diff --git a/bin/jinja2_templates/doc_playbooks.j2 b/bin/jinja2_templates/doc_playbooks.j2
index f99a53fa6b..55cfbdbbb0 100644
--- a/bin/jinja2_templates/doc_playbooks.j2
+++ b/bin/jinja2_templates/doc_playbooks.j2
@@ -39,7 +39,7 @@ tags:
 {{ playbook.how_to_implement}}
 
 #### Playbooks
-![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png)
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.playbook | lower | replace(" ", "_")}}.png)
 
 #### Required field
 {% for field in playbook.tags.playbook_fields -%}
@@ -54,4 +54,4 @@ tags:
 {% endif %}
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.playbook | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**
diff --git a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py b/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
index cec0be1d22..1d3c366206 100644
--- a/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
+++ b/bin/ssa-end-to-end-testing/modules/streams_service_api_helper.py
@@ -429,7 +429,7 @@ class DSPApi:
         return preview_id
 
 
-    def ingest_data(self, data):
+    def ingest_data(self, data, sourcetype):
         """
         Send events
 
@@ -443,9 +443,11 @@ class DSPApi:
         response
             response body in JSON format
         """
+        if sourcetype == "WinEventLog:Security":
+            sourcetype = "WinEventLog"
         data = [{
             "body": event,
-            "sourcetype": "WinEventLog"
+            "sourcetype": sourcetype
             } for event in data]
         response = requests.post(self.return_api_endpoint(INGEST_ENDPOINT), json=data, headers=request_headers(self.header_token))
         if response.status_code != HTTPStatus.OK:
diff --git a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py b/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
index 1c21291c7a..72221bd621 100644
--- a/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
+++ b/bin/ssa-end-to-end-testing/modules/test_ssa_detections.py
@@ -1,5 +1,6 @@
 import logging
 import os
+from re import S
 import time
 import sys
 import uuid
@@ -48,7 +49,7 @@ class SSADetectionTesting:
         for i in range(0, len(test_spls)):
             self.max_execution_time = MAX_EXECUTION_TIME_LIMIT
             test_id = str(uuid.uuid4())
-            test_result = self.ssa_detection_test(read_spl(file_path_spl, test_spls[i]), file_path_data, test_names[i], test_id)
+            test_result = self.ssa_detection_test(read_spl(file_path_spl, test_spls[i]), file_path_data, test_names[i], test_id, "WinEventLog")
             test_results.append(test_result.copy())
 
         passed = True
@@ -70,6 +71,7 @@ class SSADetectionTesting:
         test_id = str(uuid.uuid4())
         test_results = self.ssa_detection_test(test_obj["detection_obj"]["search"], file_path_attack_data,
                                                "SSA Smoke Test " + test_obj["test_obj"]["name"], test_id,
+                                               test_obj['test_obj']['tests'][0]['attack_data'][0]['source'],
                                                test_obj['test_obj']['tests'][0]['pass_condition'])
 
         return test_results
@@ -113,7 +115,7 @@ class SSADetectionTesting:
                 else:
                     LOGGER.warning("Found and deleted an old pipeline: %s", pipeline['name'])
 
-    def ssa_detection_test_main(self, spl, source, test_name, pass_condition, test_id):
+    def ssa_detection_test_main(self, spl, source, test_name, pass_condition, test_id, sourcetype):
         self.execution_passed = True
 
         self.wait_time(SLEEP_TIME_CREATE_INDEX)
@@ -147,12 +149,12 @@ class SSADetectionTesting:
             self.test_results["msg"] = msg
             return self.test_results
 
-        data = read_data(source)
+        data = read_data(source, sourcetype)
         LOGGER.info("Sending (%d) events" % (len(data)))
 
         assert len(data) > 0, "No events to send, skip to next test."
 
-        data_uploaded = self.api.ingest_data(data)
+        data_uploaded = self.api.ingest_data(data, sourcetype)
         assert data_uploaded, "Failed to upload test data"
 
         self.wait_time(SLEEP_TIME_SEND_DATA)
@@ -212,10 +214,10 @@ class SSADetectionTesting:
         else:
             LOGGER.info("Testing successfully cleaned up")
 
-    def ssa_detection_test(self, spl, source, test_name, test_id, pass_condition='@count_gt(0)'):
+    def ssa_detection_test(self, spl, source, test_name, test_id, sourcetype, pass_condition='@count_gt(0)'):
         self.ssa_detection_test_init()
         try:
-            test_result = self.ssa_detection_test_main(spl, source, test_name, pass_condition, test_id)
+            test_result = self.ssa_detection_test_main(spl, source, test_name, pass_condition, test_id, sourcetype)
             self.ssa_detection_test_teardown()
             return test_result
         except AssertionError as e:
diff --git a/bin/ssa-end-to-end-testing/modules/utils.py b/bin/ssa-end-to-end-testing/modules/utils.py
index 8e9d21ad6d..a803caa3b7 100644
--- a/bin/ssa-end-to-end-testing/modules/utils.py
+++ b/bin/ssa-end-to-end-testing/modules/utils.py
@@ -3,6 +3,7 @@ import logging
 import os
 import fileinput
 import re
+import io
 
 from .data_manipulation import DataManipulation
 
@@ -104,31 +105,35 @@ def replace_ssa_macros(source, sink, spl):
     return spl
 
 
-def read_data(file_path):
-    data_manipulation = DataManipulation()
-    modified_file = data_manipulation.manipulate_timestamp(file_path, 'xmlwineventlog', 'WinEventLog:Security')
+def read_data(file_path, sourcetype):
     data = []
-    date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M'
-    count = len(open(modified_file).readlines())
+    if sourcetype == "WinEventLog:Security" or sourcetype == "WinEventLog":
+        data_manipulation = DataManipulation()
+        modified_file = data_manipulation.manipulate_timestamp(file_path, 'xmlwineventlog', 'WinEventLog:Security')
+        date_rex = r'\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [AP]M'
+        count = len(open(modified_file).readlines())
 
-    i = 0
-    file = fileinput.input(files=modified_file)
-    event = file[0]
-    start_position = 0
+        i = 0
+        file = fileinput.input(files=modified_file)
+        event = file[0]
+        start_position = 0
 
-    for i in range(1, count):
-        line = file[i]
-        i = i + 1
-        if re.match(date_rex, line):
-            data.append(event)
-            start_position = i
-            event = line
-        else:
-            event = event + line
+        for i in range(1, count):
+            line = file[i]
+            i = i + 1
+            if re.match(date_rex, line):
+                data.append(event)
+                start_position = i
+                event = line
+            else:
+                event = event + line
 
 
-    data.append(event)
-    fileinput.close()
+        data.append(event)
+        fileinput.close()
+    elif sourcetype == "xmlwineventlog":
+        for line in fileinput.input(files=file_path):
+            data.append(line)
 
