diff --git a/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml b/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
index 346ac734..a50f3851 100644
--- a/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
+++ b/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
@@ -8,7 +8,7 @@ mitre_technique: []
 datasets:
 - name: sysmon_local_llms
   path: /datasets/local_llms/sysmon_local_llms.txt
-  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/sysmon_local_llms.txt
+  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/local_llms/sysmon_local_llms.txt
   sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 - name: 4688_local_llms
   path: /datasets/local_llms/4688_local_llms.txt