diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 8c4785dd4a..f29898d046 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -27,7 +27,7 @@ docutils==0.16
 execnet==1.8.0
 gitdb==4.0.5
 GitPython==3.1.14
-identify==2.1.3
+identify==2.2.4
 idna==2.8
 importlib-metadata==3.7.3
 Jinja2==2.11.3
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 9bef6ba923..b585325c63 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -4,7 +4,8 @@ version: 5
 date: '2020-11-27'
 author: David Dorsey, Splunk
 type: batch
-datamodel: []
+datamodel: 
+  - Endpoint
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)