     return data
 
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
similarity index 55%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index ce57b526e6..69518c020c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -1,30 +1,35 @@
 name: Applying Stolen Credentials via Mimikatz modules
 id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
-  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
+  - Endpoint_Processes
+description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line.
+  A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller.
+  A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
   /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
   OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
-
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz.
 references:
-- https://github.com/gentilkiwi/mimikatz
-- https://adsecurity.org/?p=1275
+  - https://github.com/gentilkiwi/mimikatz
+  - https://adsecurity.org/?p=1275
+  - https://adsecurity.org/?p=1515
+  - https://adsecurity.org/?page_id=1821#KERBEROSPTT
+  - https://attack.mitre.org/software/S0002/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
 tags:
   analytic_story:
   - Credential Dumping
@@ -58,6 +63,10 @@ tags:
   - T1554
   - T1556
   - T1558
+  - T1558.002
+  - T1558.001
+  - T1003
+  - T1003.001
   nist:
   - PR.AC
   - PR.IP
@@ -81,6 +90,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
similarity index 64%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index c52f46a113..1023e7c74c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -1,15 +1,13 @@
 name: Applying Stolen Credentials via PowerSploit modules
 id: 270b482d-2af2-448f-9923-9cf005f61be4
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Stolen credentials are applied by methods such as user impersonation,
-  credential injection, spoofing of authentication processes or getting hold of critical
-  accounts. This detection indicates such activities carried out by PowerSploit exploit
-  kit APIs.
+  - Endpoint_Processes
+description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials.
+  PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit.
 references:
-- https://github.com/PowerShellMafia/PowerSploit
+  - https://github.com/PowerShellMafia/PowerSploit
+  - https://attack.mitre.org/software/S0194/
 tags:
   analytic_story:
   - Credential Dumping
@@ -62,6 +62,7 @@ tags:
   - T1554
   - T1555
   - T1558
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -85,6 +86,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
similarity index 68%
rename from detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 77ce2b1fb7..7db363f5db 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -1,13 +1,12 @@
 name: Assessment of Credential Strength via DSInternals modules
 id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection identifies use of DSInternals modules that verify password
-  strength, i.e., identify weak accounts that would be easily compromised.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -49,6 +50,8 @@ tags:
   - T1201
   - T1552
   - T1555
+  - T1059.001
+  - T1059
   nist:
   - PR.AC
   - PR.IP
@@ -72,6 +75,7 @@ tags:
   - process
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 25
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
similarity index 66%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
index f3c7b0941e..346e9ec039 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
@@ -1,16 +1,14 @@
 name: Credential Extraction indicative of use of DSInternals credential conversion
   modules
 id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+  - Endpoint_Processes
+description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
+  Adversaries may use these modules for decrypting or transforming the stored credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -53,10 +54,12 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   message: DSInternals tool kit is converting stolen credential material to a form
-    applicable to authentications. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+    applicable to authentications. Operation is performed on the device $dest_device_id$,
+    by the account $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -69,10 +72,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -82,7 +85,7 @@ tags:
   - _time
   - process_path
   - dest_user_id
-  - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
similarity index 76%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
index ad2a5a161b..0b9a3c4b74 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
@@ -1,15 +1,13 @@
 name: Credential Extraction indicative of use of DSInternals modules
 id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint.
+  Adversaries may use these modules for manipulating data related to Active Directory and credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -56,9 +57,11 @@ tags:
   message: DSInternals tool kit is accessing sensitive credential material such as
     KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
     Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -71,10 +74,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,6 +88,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
similarity index 69%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
index 100e2c60f0..d31701b203 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with s option
 id: 312582f2-5e91-42c1-a275-cd67f31373c8
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
-references: []
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 tags:
   analytic_story:
   - Unusual Processes
@@ -51,9 +53,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -66,10 +69,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -80,6 +83,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
similarity index 67%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
index c636e1241d..ec6113cf84 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with v option
 id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 references: []
 tags:
   analytic_story:
@@ -49,9 +52,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -64,10 +68,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -77,6 +81,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
rename to detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
rename to detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
rename to detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
rename to detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
index 7b38c7b154..d4993baf2c 100644
--- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
+++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
@@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 6b8b7a8286..a8f9c6fc3c 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -36,7 +36,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index f3bed31e95..aae0bea823 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -33,7 +33,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 90
   context:
diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index cea14e9c2d..d4cdc813b6 100644
--- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
-  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  suspicious behavior as its commonly used by tools like like PsExec/PaExec and others
   to stage service binaries before creating and starting a Windows service on remote
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
@@ -31,7 +31,7 @@ references:
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index 103da14e4d..d2c6c8d24a 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -36,7 +36,7 @@ references:
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 8a8ae569ea..3f8090e1e6 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   confidence: 50
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
index adb4eb9517..0ef0b02006 100644
--- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
+++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
@@ -23,7 +23,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - SamSam Ransomware
   product:
   - Splunk Phantom
diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
index ea44d9edb0..b49f8879df 100644
--- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index be87f8b84f..ea47f2e0e7 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Windows Discovery Techniques
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
new file mode 100644
index 0000000000..b9179b8089
--- /dev/null
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -0,0 +1,86 @@
+name: Possible Lateral Movement PowerShell Spawn
+id: cb909b3e-512b-11ec-aa31-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic assists with identifying a PowerShell process
+  spawned as a child or grand child process of commonly abused processes during lateral
+  movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
+  and `mmc.exe`. Legitimate Windows features such as the Service Control Manager,
+  Windows Management Instrumentation, Task Scheduler, Windows Remote Management and
+  the DCOM protocol can be abused to start a process on a remote endpoint. Looking
+  for PowerShell spawned out of this processes may reveal a lateral movement attack.
+  Red Teams and adversaries alike may abuse these services during a breach for lateral
+  movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
+  OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
+  (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
+  OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may spawn PowerShell as a child process
+  of the the identified processes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1021/003
+- https://attack.mitre.org/techniques/T1021/006/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053.005/
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  - Malicious PowerShell
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  - T1021.006
+  - T1047
+  - T1053.005
+  - T1543.003
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A PowerShell process was spawned as a child process of typically abused
+    processes on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index a9909bece8..4732042e6b 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -27,7 +27,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
index 921e7209ea..15389b529a 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -25,7 +25,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index b91bf8ffc1..b26ed0eae8 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -28,7 +28,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 0cc04eb85e..3482d16ebd 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 66f259f1d8..0cf0e762c5 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -27,7 +27,7 @@ references:
 - https://attack.mitre.org/techniques/T1021/006/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 4a29b6ae73..ea0ab2981e 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 230e41cbfe..aa04af220f 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -27,7 +27,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 6a6016cf50..abd9d37eec 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 61c0b7ecdd..dc1b4e2e5c 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -29,7 +29,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index f30345a006..534990ea49 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index 06696828bb..ba117efbda 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
index bd90a89185..3761b132b9 100644
--- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
-  as a child processs of `services.exe`. The LOLBAS project documents Windows native
+  as a child process of `services.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of services.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
new file mode 100644
index 0000000000..7caeaf1551
--- /dev/null
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -0,0 +1,67 @@
+name: Short Lived Scheduled Task
+id: 6fa31414-546e-11ec-adfa-acde48001122
+version: 1
+date: '2021-12-03'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security EventCode 4698, `A
+  scheduled task was created` and Windows Security EventCode 4699, `A scheduled task
+  was deleted` to identify scheduled tasks created and deleted in less than 30 seconds.
+  This behavior may represent a lateral movement attack abusing the Task Scheduler
+  to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler
+  for lateral movement and remote code execution.
+search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
+  | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
+  eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | table
+  _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: Although uncommon, legitimate applications may create and delete
+  a Scheduled Task within 30 seconds. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - ComputerName
+  - Account_Name
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 90
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Lateral Movement
+  message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target
+  automated_detection_testing: passed
diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 02b3713ccb..b796491f7b 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to delete a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then delete it.
-  Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   analytic_story:
   - XMRig
@@ -52,6 +49,8 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   mitre_attack_id:
   - T1489
+  - T1543
+  - T1543.003
   nist:
   - PR.DS
   - PR.IP
@@ -85,4 +84,4 @@ tags:
   - cmd_line
   risk_score: 36
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index ece73aba06..313f4d4564 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to disable a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then disable
-  it. Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   analytic_story:
   - XMRig
@@ -87,4 +83,4 @@ tags:
   - process
   risk_score: 36
   risk_severity: medium
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index fb81931e78..ed66d0cca6 100644
--- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,13 +1,12 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: 14038953-e5f2-4daf-acff-5452062baf03
-version: 1
-date: 2020-6-04
+version: 2
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Monitor for execution of reg.exe with parameters specifying an export
-  of keys that contain hashed credentials that attackers may try to crack offline.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.'
 search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
   "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
@@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events(); '
-how_to_implement: You must be ingesting windows endpoint data that tracks process
-  activity, including parent-child relationships from your endpoints.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
 known_false_positives: None identified.
 references:
-- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -43,11 +45,10 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping stored credentials from the registry sections
-    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+  message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - DE.CM
   observable:
@@ -59,10 +60,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -71,6 +72,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
new file mode 100644
index 0000000000..7b19775d61
--- /dev/null
+++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
@@ -0,0 +1,84 @@
+name: BCDEdit Failure Recovery Modification
+id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to bcdedit.exe modifications to the
+  built-in Windows error recovery boot configurations. This is typically used by ransomware
+  to prevent recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND
+  (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the
+    endpoint.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 0d8c7562fe..04281188df 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%")
-  AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) | into
-  write_ssa_detected_events();'
-how_to_implement: o successfully implement this search, you need to be ingesting logs
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
   with the process name, parent process, and command-line executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
   Tune and filter known instances where renamed net.exe may be used.
diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 99f240479b..2ffee7990f 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Deny Permission using Cacls Utility
 id: b76eae28-cd25-11eb-9c92-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-29'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
-  and prevent access to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 51de8d3da3..e2bf1d6826 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -1,29 +1,29 @@
 name: Detect Dump LSASS Memory using comsvcs
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
 version: 2
-date: '2020-09-15'
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: This search detects the memory of lsass.exe being dumped for offline
-  credential theft attack.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
-  | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
-  timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event,
-  "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string",
-  null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
-  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
-  | eval body=create_map(["event_id", event_id, "process_name", process_name, "process",
-  process]) | into write_ssa_detected_events();'
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.'
+search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
+  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
+  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
+  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
   on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
-known_false_positives: None identified.
+known_false_positives: False positives should be limited, filter as needed.
 references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
 tags:
   analytic_story:
   - Credential Dumping
@@ -41,9 +41,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
-    DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003
   - T1003
@@ -58,10 +56,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
-    role:
-    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -72,4 +66,4 @@ tags:
   - process
   risk_score: 70
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
new file mode 100644
index 0000000000..521ff7a8eb
--- /dev/null
+++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -0,0 +1,90 @@
+name: Detect RClone Command-Line Usage
+id: e8b74268-5454-11ec-a799-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic identifies commonly used command-line arguments used by
+  `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
+  specific to the configuration used by adversaries. In particular, an adversary may
+  list the files or directories of the remote file share using `ls` or `lsd`, which
+  is not indicative of malicious behavior. During triage, at this stage of a ransomware
+  event, exfiltration is about to occur or has already. Isolate the endpoint and continue
+  investigating by review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND
+  (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
+  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%")
+  OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%")
+  OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
+references:
+  - https://redcanary.com/blog/rclone-mega-extortion/
+  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+  - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
+tags:
+  analytic_story:
+  - DarkSide Ransomware
+  - Ransomware
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service
+    to move files or folders.
+  mitre_attack_id:
+  - T1020
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 0948312f9f..23b8d7ef16 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
 version: 3
-date: '2021-12-01'
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
-  may used by the adversaries to interrupt availability of accounts and continue the
-  impact against the organization.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: System administrators or automated scripts may disable an account
-  but not a common practice. Filter as needed.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -52,6 +51,7 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   mitre_attack_id:
   - T1489
+  - T1078
   nist:
   - PR.AC
   - PR.IP
@@ -83,6 +83,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 49
   risk_severity: medium
-  security_domain: endpoint
+  risk_score: 49
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
new file mode 100644
index 0000000000..95d44c07d3
--- /dev/null
+++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -0,0 +1,86 @@
+name: DNS Exfiltration Using Nslookup App
+id: 2452e632-9e0d-11eb-34ba-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
+  commonly used by attacker and also the retry parameter which is designed to query
+  C2 DNS multiple tries.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND
+  (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%")
+  OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  - Data Exfiltration
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration.
+  mitre_attack_id:
+  - T1048
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml
new file mode 100644
index 0000000000..bd29f2cbbf
--- /dev/null
