diff --git a/detections/web/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml
similarity index 100%
rename from detections/web/web_fraud___account_harvesting.yml
rename to detections/deprecated/web_fraud___account_harvesting.yml
diff --git a/detections/web/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml
similarity index 100%
rename from detections/web/web_fraud___anomalous_user_clickspeed.yml
rename to detections/deprecated/web_fraud___anomalous_user_clickspeed.yml
diff --git a/detections/web/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml
similarity index 100%
rename from detections/web/web_fraud___password_sharing_across_accounts.yml
rename to detections/deprecated/web_fraud___password_sharing_across_accounts.yml
diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml
similarity index 100%
rename from detections/application/email_files_written_outside_of_the_outlook_directory.yml
rename to detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml
diff --git a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
similarity index 100%
rename from detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
rename to detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
diff --git a/detections/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml
similarity index 100%
rename from detections/application/okta_account_lockout_events.yml
rename to detections/experimental/application/okta_account_lockout_events.yml
diff --git a/detections/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml
similarity index 100%
rename from detections/application/okta_failed_sso_attempts.yml
rename to detections/experimental/application/okta_failed_sso_attempts.yml
diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml
similarity index 100%
rename from detections/application/okta_user_logins_from_multiple_cities.yml
rename to detections/experimental/application/okta_user_logins_from_multiple_cities.yml
diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/experimental/application/web_servers_executing_suspicious_processes.yml
similarity index 100%
rename from detections/application/web_servers_executing_suspicious_processes.yml
rename to detections/experimental/application/web_servers_executing_suspicious_processes.yml
diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml
similarity index 100%
rename from detections/cloud/abnormally_high_cloud_instances_destroyed.yml
rename to detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml
diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml
similarity index 100%
rename from detections/cloud/abnormally_high_cloud_instances_launched.yml
rename to detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml
diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml
similarity index 100%
rename from detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
rename to detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml
diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml
similarity index 100%
rename from detections/cloud/detect_new_open_gcp_storage_buckets.yml
rename to detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml
diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml
similarity index 100%
rename from detections/cloud/detect_s3_access_from_a_new_ip.yml
rename to detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
similarity index 100%
rename from detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
rename to detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
diff --git a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
similarity index 100%
rename from detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
rename to detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml
similarity index 100%
rename from detections/cloud/detect_spike_in_s3_bucket_deletion.yml
rename to detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml
diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml
similarity index 100%
rename from detections/cloud/high_number_of_login_failures_from_a_single_source.yml
rename to detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml
diff --git a/detections/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml
similarity index 100%
rename from detections/cloud/new_container_uploaded_to_aws_ecr.yml
rename to detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml
diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/experimental/endpoint/detect_rare_executables.yml
similarity index 100%
rename from detections/endpoint/detect_rare_executables.yml
rename to detections/experimental/endpoint/detect_rare_executables.yml
diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml
similarity index 100%
rename from detections/endpoint/unusually_long_command_line___mltk.yml
rename to detections/experimental/endpoint/unusually_long_command_line___mltk.yml
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/experimental/endpoint/windows_adfind_exe.yml
similarity index 100%
rename from detections/endpoint/windows_adfind_exe.yml
rename to detections/experimental/endpoint/windows_adfind_exe.yml
diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml
similarity index 100%
rename from detections/network/detect_ipv6_network_infrastructure_threats.yml
rename to detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml
diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/experimental/network/detect_large_outbound_icmp_packets.yml
similarity index 100%
rename from detections/network/detect_large_outbound_icmp_packets.yml
rename to detections/experimental/network/detect_large_outbound_icmp_packets.yml
diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/experimental/network/detect_outbound_smb_traffic.yml
similarity index 100%
rename from detections/network/detect_outbound_smb_traffic.yml
rename to detections/experimental/network/detect_outbound_smb_traffic.yml
diff --git a/detections/network/detect_port_security_violation.yml b/detections/experimental/network/detect_port_security_violation.yml
similarity index 100%
rename from detections/network/detect_port_security_violation.yml
rename to detections/experimental/network/detect_port_security_violation.yml
diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/experimental/network/detect_rogue_dhcp_server.yml
similarity index 100%
rename from detections/network/detect_rogue_dhcp_server.yml
rename to detections/experimental/network/detect_rogue_dhcp_server.yml
diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/experimental/network/detect_snicat_sni_exfiltration.yml
similarity index 100%
rename from detections/network/detect_snicat_sni_exfiltration.yml
rename to detections/experimental/network/detect_snicat_sni_exfiltration.yml
diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/experimental/network/detect_software_download_to_network_device.yml
similarity index 100%
rename from detections/network/detect_software_download_to_network_device.yml
rename to detections/experimental/network/detect_software_download_to_network_device.yml
diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/experimental/network/detect_traffic_mirroring.yml
similarity index 100%
rename from detections/network/detect_traffic_mirroring.yml
rename to detections/experimental/network/detect_traffic_mirroring.yml
diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml
similarity index 100%
rename from detections/network/detect_unauthorized_assets_by_mac_address.yml
rename to detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml
diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml
similarity index 100%
rename from detections/network/detect_windows_dns_sigred_via_splunk_stream.yml
rename to detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml
diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml
similarity index 100%
rename from detections/network/detect_windows_dns_sigred_via_zeek.yml
rename to detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml
diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/experimental/network/detect_zerologon_via_zeek.yml
similarity index 100%
rename from detections/network/detect_zerologon_via_zeek.yml
rename to detections/experimental/network/detect_zerologon_via_zeek.yml
diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/experimental/network/dns_query_length_outliers___mltk.yml
similarity index 100%
rename from detections/network/dns_query_length_outliers___mltk.yml
rename to detections/experimental/network/dns_query_length_outliers___mltk.yml
diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/experimental/network/remote_desktop_network_bruteforce.yml
similarity index 100%
rename from detections/network/remote_desktop_network_bruteforce.yml
rename to detections/experimental/network/remote_desktop_network_bruteforce.yml
diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml
similarity index 100%
rename from detections/network/remote_desktop_network_traffic.yml
rename to detections/experimental/network/remote_desktop_network_traffic.yml
diff --git a/detections/network/smb_traffic_spike.yml b/detections/experimental/network/smb_traffic_spike.yml
similarity index 100%
rename from detections/network/smb_traffic_spike.yml
rename to detections/experimental/network/smb_traffic_spike.yml
diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/experimental/network/smb_traffic_spike___mltk.yml
similarity index 100%
rename from detections/network/smb_traffic_spike___mltk.yml
rename to detections/experimental/network/smb_traffic_spike___mltk.yml
diff --git a/detections/network/tor_traffic.yml b/detections/experimental/network/tor_traffic.yml
similarity index 100%
rename from detections/network/tor_traffic.yml
rename to detections/experimental/network/tor_traffic.yml
diff --git a/detections/network/unusually_long_content_type_length.yml b/detections/experimental/network/unusually_long_content_type_length.yml
similarity index 100%
rename from detections/network/unusually_long_content_type_length.yml
rename to detections/experimental/network/unusually_long_content_type_length.yml