diff --git a/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail.json b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail.json
new file mode 100644
index 00000000..b7f761ec
--- /dev/null
+++ b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c719c5734603fa38a8e555ac8404fdda6de9427134d756636e1d94ad7904a6c5
+size 12881