[BUG] Incorrect Data Source for "MacOS - Re-opened Applications"

Hi,

It looks like there is an error with the Data Source annotation on the MacOS - Re-opened Applications detection.
The detection is clearly targeted at macOS and finds processes associated with com.apple.loginwindow in the Endpoint.Processes data model. Its current Data Source annotation is as follows:

Name: Sysmon EventID 1
Platform: Windows
Sourcetype: XmlWinEventLog
Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Since Sysmon EventID 1 is a Windows process creation data source, the above is a clear metadata/annotation error in my opinion.
Moreover, the ColdRoot MacOS RAT Analytic Story that this detection belongs to says that it uses OSquery features in its searches and Osquery Results is indeed one of the data sources used by this story.

The Data Source annotation in MacOS - Re-opened Applications must be consistent with the actual data source that is leveraged for the macOS detection.
According to the associated Analytic Story as well as the actual macOS detections in Splunk Security Content, the expected Data Source should be:

Name: Osquery Results
Platform: Other
Sourcetype: osquery:results
Source: osquery

It seems that the problem only affects the Data Source metadata and not the detection SPL.
Currently, the detection is marked as Experimental, while its detection testing is categorized as Not Applicable / Failing; therefore, this report pertains to the incorrect Data Source metadata and not the detection logic itself.

Thank you for your time and consideration.

Best regards

App Version:

ESCU: [6.5.0]

Locate the “MacOS - Re-opened Applications” detection and inspect its Data Source annotation alongside the ColdRoot MacOS RAT Analytic Story. Update only the metadata to use Osquery Results with Platform Other, Sourcetype osquery:results, and Source osquery. Confirm that the detection SPL remains unchanged and the annotation matches the stated values.