diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
index b5762cf6ac..76676e1841 100644
--- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
@@ -42,6 +42,11 @@ eli5: "This detection identifies use of PowerSploit modules that discover access
 known_false_positives:
   "None identified."
 tags:
+  required_fields:
+    - _time
+    - process
+    - dest_device_id
+    - dest_user_id
   cis20:
     - CIS 16
     - CIS 20