+++ b/detections/endpoint/ssa___excessive_number_of_office_files_copied.yml
@@ -0,0 +1,54 @@
+name: Excessive Number of Office Files Copied
+id: 3c6594a9-8df6-45a1-9357-d73b62083c63
+version: 1
+date: '2021-12-07'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Filesystem
+description: This detection detects a high amount of office file copied.
+  This can be an indicator for a malicious insider.
+search: '| from read_ssa_enriched_events() 
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+  | eval action=ucast(map_get(input_event, "action"), "string", null), 
+  process=ucast(map_get(input_event, "process"), "string", null), 
+  file_name=ucast(map_get(input_event, "file_name"), "string", null), 
+  file_path=ucast(map_get(input_event, "file_path"), "string", null), 
+  dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
+  | where "Endpoint_Filesystem" IN(_datamodels) 
+  | where action="created" 
+  | where like(file_name, "%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") 
+  | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, 10m)
+  | where count > 20
+  | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, dest_device_id), body=create_map(["count", count]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
+known_false_positives: user may copy a lot of office fies from one folder to another
+references: []
+tags:
+  analytic_story: []
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfitration
+  dataset:
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: High number of files copied
+  mitre_attack_id:
+  - T1048.003
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - action
+  - process
+  - file_name
+  - file_path
+  risk_score: 72
+  security_domain: endpoint
+
diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 05bdaabafe..554d4d973e 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -1,14 +1,15 @@
 name: First time seen command line argument
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
-version: 3
-date: 2021-2-1
+version: 4
+date: '2021-11-30'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This search looks for command-line arguments that use a `/c` parameter
   to execute a command that has not previously been seen. This is an implementation
   on SPL2 of the rule `First time seen command line argument` by @bpatel.
+  'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
   "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
@@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be populating the endpoint data model for SSA and specifically
-  the process_name and the process fields
-known_false_positives: Legitimate programs can also use command-line arguments to
-  execute. Please verify the command-line arguments to check what command/program
-  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
-  macro to exclude legitimate parent_process_name
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Legitimate programs use command-line arguments to
+  execute. Verify the command-line arguments to check what command/program
+  is being executed. Filtering will be needed.
 references: []
 tags:
   analytic_story:
@@ -47,11 +49,9 @@ tags:
   kill_chain_phases:
   - Command and Control
   - Actions on Objectives
-  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
-    command has not previously seen in host $dest_device_id$
+  message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$
   mitre_attack_id:
   - T1059
-  - T1117
   - T1202
   nist:
   - PR.PT
@@ -74,6 +74,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 30
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml
new file mode 100644
index 0000000000..4d2c223974
--- /dev/null
+++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml
@@ -0,0 +1,83 @@
+name: Fsutil Zeroing File
+id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect a suspicious fsutil process to zeroing a target
+  file. This technique was seen in lockbit ransomware where it tries to zero out its
+  malware path as part of its defense evasion after encrypting the compromised host.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND
+  (like (cmd_line, "%setzerodata%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+references:
+  - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
+tags:
+  analytic_story:
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
+  mitre_attack_id:
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 54
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 8356803542..93a6d31601 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Grant Permission Using Cacls Utility
 id: c6da561a-cd29-11eb-ae65-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies potential adversaries that modify the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware and coinminer scripts to evade detections and restrict access
-  to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___high_file_deletion_frequency.yml b/detections/endpoint/ssa___high_file_deletion_frequency.yml
new file mode 100644
index 0000000000..d20a68653e
--- /dev/null
+++ b/detections/endpoint/ssa___high_file_deletion_frequency.yml
@@ -0,0 +1,75 @@
+name: High File Deletion Frequency
+id: b6200efd-13bd-4336-920a-057b25bbcfaf
+version: 1
+date: '2021-12-07'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Filesystem
+description: This detection detects a high amount of file deletions in a short time for specific file types.
+  This can be an indicator for a malicious insider.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+  | eval action=ucast(map_get(input_event, "action"), "string", null), 
+  process=ucast(map_get(input_event, "process"), "string", null), 
+  file_name=ucast(map_get(input_event, "file_name"), "string", null), 
+  file_path=ucast(map_get(input_event, "file_path"), "string", null), 
+  dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), 
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) 
+  | where "Endpoint_Filesystem" IN(_datamodels) 
+  | where action="deleted" 
+  | where like(file_name, "%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") 
+  OR like(file_name, "%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") 
+  OR like(file_name, "%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") 
+  OR like(file_name, "%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") 
+  OR like(file_name, "%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") 
+  OR like(file_name, "%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") 
+  OR like(file_name, "%.js")
+  | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) 
+  | where count > 20
+  | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id, dest_device_id), body=create_map(["count", count]) 
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
+known_false_positives: user may delete bunch of pictures or files in a folder.
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+tags:
+  analytic_story:
+  - Clop Ransomware
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: High frequency file deletion activity detected on host $Computer$
+  mitre_attack_id:
+  - T1485
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: deleted_files
+    type: File Name
+    role:
+    - Target
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - action
+  - process
+  - file_name
+  - file_path
+  risk_score: 72
+  security_domain: endpoint
+
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 872c2a90b7..944c08e1bf 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -1,7 +1,7 @@
 name: Modify ACLs Permission Of Files Or Folders
 id: 9ae9a48a-cdbe-11eb-875a-acde48001122
-version: 1
-date: '2021-06-15'
+version: 2
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission
   a files or folder to make it available to everyone or to a specific user. This technique
   may be used by the adversary to evade ACLs or protected files access. This changes
   is commonly configured by the file or directory owner with appropriate permission.
-  This behavior is a good indicator if this command seen on a machine utilized by
+  This behavior raises suspicion if this command is seen on an endpoint utilized by
   an account with no permission to do so.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
@@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
-known_false_positives: network administrator may use this windows utility. filter
+known_false_positives: System administrators may use this windows utility. filter
   is needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,6 +74,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 26609a21e8..c557ace1ce 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -4,15 +4,11 @@ version: 2
 date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies parent processes, browsers, Windows
-  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
-  many applications spawn cmd.exe natively or built into macros. Much of this will
-  need to be tuned to further enhance the risk. During triage, review parallel process
-  execution and identify any file modifications that may have occurred. Capture any
-  artifacts and review further.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.'
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -82,6 +78,7 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 35
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index 300cb649b0..9337d767fe 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -1,13 +1,13 @@
 name: Potential Pass the Token or Hash Observed at the Destination Device
 id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
-version: 2
-date: '2021-11-05'
+version: 3
+date: '2021-11-30'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by a detination device.
 search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
@@ -45,10 +45,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index f8bd23739e..c771240784 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by an event-collecting device (i.e., a specific domain controller or an endpoint
   destination).
@@ -47,10 +47,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
index 17cfa4730e..a6faed82d7 100644
--- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
@@ -1,13 +1,13 @@
 name: Rare Parent-Child Process Relationship
 id: cf090c78-bcc6-11eb-8529-0242ac130003
-version: 1
-date: '2021-05-20'
+version: 2
+date: '2021-11-30'
 author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
 description: An attacker may use LOLBAS tools spawned from vulnerable applications
-  not typically used by system administrators. This search leverages the Splunk Streaming
+  not typically used by system administrators. This analytic leverages the Splunk Streaming
   ML DSP plugin to find rare parent/child relationships. The list of application has
   been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
   cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
-known_false_positives: 'Some custom tools used by admins could be used rarely to launch
+known_false_positives: 'Some custom tools used by administrators could be used rarely to launch
   remotely applications. This might trigger false positives at the beginning when
-  it hasn''t collected yet enough data to construct the baseline.
-
-  '
-references: []
+  it has not collected yet enough data to construct the baseline.'
+references: 
+  - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 tags:
   analytic_story:
   - Unusual Processes
@@ -82,5 +81,6 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 57327daab1..f9da11fb80 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -1,17 +1,13 @@
 name: Resize Shadowstorage Volume
 id: dbc30554-d27e-11eb-9e5e-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: System administrators may resize the shadowstorage for valid
-  purposes. Filter as needed.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -88,4 +83,4 @@ tags:
   - cmd_line
   risk_score: 64
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml
index 2ccd153f23..8aca4bc53b 100644
--- a/detections/endpoint/ssa___sdelete_application_execution.yml
+++ b/detections/endpoint/ssa___sdelete_application_execution.yml
@@ -5,34 +5,30 @@ date: '2021-11-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+  - Endpoint_Processes
+description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
+  that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
+  meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), 
+  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), 
+  parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), 
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") 
+  AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
+  OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") 
+  OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") 
+  OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") 
+  OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") 
+  OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") 
+  OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") 
+  OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) 
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -52,27 +48,32 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
   impact: 60
+  risk_score: 42
   kill_chain_phases:
   - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
+  message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently
+    delete files by $dest_user_id$.
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
+  - name: dest_user_id
     type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,5 +86,5 @@ tags:
   - process
   - process_id
   - process_path
-  risk_score: 42
-  security_domain: endpoint
+  - cmd_line
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
new file mode 100644
index 0000000000..7c18a2e2ca
--- /dev/null
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -0,0 +1,86 @@
+name: WBAdmin Delete System Backups
+id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND
+  like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")  
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://thedfirreport.com/2020/10/08/ryuks-return/
+  - https://attack.mitre.org/techniques/T1490/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 15
+  risk_severity: high
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
new file mode 100644
index 0000000000..03049346b9
--- /dev/null
+++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
@@ -0,0 +1,98 @@
+name: Windows Curl Upload to Remote Destination
+id: cc8d046a-543b-11ec-b864-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
+
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND
+  (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %")
+  OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+references:
+  - https://everything.curl.dev/usingcurl/uploads
+  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index a647523f9c..e4ff7baa92 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
-  as a child processs of `svchost.exe`. The LOLBAS project documents Windows native
+  as a child process of `svchost.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of svchost.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -39,7 +39,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
index 63dfff09af..c3fa2d88f7 100644
--- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
+++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
@@ -28,7 +28,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml
index 94cc1e0dee..483bbb5954 100644
--- a/detections/endpoint/windows_service_created_within_public_path.yml
+++ b/detections/endpoint/windows_service_created_within_public_path.yml
@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2020/07/21/lateral-movement-services/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index 1067c551d7..ee54cbec60 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -28,7 +28,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index 72ec8412e9..bf0a3f099e 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 0091f8b44b..ff59f2304b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -47,7 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index d8c382523d..e97f6960b8 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
-  Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`.
+  Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
   The LOLBAS project documents Windows native binaries that can be abused by threat
   actors to perform tasks like executing malicious code. Looking for child processes
   of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index f3884c6b51..f7a2261b11 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -40,7 +40,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
new file mode 100644
index 0000000000..ddb0436bae
--- /dev/null
+++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
@@ -0,0 +1,63 @@
+name: Randomly Generated Scheduled Task Name
+id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, 
+ to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task
+ and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec,
+ typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help
+ defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Command field can be used to determine if the task has malicious intent or not. 
+search: ' `wineventlog_security` EventCode=4698 | xmlkv Message 
+| lookup ut_shannon_lookup word as Task_Name
+| where ut_shannon > 3
+| table  _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Scheduled Task names.
+references:
+- https://attack.mitre.org/techniques/T1053/005/ 
+- https://splunkbase.splunk.com/app/2734/
+- https://en.wikipedia.org/wiki/Entropy_(information_theory) 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  - Persistence
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Lateral Movement
+  message: 'A windows scheduled task with a suspicious task name was created on $dest$'
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml
new file mode 100644
index 0000000000..af39d3a77f
--- /dev/null
+++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml
@@ -0,0 +1,65 @@
+name: Randomly Generated Windows Service Name
+id: 2032a95a-5165-11ec-a2c3-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, 
+ to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service
+ and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket,
+ typically create a Windows Service with a random service name on the victim host. This hunting analytic may help
+ defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. 
+search: ' `wineventlog_system` EventCode=7045  
+| lookup ut_shannon_lookup word as Service_Name
+| where ut_shannon > 3
+| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Windows Service names.
+references:
+- https://attack.mitre.org/techniques/T1543/003/ 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ComputerName
+  - Service_File_Name
+  - Service_Type
+  - Service_Name
+  - Service_Start_Type
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service with a suspicious service name was installed on $ComputerName$
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
index 512846226c..d9c7c0dda1 100644
--- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
+++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
@@ -28,7 +28,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml
new file mode 100644
index 0000000000..0072e766ee
--- /dev/null
+++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml
@@ -0,0 +1,70 @@
+name: Unusual Number of Computer Service Tickets Requested
+id: ac3b81c0-52f4-11ec-ac44-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, 
+ to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects 
+ to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint
+ requesting a large number of computer service tickets for different endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number of service requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
+| bucket span=2m _time 
+| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+| `unusual_number_of_computer_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of computer service tickets 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, administration systeams and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - service
+  - service_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
new file mode 100644
index 0000000000..0fc6e072e6
--- /dev/null
+++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
@@ -0,0 +1,70 @@
+name: Unusual Number of Remote Endpoint Authentication Events
+id: acb5dc74-5324-11ec-a36d-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, 
+ to identify an unusual number of remote authentication attempts coming from one source. An endpoint
+ authenticating to a large number of remote endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$"
+| eval Source_Account = mvindex(Account_Name, 1) 
+| bucket span=2m _time 
+| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+ `unusual_number_of_remote_endpoint_authentication_events_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: An single endpoint authenticating to a large number of hosts 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, jump servers and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Caller_Process_Name
+  - Security_ID
+  - Account_Name
+  - ComputerName
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml
index a3148b01dd..e08cb53592 100644
--- a/detections/experimental/network/remote_desktop_network_traffic.yml
+++ b/detections/experimental/network/remote_desktop_network_traffic.yml
@@ -32,7 +32,7 @@ tags:
   - SamSam Ransomware
   - Ryuk Ransomware
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/docs/_config.yml b/docs/_config.yml
index 71a15fccf7..32d6c901ee 100644
--- a/docs/_config.yml
+++ b/docs/_config.yml
@@ -31,6 +31,8 @@ minimal_mistakes_skin: "contrast" #default, neon, dark are also options
 
