diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
index 3f6202f8a0..f1ec271d45 100644
--- a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -5,6 +5,6 @@ tests:
   pass_condition: '@count_gt(0)'
   description: Test detection of FSUtil Zeroing File
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
+    source: WinEventLog:Security