From 4217a5f71373c73cddd49f5800a42fdcff24deea Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Wed, 12 Nov 2025 15:01:35 -0500
Subject: [PATCH] Fix source URL for sysmon_local_llms dataset

---
 .../local_llms/suspicious_local_llm_frameworks.yml              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml b/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
index 346ac734..a50f3851 100644
--- a/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
+++ b/datasets/suspicious_behaviour/local_llms/suspicious_local_llm_frameworks.yml
@@ -8,7 +8,7 @@ mitre_technique: []
 datasets:
 - name: sysmon_local_llms
   path: /datasets/local_llms/sysmon_local_llms.txt
-  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/sysmon_local_llms.txt
+  source: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/local_llms/sysmon_local_llms.txt
   sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 - name: 4688_local_llms
   path: /datasets/local_llms/4688_local_llms.txt