 # Build settings
 markdown: kramdown
+highlighter: rouge
+
 remote_theme: mmistakes/minimal-mistakes
 # Outputting
 permalink: /:categories/:title/
diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml
index cd73da3ebf..c837d67511 100644
--- a/docs/_data/navigation.yml
+++ b/docs/_data/navigation.yml
@@ -38,8 +38,6 @@ detections:
         url: /detections/privilege_escalation/
       - title: Reconnaissance
         url: /detections/reconnaissance/
-      - title: Resource Development
-        url: /detections/resource_development/
   - title: "Datamodel"
     children:
       - title: Authentication
diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md
index 31fdf3eb01..147a06b8ac 100644
--- a/docs/_pages/adversary_tactics.md
+++ b/docs/_pages/adversary_tactics.md
@@ -11,6 +11,7 @@ sidebar:
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | [Active Directory Discovery](/stories/active_directory_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
+| [Active Directory Lateral Movement](/stories/active_directory_lateral_movement/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
 | [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
@@ -27,7 +28,6 @@ sidebar:
 | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [HAFNIUM Group](/stories/hafnium_group/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
-| [Lateral Movement](/stories/lateral_movement/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
 | [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
@@ -56,7 +56,7 @@ sidebar:
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
 | [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
\ No newline at end of file
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 0eee0b17f5..40fe7f976b 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -55,18 +55,16 @@ sidebar:
 | [Anomalous usage of Archive Tools](/endpoint/anomalous_usage_of_archive_tools/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly |
 | [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
-| [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
-| [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
-| [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP |
 | [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP |
 | [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | TTP |
-| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | TTP |
 | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP |
@@ -116,18 +114,9 @@ sidebar:
 | [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP |
-| [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
 | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
+| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly |
 | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
 | [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP |
@@ -180,6 +169,7 @@ sidebar:
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly |
 | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
 | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
+| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
 | [Detect Rare Executables]() | None | Anomaly |
 | [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP |
 | [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP |
@@ -231,7 +221,7 @@ sidebar:
 | [Disable Defender Submit Samples Consent Feature](/endpoint/disable_defender_submit_samples_consent_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
-| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop), [Valid Accounts](/tags/#valid-accounts) | TTP |
 | [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry) | TTP |
@@ -299,9 +289,10 @@ sidebar:
 | [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly |
 | [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly |
-| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
+| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
 | [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
+| [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | TTP |
 | [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting |
 | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
@@ -368,16 +359,6 @@ sidebar:
 | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting |
-| [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP |
-| [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP |
-| [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
-| [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Illegal Management of Active Directory Elements and Policies via DSInternals modules](/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Illegal Management of Computers and Active Directory Elements via PowerSploit modules](/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP |
-| [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP |
 | [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service) | TTP |
 | [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
 | [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
@@ -473,6 +454,7 @@ sidebar:
 | [Phishing Email Detection by Machine Learning Method - SSA](/application/phishing_email_detection_by_machine_learning_method_-_ssa/) | [Phishing](/tags/#phishing) | Anomaly |
 | [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | Hunting |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | TTP |
 | [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
 | [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
 | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting |
@@ -495,7 +477,6 @@ sidebar:
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
-| [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
 | [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Phishing](/tags/#phishing), [Spearphishing Link](/tags/#spearphishing-link) | TTP |
 | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
@@ -506,25 +487,12 @@ sidebar:
 | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
 | [Protocols passing authentication in cleartext]() | None | TTP |
+| [Randomly Generated Scheduled Task Name](/endpoint/randomly_generated_scheduled_task_name/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | Hunting |
+| [Randomly Generated Windows Service Name](/endpoint/randomly_generated_windows_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | Hunting |
 | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly |
 | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly |
 | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
 | [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
-| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Reconnaissance and Access to Accounts and Groups via Mimikatz modules](/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP |
-| [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
-| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software](/tags/#software), [Network Service Scanning](/tags/#network-service-scanning), [Query Registry](/tags/#query-registry), [System Service Discovery](/tags/#system-service-discovery), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Software Discovery](/tags/#software-discovery) | TTP |
-| [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | TTP |
-| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
-| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Account Manipulation](/tags/#account-manipulation), [Domain Properties](/tags/#domain-properties), [Valid Accounts](/tags/#valid-accounts), [Credentials](/tags/#credentials), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Network Trust Dependencies](/tags/#network-trust-dependencies) | TTP |
-| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Software](/tags/#software), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -595,11 +563,9 @@ sidebar:
 | [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Services LOLBAS Execution Process Spawn](/endpoint/services_lolbas_execution_process_spawn/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
-| [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
 | [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
+| [Short Lived Scheduled Task](/endpoint/short_lived_scheduled_task/) | [Scheduled Task](/tags/#scheduled-task) | TTP |
 | [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP |
 | [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP |
@@ -664,6 +630,8 @@ sidebar:
 | [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP |
 | [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [Unusual Number of Remote Endpoint Authentication Events](/endpoint/unusual_number_of_remote_endpoint_authentication_events/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
 | [Unusually Long Command Line]() | None | Anomaly |
 | [Unusually Long Command Line]() | None | Anomaly |
 | [Unusually Long Command Line - MLTK]() | None | Anomaly |
@@ -674,6 +642,7 @@ sidebar:
 | [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | Hunting |
 | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP |
 | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
 | [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
@@ -694,6 +663,7 @@ sidebar:
 | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP |
 | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Hunting |
diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md
index 5577983c2e..85dac5c58e 100644
--- a/docs/_pages/playbooks.md
+++ b/docs/_pages/playbooks.md
@@ -10,6 +10,9 @@ sidebar:
 
