Add datamodel field to yml

detections/endpoint/detect_html_help_renamed.yml

@@ -18,6 +18,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed hh.exe may be used.
 type: batch
+datamodel: []
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -12,6 +12,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: batch
+datamodel:
+- Endpoint
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: batch
+datamodel:
+- Endpoint
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -19,6 +19,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: batch
+datamodel:
+- Endpoint
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://www.kb.cert.org/vuls/id/851869

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: batch
+datamodel:
+- Endpoint
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 type: batch
+datamodel:
+- Endpoint
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md