diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml
index 060c28c6..b189ce2f 100644
--- a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml
+++ b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml
@@ -9,5 +9,5 @@ mitre_technique:
 datasets:
 -   name: snapattack
     sourcetype: XmlWinEventLog
-    source: XmlWinEventLog:Security
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational 
     path: /datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
index 0da7d167..494a5d7d 100644
--- a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
+++ b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:c83a52e523bbae925a7dfca3f6e10b421bec5baa7d0461471864c770f15f8386
-size 1515
+oid sha256:b197078de8c2c3c523df7c2e049178c30cf334621047a16e89f78a309295839a
+size 2380