 | Name    | Detections | Type        |
 | --------| ---------- | ----------- |
+| [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response |
+| [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response |
+| [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/detections/TTP/executable_file_written_in_administrative_smb_share)| Response |
 | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |
 | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response |
 | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index 5b3028ad5d..188c2c8c09 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -16,6 +16,7 @@ sidebar:
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Active Directory Discovery](active_directory_discovery) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
+| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
 | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Asset Tracking]() | None | None |
@@ -56,7 +57,6 @@ sidebar:
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
-| [Lateral Movement](lateral_movement) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | [Lateral Movement](/tags/#lateral-movement) |
 | [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
@@ -109,7 +109,7 @@ sidebar:
 | [Use of Cleartext Protocols]() | None | None |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
 | [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
diff --git a/docs/_playbooks/active_directory_reset_password.md b/docs/_playbooks/active_directory_reset_password.md
new file mode 100644
index 0000000000..6aa1af6985
--- /dev/null
+++ b/docs/_playbooks/active_directory_reset_password.md
@@ -0,0 +1,42 @@
+---
+title: "Active Directory Reset password"
+last_modified_at: 2020-12-08
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - LDAP
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar)
+- **Last Updated**: 2020-12-08
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc96-ff2b-48b0-9f6f-63da6783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+This playbook works on artifacts with artifact:*.cef.compromisedUserName which can be created as shown in the playbook &#34;recorded_future_handle_leaked_credentials&#34; - The prompt is hard-coded to use &#34;admin&#34; as the user, so change it to the correct user or role
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/activedirectory_reset_password.png)
+
+#### Required field
+* compromisedUserName
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/activedirectory_reset_password.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_playbooks/crowdstrike_malware_triage.md b/docs/_playbooks/crowdstrike_malware_triage.md
new file mode 100644
index 0000000000..1efead38b2
--- /dev/null
+++ b/docs/_playbooks/crowdstrike_malware_triage.md
@@ -0,0 +1,43 @@
+---
+title: "Crowdstrike Malware Triage"
+last_modified_at: 2021-02-25
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - Crowdstrike OAuth
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook is used to enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst&#39;s choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of &#34;detect&#34; or &#34;none&#34;, and the endpoint can be optionally quarantined from the network.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [Crowdstrike OAuth](https://splunkbase.splunk.com/apps/#/search/Crowdstrike OAuth/product/soar)
+- **Last Updated**: 2021-02-25
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc96-fa2b-48b0-9a6f-63da6783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+This playbook uses the Crowdstrike OAuth app. Change the target user of the prompt from admin to the appropriate user or role.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/crowdstrike_malware_triage.png)
+
+#### Required field
+* filePath
+* destinationAddress
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/crowdstrike_malware_triage.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md
new file mode 100644
index 0000000000..f9506da3af
--- /dev/null
+++ b/docs/_playbooks/delete_detected_files.md
@@ -0,0 +1,729 @@
+---
+title: "Delete Detected Files"
+last_modified_at: 2021-03-29
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - Windows Remote Management
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host). Before deleting the file, we run a &#34;more&#34; command on the file in question to extract its contents. We then run a delete on the file in question.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [Windows Remote Management](https://splunkbase.splunk.com/apps/#/search/Windows Remote Management/product/soar)
+- **Last Updated**: 2021-03-29
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc96-ff2b-48b0-9a6f-63da6783fd63
+
+#### Associated Detections
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+* [Executable File Written in Administrative SMB Share](/detections/TTP/executable_file_written_in_administrative_smb_share)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#### How To Implement
+This playbook reads and then deletes files stored with artifact:*.cef.filePath from hosts stored in artifact:*.cef.destinationAddress. Windows Remote Management must be enabled on the remote computer.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/delete_detected_files.png)
+
+#### Required field
+* filePath
+* destinationAddress
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/delete_detected_files.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md
index 224cbff83b..43b255d207 100644
--- a/docs/_playbooks/ransomware_investigate_and_contain.md
+++ b/docs/_playbooks/ransomware_investigate_and_contain.md
@@ -115,8 +115,6 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
-
-
 
 
 
@@ -696,34 +694,6 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 
 
 
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index eaceb24d99..e9f3b6a2de 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -15,6 +15,8 @@ tags:
   - Endpoint
 ---
 
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -96,4 +98,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/first_time_seen_child_process_of_zoom.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index 5233c1b80b..c47e24c064 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -58,7 +58,7 @@ This search looks for network traffic on TCP/3389, the default port used by remo
 * [SamSam Ransomware](/stories/samsam_ransomware)
 * [Ryuk Ransomware](/stories/ryuk_ransomware)
 * [Hidden Cobra Malware](/stories/hidden_cobra_malware)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index 0d530566df..6d7527892e 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -56,7 +56,7 @@ This search looks for the remote desktop process mstsc.exe running on systems up
 
 #### Associated Analytic Story
 * [Hidden Cobra Malware](/stories/hidden_cobra_malware)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
index afc08467fb..17ff1b5612 100644
--- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
+++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
@@ -15,6 +15,8 @@ tags:
   - CVE-2020-1472
 ---
 
