   - Stage:Impact
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
   impact: 100
   kill_chain_phases:
   - Actions on Objectives
diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
index 28b9bfa6ff..b6fdef2913 100644
--- a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -47,7 +47,7 @@ tags:
   - Source:Endpoint
   - Stage:Exfiltration
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml
index 5b0d131f45..3399c9ac7e 100644
--- a/detections/endpoint/ssa___fsutil_zeroing_file.yml
+++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml
@@ -80,3 +80,5 @@ tags:
   risk_score: 54
   risk_severity: high
   security_domain: endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
\ No newline at end of file
diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
index 424b7dc49a..ced98b05dd 100644
--- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -84,3 +84,5 @@ tags:
   risk_score: 15
   risk_severity: high
   security_domain: endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
\ No newline at end of file
diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
index 0127db21ec..b68e9e1888 100644
--- a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
+++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test detection of BCDEdit Failure Recovery Modification
     attack_data:
-      - file_name: windows-sysmon.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+      - file_name: windows-security_bcdedit_wbadmin.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
+        source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
index cb4664986f..76c940b9cc 100644
--- a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
+++ b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
index 11edb21baf..4ca51963d1 100644
--- a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test detection of FSUtil Zeroing File
     attack_data:
-    - file_name: windows-sysmon.log
-      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
-      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
+      source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
index 84a6b071df..6a7c0c7237 100644
--- a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -5,6 +5,6 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test detection of WBAdmin Delete System Backups
     attack_data:
-      - file_name: windows-sysmon.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
-        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+      - file_name: windows-security_bcdedit_wbadmin.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
+        source: WinEventLog:Security
\ No newline at end of file