diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index 2a847efb46..300cb649b0 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -17,7 +17,8 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null),
   signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)),
   authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
+  "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND dest_device_id != null
@@ -34,7 +35,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
-  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
+  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", event_id, "total_kerberos",
   totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
   endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
 
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index 3cb105366d..f8bd23739e 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -19,8 +19,8 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string",
   null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string",
   null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
-
+  "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND origin_device_id != null
 
@@ -36,7 +36,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
-  origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
+  origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, "total_ntlm",
   totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
   startNTLMTime, "detection_end_time", endNTLMTime])
 
diff --git a/dist/ssa/detections/sdelete_application_execution.yml b/dist/ssa/detections/sdelete_application_execution.yml
deleted file mode 100644
index e48f454597..0000000000
--- a/dist/ssa/detections/sdelete_application_execution.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-author: Teoderick Contreras, Splunk
-datamodel:
-- Endpoint_Processes
-date: '2021-11-15'
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-id: fcc52b9a-4616-11ec-8454-acde48001122
-known_false_positives: False positives should be limited, filter as needed.
-name: Sdelete Application Execution
-product:
-- Splunk Behavioral Analytics
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
-risk_message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-  delete files.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
-tags:
-  analytic_story:
-  - Information Sabotage
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
-  impact: 60
-  kill_chain_phases:
-  - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
-  observable:
-  - name: dest
-    role:
-    - Victim
-    type: Endpoint
-  - name: user
-    role:
-    - Victim
-    type: User
-  - name: process_name
-    role:
-    - Child Process
-    type: Process
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest
-  - user
-  - parent_process_name
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_path
-  risk_score: 42
-  risk_severity: medium
-  security_domain: endpoint
-type: Anomaly
-version: 1
diff --git a/dist/ssa/detections/anomalous_usage_of_archive_tools.yml b/dist/ssa/detections/ssa___anomalous_usage_of_archive_tools.yml
similarity index 86%
rename from dist/ssa/detections/anomalous_usage_of_archive_tools.yml
rename to dist/ssa/detections/ssa___anomalous_usage_of_archive_tools.yml
index 100fdef0c1..a0716cc96c 100644
--- a/dist/ssa/detections/anomalous_usage_of_archive_tools.yml
+++ b/dist/ssa/detections/ssa___anomalous_usage_of_archive_tools.yml
@@ -81,5 +81,16 @@ tags:
   risk_score: 42
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Anomalous usage of Archive Tools Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test for Anomalous usage of Archive Tools
+    file: endpoint/ssa___anomalous_usage_of_archive_tools.yml
+    name: Anomalous usage of Archive Tools
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/dist/ssa/detections/ssa___attempt_to_delete_services.yml b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
index a3765f779b..b9706fa502 100644
--- a/dist/ssa/detections/ssa___attempt_to_delete_services.yml
+++ b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
@@ -12,8 +12,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-known_false_positives: unknown
-name: Attempt To delete Services
+known_false_positives: It is possible administrative scripts may start/stop/delete
+  services. Filter as needed.
+name: Attempt To Delete Services
 product:
 - Splunk Behavioral Analytics
 references:
diff --git a/dist/ssa/detections/ssa___delete_a_net_user.yml b/dist/ssa/detections/ssa___delete_a_net_user.yml
index 5855416106..8ec2a1ce67 100644
--- a/dist/ssa/detections/ssa___delete_a_net_user.yml
+++ b/dist/ssa/detections/ssa___delete_a_net_user.yml
@@ -99,6 +99,9 @@ test:
     - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
       file_name: net_user_del.log
       source: WinEventLog:Security
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
+      file_name: security.log
+      source: WinEventLog:Security
     description: Test for usage of net.exe or net1.exe to delete net user
     file: endpoint/ssa___delete_a_net_user.yml
     name: Delete A Net User
diff --git a/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 36dec46f53..4629d8820b 100644
--- a/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,6 +1,7 @@
 author: Ignacio Bermudez Corrales, Splunk
-datamodel: []
-date: '2021-11-10'
+datamodel:
+- Endpoint_Processes
+date: '2020-11-10'
 description: The following analytic identifies parent processes, browsers, Windows
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -21,8 +22,7 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events()
-
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
diff --git a/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
index 42441fa0c9..6bc447b739 100644
--- a/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
+++ b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
@@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null),
   signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)),
   authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND dest_device_id != null
@@ -43,9 +43,10 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
-  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
-  totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
-  endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
+  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
+  event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
+  startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
+  endNTLMTime])
 
   | into write_ssa_detected_events();'
 tags:
diff --git a/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
index 6daf852176..2bcc0f9bc2 100644
--- a/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
+++ b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
@@ -29,8 +29,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string",
   null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string",
   null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
-
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND origin_device_id != null
 
@@ -46,9 +45,9 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
-  origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
-  totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
-  startNTLMTime, "detection_end_time", endNTLMTime])
+  origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
+  "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
+  endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
 
   | into write_ssa_detected_events();'
 tags:
diff --git a/dist/ssa/detections/ssa___sdelete_application_execution.yml b/dist/ssa/detections/ssa___sdelete_application_execution.yml
index 44341ebf5a..f2f52284d2 100644
--- a/dist/ssa/detections/ssa___sdelete_application_execution.yml
+++ b/dist/ssa/detections/ssa___sdelete_application_execution.yml
@@ -1,6 +1,6 @@
 author: Teoderick Contreras, Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2021-11-15'
 description: This analytic will detect the execution of sdelete.exe attempting to
   delete potentially important files that may related to adversary or insider threats