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -98,4 +100,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_computer_changed_with_anonymous_account.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_computer_changed_with_anonymous_account.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index 1fb623a3fa..33c3ee77ae 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -54,7 +54,7 @@ This search looks for specific authentication events from the Windows Security E
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md
deleted file mode 100644
index 0c753e11af..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: "Credential Extraction indicative of FGDump and CacheDump with s option"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system&#39;s registry.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 312582f2-5e91-42c1-a275-cd67f31373c8
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND process_name != null AND parent_process_name != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Unusual Processes](/stories/unusual_processes)
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* process_name
-* parent_process_name
-* _time
-* process_path
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md
deleted file mode 100644
index 7b5cfb6787..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-title: "Credential Extraction indicative of FGDump and CacheDump with v option"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system&#39;s registry.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Unusual Processes](/stories/unusual_processes)
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* process_name
-* _time
-* process_path
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md
deleted file mode 100644
index 3e5ff7beae..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: "Credential Extraction indicative of Lazagne command line options"
-excerpt: "OS Credential Dumping, Credentials from Password Stores"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Credentials from Password Stores
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is a tool that extracts various kinds of credentials from a local computer, including account passwords, domain passwords, browser passwords, etc.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 341975fa-4ad0-4f01-9acc-df4f69742db7
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_lazagne_command_line_options.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md
deleted file mode 100644
index a0976476aa..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: "Credential Extraction native Microsoft debuggers peek into the kernel"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND parent_process_name != null AND process_name != null  AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Unusual Processes](/stories/unusual_processes)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* process_name
-* parent_process_name
-* _time
-* dest_device_id
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | Malicious actor is extracting/decoding encoded credentials via Microsoft&#39;s native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29](https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md
deleted file mode 100644
index ece42e02d0..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: "Credential Extraction native Microsoft debuggers via z command line option"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: adc51a77-90c9-4358-b43c-f10dd1a27d05
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND process_name != null AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Unusual Processes](/stories/unusual_processes)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* process_name
-* _time
-* dest_device_id
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | Malicious actor is extracting/decoding encoded credentials via Microsoft&#39;s native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md b/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md
deleted file mode 100644
index 2fd4251640..0000000000
--- a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: "Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-18
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit and DSInternals are common exploit APIs offering PowerShell modules for various exploits of Windows and Active Directory environments.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-18
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
- 
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\
-|]+/)=true
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md
deleted file mode 100644
index 05b9f49483..0000000000
--- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: "Credential Extraction indicative of use of DSInternals credential conversion modules"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-21
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-21
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* process_name
-* parent_process_name
-* _time
-* process_path
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md
deleted file mode 100644
index 1a8507d4b8..0000000000
--- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: "Credential Extraction indicative of use of DSInternals modules"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-21
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-21
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* process_name
-* parent_process_name
-* _time
-* process_path
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md
deleted file mode 100644
index 868a105408..0000000000
--- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: "Credential Extraction indicative of use of Mimikatz modules"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-21
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz is a collection of tools and modules commonly employed in Windows exploits.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-21
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Unusual Processes](/stories/unusual_processes)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 66.5 | 70 | 95 | Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md
deleted file mode 100644
index c965264fec..0000000000
--- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: "Credential Extraction indicative of use of PowerSploit modules"
-excerpt: "OS Credential Dumping"
-categories:
-  - Endpoint
-last_modified_at: 2020-10-21
-toc: true
-toc_label: ""
-tags:
-  - OS Credential Dumping
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit is a collection of Microsoft PowerShell modules commonly employed in exploits.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-10-21
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 5f1186a4-e681-446e-851c-dc9574ad28eb
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md
deleted file mode 100644
index e5e5d64c3f..0000000000
--- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: "Applying Stolen Credentials via Mimikatz modules"
-excerpt: "Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, Boot or Logon Autostart Execution, Abuse Elevation Control Mechanism, Compromise Client Software Binary, Modify Authentication Process, Steal or Forge Kerberos Tickets"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Process Injection
-  - Defense Evasion
-  - Privilege Escalation
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Access Token Manipulation
-  - Defense Evasion
-  - Privilege Escalation
-  - Create or Modify System Process
-  - Persistence
-  - Privilege Escalation
-  - Boot or Logon Autostart Execution
-  - Persistence
-  - Privilege Escalation
-  - Abuse Elevation Control Mechanism
-  - Privilege Escalation
-  - Defense Evasion
-  - Compromise Client Software Binary
-  - Persistence
-  - Modify Authentication Process
-  - Credential Access
-  - Defense Evasion
-  - Persistence
-  - Steal or Forge Kerberos Tickets
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 759a653f-cb92-40f9-94c9-ec4e47b0f709
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
-
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-
-| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
-
-| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
-
-| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
-
-| [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence |
-
-| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
-
-| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events() 
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-* [https://adsecurity.org/?p=1275](https://adsecurity.org/?p=1275)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/applying_stolen_credentials_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md
deleted file mode 100644
index 7662d8a84b..0000000000
--- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md
+++ /dev/null
@@ -1,144 +0,0 @@
----
-title: "Applying Stolen Credentials via PowerSploit modules"
-excerpt: "Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, Boot or Logon Autostart Execution, Abuse Elevation Control Mechanism, Compromise Client Software Binary, Credentials from Password Stores, Steal or Forge Kerberos Tickets"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Process Injection
-  - Defense Evasion
-  - Privilege Escalation
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Access Token Manipulation
-  - Defense Evasion
-  - Privilege Escalation
-  - Create or Modify System Process
-  - Persistence
-  - Privilege Escalation
-  - Boot or Logon Autostart Execution
-  - Persistence
-  - Privilege Escalation
-  - Abuse Elevation Control Mechanism
-  - Privilege Escalation
-  - Defense Evasion
-  - Compromise Client Software Binary
-  - Persistence
-  - Credentials from Password Stores
-  - Credential Access
-  - Steal or Forge Kerberos Tickets
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit kit APIs.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 270b482d-2af2-448f-9923-9cf005f61be4
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
-
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-
-| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
-
-| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
-
-| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
-
-| [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence |
-
-| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access |
-
-| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/applying_stolen_credentials_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md b/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md
deleted file mode 100644
index 1f45db9f7f..0000000000
--- a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: "Assessment of Credential Strength via DSInternals modules"
-excerpt: "Valid Accounts, Account Manipulation, Account Discovery, Password Policy Discovery, Unsecured Credentials, Credentials from Password Stores"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Account Discovery
-  - Discovery
-  - Password Policy Discovery
-  - Discovery
-  - Unsecured Credentials
-  - Credential Access
-  - Credentials from Password Stores
-  - Credential Access
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of DSInternals modules that verify password strength, i.e., identify weak accounts that would be easily compromised.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
-
-| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
-
-| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access |
-
-| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Credential Dumping](/stories/credential_dumping)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 25.5 | 30 | 85 | DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/assessment_of_credential_strength_via_dsinternals_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md
deleted file mode 100644
index cdf3b522db..0000000000
--- a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md
+++ /dev/null
@@ -1,126 +0,0 @@
----
-title: "Reconnaissance of Credential Stores and Services via Mimikatz modules"
-excerpt: "Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim Identity Information, Network Trust Dependencies"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Account Manipulation
-  - Persistence
-  - Domain Properties
-  - Reconnaissance
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Credentials
-  - Reconnaissance
-  - Gather Victim Network Information
-  - Reconnaissance
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Gather Victim Identity Information
-  - Reconnaissance
-  - Network Trust Dependencies
-  - Reconnaissance
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 5facee5b-79e4-47ab-b0e6-c625acc0554f
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1590.001](https://attack.mitre.org/techniques/T1590/001/) | Domain Properties | Reconnaissance |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1589.001](https://attack.mitre.org/techniques/T1589/001/) | Credentials | Reconnaissance |
-
-| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance |
-
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1589](https://attack.mitre.org/techniques/T1589/) | Gather Victim Identity Information | Reconnaissance |
-
-| [T1590.003](https://attack.mitre.org/techniques/T1590/003/) | Network Trust Dependencies | Reconnaissance |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md
deleted file mode 100644
index 515bdba702..0000000000
--- a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md
+++ /dev/null
@@ -1,110 +0,0 @@
----
-title: "Setting Credentials via DSInternals modules"
-excerpt: "Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies illegal setting of credentials via DSInternals modules.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* process_name
-* parent_process_name
-* _time
-* process_path
-* dest_user_id
-* process
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/setting_credentials_via_dsinternals_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md
deleted file mode 100644
index e18e937edb..0000000000
--- a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Setting Credentials via Mimikatz modules"
-excerpt: "Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies illegal setting of credentials via Mimikatz modules.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: c8b84699-7652-4363-910f-efd1ca82f780
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/setting_credentials_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md
deleted file mode 100644
index de67fb38fc..0000000000
--- a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Setting Credentials via PowerSploit modules"
-excerpt: "Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-03
-toc: true
-toc_label: ""
-tags:
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies illegal setting of credentials via PowerSploit modules.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-03
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 07b2a501-f967-4ddc-9f56-2dce46dfce44
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/setting_credentials_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md
deleted file mode 100644
index 6831faadb1..0000000000
--- a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md
+++ /dev/null
@@ -1,102 +0,0 @@
----
-title: "Probing Access with Stolen Credentials via PowerSploit modules"
-excerpt: "Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-04
-toc: true
-toc_label: ""
-tags:
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-04
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: d405af5d-99f1-45af-8dfb-b8f98b764247
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_user_id
-* dest_device_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 60.0 | 60 | 100 | PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md
deleted file mode 100644
index 38323a1cf8..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance and Access to Accounts and Groups via Mimikatz modules"
-excerpt: "Valid Accounts, Account Discovery, Domain Policy Modification"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Discovery
-  - Discovery
-  - Domain Policy Modification
-  - Defense Evasion
-  - Privilege Escalation
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
-
-| [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md
deleted file mode 100644
index 61f382d90f..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules"
-excerpt: "Valid Accounts, Account Discovery, Domain Policy Modification"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Discovery
-  - Discovery
-  - Domain Policy Modification
-  - Defense Evasion
-  - Privilege Escalation
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 63422f8e-766c-468f-8133-2ba6795e263b
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
-
-| [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-LastLoggedOn/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | PowerSploit malware is searching for and using specific accounts, groups and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md
deleted file mode 100644
index b289e12f8f..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-title: "Reconnaissance of Access and Persistence Opportunities via PowerSploit modules"
-excerpt: "Scheduled Task/Job, Exploitation for Privilege Escalation, Valid Accounts, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Execution Flow"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Scheduled Task/Job
-  - Execution
-  - Persistence
-  - Privilege Escalation
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Create or Modify System Process
-  - Persistence
-  - Privilege Escalation
-  - Boot or Logon Autostart Execution
-  - Persistence
-  - Privilege Escalation
-  - Hijack Execution Flow
-  - Persistence
-  - Privilege Escalation
-  - Defense Evasion
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities, as well as services and system files that can be compromised.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
-
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
-
-| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
-
-| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 60.0 | 60 | 100 | PowerSploit malware is searching for an entry point into the infrastructure, such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md
deleted file mode 100644
index 2080b849c8..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance of Defensive Tools via PowerSploit modules"
-excerpt: "Software, Vulnerability Scanning, Gather Victim Host Information, Active Scanning"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Software
-  - Reconnaissance
-  - Vulnerability Scanning
-  - Reconnaissance
-  - Gather Victim Host Information
-  - Reconnaissance
-  - Active Scanning
-  - Reconnaissance
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of PowerSploit modules for assessment of presence of defensive tools.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 24b4e659-63a2-4e7b-89ac-87dd659c7110
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance |
-
-| [T1595.002](https://attack.mitre.org/techniques/T1595/002/) | Vulnerability Scanning | Reconnaissance |
-
-| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
-
-| [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 40.0 | 40 | 100 | PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md
deleted file mode 100644
