diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
index 5c653533c7..a0d7b45a46 100644
--- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
+++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml
@@ -18,6 +18,10 @@ tags:
   asset_type: Endpoint
   cve:
   - CVE-2022-32152
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
   confidence: 80
   context:
   - Source:Endpoint