index 02ee11f4b3..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: "Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules"
-excerpt: "Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Exploitation for Privilege Escalation
-  - Privilege Escalation
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: b9b4492c-2af8-449b-beb4-b1b78d963321
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
-
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 60.0 | 60 | 100 | PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md
deleted file mode 100644
index edd9e9cc37..0000000000
--- a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md
+++ /dev/null
@@ -1,108 +0,0 @@
----
-title: "Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules"
-excerpt: "Create or Modify System Process, Process Injection, Hijack Execution Flow"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-05
-toc: true
-toc_label: ""
-tags:
-  - Create or Modify System Process
-  - Persistence
-  - Privilege Escalation
-  - Process Injection
-  - Defense Evasion
-  - Privilege Escalation
-  - Hijack Execution Flow
-  - Persistence
-  - Privilege Escalation
-  - Defense Evasion
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments called payloads to any Win32 binary.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-05
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: fc5c1cbd-7494-4314-aad2-458d6fd4fada
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
-
-| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
-
-| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-* [https://en.wikipedia.org/wiki/Microsoft_Detours](https://en.wikipedia.org/wiki/Microsoft_Detours)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md
deleted file mode 100644
index 298d99ad17..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md
+++ /dev/null
@@ -1,111 +0,0 @@
----
-title: "Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules"
-excerpt: "Trusted Relationship, Domain Trust Discovery, Gather Victim Network Information, Gather Victim Org Information, Active Scanning"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Trusted Relationship
-  - Initial Access
-  - Domain Trust Discovery
-  - Discovery
-  - Gather Victim Network Information
-  - Reconnaissance
-  - Gather Victim Org Information
-  - Reconnaissance
-  - Active Scanning
-  - Reconnaissance
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: db08ac40-ee14-43e9-9a75-dddd059ef812
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access |
-
-| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
-
-| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance |
-
-| [T1591](https://attack.mitre.org/techniques/T1591/) | Gather Victim Org Information | Reconnaissance |
-
-| [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md
deleted file mode 100644
index 1698ca8885..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: "Reconnaissance and Access to Computers and Domains via PowerSploit modules"
-excerpt: "Gather Victim Host Information, Gather Victim Network Information, Account Discovery"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Gather Victim Host Information
-  - Reconnaissance
-  - Gather Victim Network Information
-  - Reconnaissance
-  - Account Discovery
-  - Discovery
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
-
-| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance |
-
-| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md
deleted file mode 100644
index d86240f486..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: "Reconnaissance and Access to Computers via Mimikatz modules"
-excerpt: "Gather Victim Host Information"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Gather Victim Host Information
-  - Reconnaissance
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 50.0 | 50 | 100 | Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md
deleted file mode 100644
index 3f9d89b415..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md
+++ /dev/null
@@ -1,127 +0,0 @@
----
-title: "Reconnaissance and Access to Operating System Elements via PowerSploit modules"
-excerpt: "Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumentation, Gather Victim Host Information, Software Discovery"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Process Discovery
-  - Discovery
-  - File and Directory Discovery
-  - Discovery
-  - Software
-  - Reconnaissance
-  - Network Service Scanning
-  - Discovery
-  - Query Registry
-  - Discovery
-  - System Service Discovery
-  - Discovery
-  - Windows Management Instrumentation
-  - Execution
-  - Gather Victim Host Information
-  - Reconnaissance
-  - Software Discovery
-  - Discovery
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1057](https://attack.mitre.org/techniques/T1057/) | Process Discovery | Discovery |
-
-| [T1083](https://attack.mitre.org/techniques/T1083/) | File and Directory Discovery | Discovery |
-
-| [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance |
-
-| [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery |
-
-| [T1012](https://attack.mitre.org/techniques/T1012/) | Query Registry | Discovery |
-
-| [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery |
-
-| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
-
-| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
-
-| [T1518](https://attack.mitre.org/techniques/T1518/) | Software Discovery | Discovery |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, /(?i)Get-RegistryMountedDrive/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md
deleted file mode 100644
index 6718a0d813..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: "Reconnaissance and Access to Processes and Services via Mimikatz modules"
-excerpt: "System Service Discovery, Network Service Scanning, Process Discovery"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - System Service Discovery
-  - Discovery
-  - Network Service Scanning
-  - Discovery
-  - Process Discovery
-  - Discovery
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for discovery and access to services and processes.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 0243d37c-57c1-4182-bfd1-39b212255fc8
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery |
-
-| [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery |
-
-| [T1057](https://attack.mitre.org/techniques/T1057/) | Process Discovery | Discovery |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 50.0 | 50 | 100 | Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md
deleted file mode 100644
index 9861d5d898..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance and Access to Shared Resources via Mimikatz modules"
-excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Remote Services
-  - Lateral Movement
-  - Data from Network Shared Drive
-  - Collection
-  - Network Share Discovery
-  - Discovery
-  - SMB/Windows Admin Shares
-  - Lateral Movement
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for discovery and access to network shares.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
-
-| [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection |
-
-| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery |
-
-| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md
deleted file mode 100644
index 9a7a3425b7..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance and Access to Shared Resources via PowerSploit modules"
-excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Remote Services
-  - Lateral Movement
-  - Data from Network Shared Drive
-  - Collection
-  - Network Share Discovery
-  - Discovery
-  - SMB/Windows Admin Shares
-  - Lateral Movement
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 6b7ca431-6b1e-4b40-9589-21cb368e369e
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
-
-| [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection |
-
-| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery |
-
-| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md
deleted file mode 100644
index a36fb00db4..0000000000
--- a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Reconnaissance of Connectivity via PowerSploit modules"
-excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-06
-toc: true
-toc_label: ""
-tags:
-  - Remote Services
-  - Lateral Movement
-  - Data from Network Shared Drive
-  - Collection
-  - Network Share Discovery
-  - Discovery
-  - SMB/Windows Admin Shares
-  - Lateral Movement
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules for reconnaissance of connectivity.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-06
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
-
-| [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection |
-
-| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery |
-
-| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* _time
-* process
-* dest_device_id
-* dest_user_id
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | PowerSploit malware is performing port scans or searching for various connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/reconnaissance_of_connectivity_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md
deleted file mode 100644
index 798884a058..0000000000
--- a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md
+++ /dev/null
@@ -1,108 +0,0 @@
----
-title: "Illegal Access To User Content via PowerSploit modules"
-excerpt: "Remote Services, Screen Capture, Audio Capture, Remote Service Session Hijacking"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Remote Services
-  - Lateral Movement
-  - Screen Capture
-  - Collection
-  - Audio Capture
-  - Collection
-  - Remote Service Session Hijacking
-  - Lateral Movement
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 01fc7d91-eb0c-478e-8633-e4fa4904463a
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
-
-| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
-
-| [T1123](https://attack.mitre.org/techniques/T1123/) | Audio Capture | Collection |
-
-| [T1563](https://attack.mitre.org/techniques/T1563/) | Remote Service Session Hijacking | Lateral Movement |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 85.0 | 85 | 100 | PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_access_to_user_content_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md
deleted file mode 100644
index 8b45cd7d45..0000000000
--- a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-title: "Illegal Account Creation via PowerSploit modules"
-excerpt: "Establish Accounts"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Establish Accounts
-  - Resource Development
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that create accounts illegaly.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 20fba62a-fa5b-46cc-b39f-473fa248fee2
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1585](https://attack.mitre.org/techniques/T1585/) | Establish Accounts | Resource Development |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_account_creation_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md
deleted file mode 100644
index c5951dda6d..0000000000
--- a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md
+++ /dev/null
@@ -1,96 +0,0 @@
----
-title: "Illegal Deletion of Logs via Mimikatz modules"
-excerpt: "Indicator Removal on Host"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Indicator Removal on Host
-  - Defense Evasion
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that delete event logs.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Log Manipulation](/stories/windows_log_manipulation)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 50.0 | 50 | 100 | Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_deletion_of_logs_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md
deleted file mode 100644
index 249ca5ec3a..0000000000
--- a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: "Illegal Enabling or Disabling of Accounts via DSInternals modules"
-excerpt: "Valid Accounts, Account Manipulation"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Valid Accounts
-  - Defense Evasion
-  - Persistence
-  - Privilege Escalation
-  - Initial Access
-  - Account Manipulation
-  - Persistence
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of DSInternals modules that enable or disable accounts illegaly.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 3e0f9962-9989-445f-878c-939443326b63
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
-
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 80.0 | 80 | 100 | DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md
deleted file mode 100644
index b0798af130..0000000000
--- a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: "Illegal Management of Active Directory Elements and Policies via DSInternals modules"
-excerpt: "Account Manipulation, Rogue Domain Controller, Domain Policy Modification"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Account Manipulation
-  - Persistence
-  - Rogue Domain Controller
-  - Defense Evasion
-  - Domain Policy Modification
-  - Defense Evasion
-  - Privilege Escalation
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: a587ca9f-c138-47b4-ba51-699f319b8cc5
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion |
-
-| [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md
deleted file mode 100644
index f602464520..0000000000
--- a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: "Illegal Management of Computers and Active Directory Elements via PowerSploit modules"
-excerpt: "Account Manipulation, Rogue Domain Controller, Domain Policy Modification"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Account Manipulation
-  - Persistence
-  - Rogue Domain Controller
-  - Defense Evasion
-  - Domain Policy Modification
-  - Defense Evasion
-  - Privilege Escalation
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 75760c11-7d48-4968-b828-013b299e8f6d
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
-
-| [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion |
-
-| [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )
-
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md
deleted file mode 100644
index 92e607770e..0000000000
--- a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: "Illegal Privilege Elevation and Persistence via PowerSploit modules"
-excerpt: "Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Scheduled Task/Job
-  - Execution
-  - Persistence
-  - Privilege Escalation
-  - Access Token Manipulation
-  - Defense Evasion
-  - Privilege Escalation
-  - Abuse Elevation Control Mechanism
-  - Privilege Escalation
-  - Defense Evasion
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 88c10ee9-fe72-4bce-b343-5b129044b991
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
-
-| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-
-| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Malicious PowerShell](/stories/malicious_powershell)
-* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md
deleted file mode 100644
index 9f96e8c8b5..0000000000
--- a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md
+++ /dev/null
@@ -1,102 +0,0 @@
----
-title: "Illegal Privilege Elevation via Mimikatz modules"
-excerpt: "Access Token Manipulation, Abuse Elevation Control Mechanism"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Access Token Manipulation
-  - Defense Evasion
-  - Privilege Escalation
-  - Abuse Elevation Control Mechanism
-  - Privilege Escalation
-  - Defense Evasion
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for illegal privilege elevation.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 2f873b1f-6352-4844-b7b9-b419f09a42c7
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation |
-
-| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_privilege_elevation_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md
deleted file mode 100644
index 0e5b72a9b1..0000000000
--- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: "Illegal Service and Process Control via Mimikatz modules"
-excerpt: "Process Injection, Native API, System Services"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Process Injection
-  - Defense Evasion
-  - Privilege Escalation
-  - Native API
-  - Execution
-  - System Services
-  - Execution
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: aaf3adf1-73e1-4477-b4ee-3771898964f1
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
-
-| [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution |
-
-| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Service Abuse](/stories/windows_service_abuse)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | Mimikatz malware is controlling computer&#39;s processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_service_and_process_control_via_mimikatz_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md
deleted file mode 100644
index 557f4b76cc..0000000000
--- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "Illegal Service and Process Control via PowerSploit modules"
-excerpt: "Process Injection, Native API, System Services"
-categories:
-  - Endpoint
-last_modified_at: 2020-11-09
-toc: true
-toc_label: ""
-tags:
-  - Process Injection
-  - Defense Evasion
-  - Privilege Escalation
-  - Native API
-  - Execution
-  - System Services
-  - Execution
-  - Splunk Behavioral Analytics
-  - Endpoint_Processes
----
-
-
-
-[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
-
-#### Description
-
-This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, modifying access to service objects, etc.
-
-- **Type**: TTP
-- **Product**: Splunk Behavioral Analytics
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-11-09
-- **Author**: Stanislav Miskovic, Splunk
-- **ID**: 0e910e5b-309d-4bc3-8af2-0030c02aa353
-
-
-#### [ATT&CK](https://attack.mitre.org/)
-
-| ID          | Technique   | Tactic         |
-| ----------- | ----------- |--------------- |
-| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
-
-| [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution |
-
-| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution |
-
-#### Search
-
-```
-
-| from read_ssa_enriched_events()
-
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true )
-
-
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) 
-| into write_ssa_detected_events();
-```
-
-#### Associated Analytic Story
-* [Windows Service Abuse](/stories/windows_service_abuse)
-* [Malicious PowerShell](/stories/malicious_powershell)
-
-
-#### How To Implement
-You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging.
-
-#### Required field
-* dest_device_id
-* dest_user_id
-* process
-* _time
-
-
-#### Kill Chain Phase
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified.
-
-
-#### RBA
-
-| Risk Score  | Impact      | Confidence   | Message      |
-| ----------- | ----------- |--------------|--------------|
-| 90.0 | 90 | 100 | PowerSploit malware is controlling computer&#39;s processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
-
-
-
-
-#### Reference
-
-* [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit)
-
-
-
-#### Test Dataset
-Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
-Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log)
-
-
-
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/illegal_service_and_process_control_via_powersploit_modules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index bb2573303a..85e1259091 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -19,7 +19,7 @@ tags:
 
 #### Description
 
-The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. During triage, review parallel process execution and identify any file modifications that may have occurred. Capture any artifacts and review further.
+The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.
 
 - **Type**: Anomaly
 - **Product**: Splunk Behavioral Analytics
@@ -39,8 +39,8 @@ The following analytic identifies parent processes, browsers, Windows terminal a
 
 ```
 
-| from read_ssa_enriched_events() 
-| where "Endpoint_Processes" IN(_datamodels) 
+| from read_ssa_enriched_events()
+
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
 | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null) 
 | where process_name="cmd.exe" 
@@ -63,6 +63,7 @@ In order to successfully implement this analytic, you will need endpoint process
 * _time
 * dest_device_id
 * dest_user_id
+* cmd_line
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index e514ffca5f..0d6b7fcb84 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -65,7 +65,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
 * [Ransomware](/stories/ransomware)
 * [Ryuk Ransomware](/stories/ryuk_ransomware)
 * [IcedID](/stories/icedid)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index f8ce88b584..ab7409816a 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -54,6 +54,7 @@ The following hunting analytic will identify the use of localgroup discovery usi
 
 #### Associated Analytic Story
 * [Active Directory Discovery](/stories/active_directory_discovery)
+* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 2d862de642..ffa9b39e6b 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -57,7 +57,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
 * [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
 * [HAFNIUM Group](/stories/hafnium_group)
 * [DarkSide Ransomware](/stories/darkside_ransomware)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index e793219766..c559d818e2 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -57,7 +57,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 * [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
 * [HAFNIUM Group](/stories/hafnium_group)
 * [DarkSide Ransomware](/stories/darkside_ransomware)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
index a6e0263361..b0c1cd09eb 100644
--- a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
+++ b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
@@ -23,7 +23,7 @@ tags:
 
 #### Description
 
-This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination).
+This detection identifies potential Pass the Token or Pass the Hash credential stealing. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination).
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
@@ -48,8 +48,7 @@ This detection identifies potential Pass the Token or Pass the Hash credential e
 | from read_ssa_enriched_events() 
 | where "Authentication" IN(_datamodels)
 
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string", null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"), "string", null))
-
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string", null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
 | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") AND dest_user_id != null AND origin_device_id != null
 
 | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
@@ -58,13 +57,13 @@ This detection identifies potential Pass the Token or Pass the Hash credential e
 
 | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50)  AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
-| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
+| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id, origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
 
 | into write_ssa_detected_events();
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
@@ -99,6 +98,7 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc
 #### Reference
 
 * [https://attack.mitre.org/techniques/T1550/002/](https://attack.mitre.org/techniques/T1550/002/)
+* [https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/](https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/)
 
 
 
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index c86d456b9d..c8881950c4 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -55,7 +55,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index 2f55c50da1..c54c9dd691 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -55,7 +55,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index d0cd21c0cb..31a0ab74ab 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -53,7 +53,7 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index d6deb640a8..01f078dbc3 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -57,7 +57,7 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index f8cd74d201..4194118136 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -57,7 +57,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
index 59efd231dc..f559199a58 100644
--- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
@@ -57,7 +57,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 * [NOBELIUM Group](/stories/nobelium_group)
 
 
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index 50db93da97..238195e276 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -51,7 +51,7 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
 #### Associated Analytic Story
 * [Ransomware](/stories/ransomware)
 * [Suspicious WMI Use](/stories/suspicious_wmi_use)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 0d4a4a1324..9f589e136e 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -53,7 +53,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
index 47d36b400a..0e27b62f7b 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
@@ -51,7 +51,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index 071a365db9..b585ba940b 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -49,7 +49,7 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
index 9ad76f44fd..bbc7e7b397 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
@@ -47,7 +47,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-15-sdelete_application_execution.md b/docs/_posts/2021-11-15-sdelete_application_execution.md
index fb41e20dc2..9ba2baca55 100644
--- a/docs/_posts/2021-11-15-sdelete_application_execution.md
+++ b/docs/_posts/2021-11-15-sdelete_application_execution.md
@@ -71,6 +71,7 @@ To successfully implement this search you need to be ingesting information on pr
 * process
 * process_id
 * process_path
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -85,7 +86,7 @@ False positives should be limited, filter as needed.
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 42.0 | 60 | 70 | sdelete process $process_name$ executed on $dest$ attempting to permanently delete files. |
+| 42.0 | 60 | 70 | Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently delete files by $dest_user_id$. |
 
 
 
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index 99ed49b5b0..a0528ae02e 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -53,7 +53,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index 8cf1485a31..cc6954a6d2 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -51,7 +51,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index 64058d3c54..cf1e2b17a3 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -23,7 +23,7 @@ tags:
 
 #### Description
 
-The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly user by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network.
+The following analytic identifies executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents suspicious behavior as its commonly used by tools like like PsExec/PaExec and others to stage service binaries before creating and starting a Windows service on remote endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral movement and remote code execution. The Trickbot malware family also implements this behavior to try to infect other machines in the infected network.
 
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -52,7 +52,7 @@ The following analytic identifies executable files (.exe or .dll) being written
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 * [Trickbot](/stories/trickbot)
 
 
diff --git a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
index ead98f1603..1baffcbf08 100644
--- a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
+++ b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
@@ -51,7 +51,7 @@ powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerN
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-19-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2021-11-19-impacket_lateral_movement_commandline_parameters.md
index 1d53001c7e..822c336296 100644
--- a/docs/_posts/2021-11-19-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2021-11-19-impacket_lateral_movement_commandline_parameters.md
@@ -66,7 +66,7 @@ This analytic looks for the presence of suspicious commandline parameters typica
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 4317744ef1..49092854d7 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -25,7 +25,7 @@ tags:
 
 #### Description
 
-The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child processs of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
+The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of `services.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
 
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -55,7 +55,7 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 6a2b502972..8ed556304b 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -27,7 +27,7 @@ tags:
 
 #### Description
 
-The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned as a child processs of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
+The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned as a child process of `svchost.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of svchost.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
 
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -57,7 +57,7 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index 5496712e16..563114b12c 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -53,7 +53,7 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 
 #### Associated Analytic Story
 * [Clop Ransomware](/stories/clop_ransomware)
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index f42fea33f8..90991cd448 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -54,7 +54,7 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index 6c72ff16bb..c4002edec9 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -21,7 +21,7 @@ tags:
 
 #### Description
 
-The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
+The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of wmiprvse.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
 
 - **Type**: TTP
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -49,7 +49,7 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index 4ffcb8dd5e..5cd3b7f298 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -53,7 +53,7 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index a84578c9cb..e953768ec6 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -53,7 +53,7 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
diff --git a/docs/_posts/2021-11-30-attempt_to_delete_services.md b/docs/_posts/2021-11-24-attempt_to_delete_services.md
similarity index 84%
rename from docs/_posts/2021-11-30-attempt_to_delete_services.md
rename to docs/_posts/2021-11-24-attempt_to_delete_services.md
index ff3998ceee..475b5429c4 100644
--- a/docs/_posts/2021-11-30-attempt_to_delete_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_delete_services.md
@@ -1,14 +1,20 @@
 ---
 title: "Attempt To Delete Services"
-excerpt: "Service Stop"
+excerpt: "Service Stop, Create or Modify System Process, Windows Service"
 categories:
   - Endpoint
-last_modified_at: 2021-11-30
+last_modified_at: 2021-11-24
 toc: true
 toc_label: ""
 tags:
   - Service Stop
   - Impact
+  - Create or Modify System Process
+  - Persistence
+  - Privilege Escalation
+  - Windows Service
+  - Persistence
+  - Privilege Escalation
   - Splunk Behavioral Analytics
   - Endpoint_Processes
 ---
@@ -24,7 +30,7 @@ The following analytic identifies Windows Service Control, `sc.exe`, attempting
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-11-30
+- **Last Updated**: 2021-11-24
 - **Author**: Teoderick Contreras, splunk
 - **ID**: a0c8c292-d01a-11eb-aa18-acde48001122
 
@@ -35,6 +41,10 @@ The following analytic identifies Windows Service Control, `sc.exe`, attempting
 | ----------- | ----------- |--------------- |
 | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
 
+| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
 #### Search
 
 ```
@@ -52,7 +62,7 @@ The following analytic identifies Windows Service Control, `sc.exe`, attempting
 
 
 #### How To Implement
-To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 
 #### Required field
 * _time
@@ -85,6 +95,7 @@ It is possible administrative scripts may start/stop/delete services. Filter as
 #### Reference
 
 * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
 
 
 
diff --git a/docs/_posts/2021-11-30-attempt_to_disable_services.md b/docs/_posts/2021-11-24-attempt_to_disable_services.md
similarity index 96%
rename from docs/_posts/2021-11-30-attempt_to_disable_services.md
rename to docs/_posts/2021-11-24-attempt_to_disable_services.md
index d6ea7f6082..cf953425b9 100644
--- a/docs/_posts/2021-11-30-attempt_to_disable_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_disable_services.md
@@ -3,7 +3,7 @@ title: "Attempt To Disable Services"
 excerpt: "Service Stop"
 categories:
   - Endpoint
-last_modified_at: 2021-11-30
+last_modified_at: 2021-11-24
 toc: true
 toc_label: ""
 tags:
@@ -24,7 +24,7 @@ The following analytic identifies Windows Service Control, `sc.exe`, attempting
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-11-30
+- **Last Updated**: 2021-11-24
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: afb31de4-d023-11eb-98d5-acde48001122
 
@@ -53,7 +53,7 @@ The following analytic identifies Windows Service Control, `sc.exe`, attempting
 
 
 #### How To Implement
-To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 
 #### Required field
 * _time
diff --git a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
similarity index 72%
rename from docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md
rename to docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
index 13ac7807ab..6b6f3289cc 100644
--- a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -1,14 +1,16 @@
 ---
 title: "Attempted Credential Dump From Registry via Reg exe"
-excerpt: "OS Credential Dumping"
+excerpt: "OS Credential Dumping, Security Account Manager"
 categories:
   - Endpoint
-last_modified_at: 2020-6-04
+last_modified_at: 2021-11-29
 toc: true
 toc_label: ""
 tags:
   - OS Credential Dumping
   - Credential Access
+  - Security Account Manager
+  - Credential Access
   - Splunk Behavioral Analytics
   - Endpoint_Processes
 ---
@@ -19,12 +21,12 @@ tags:
 
 #### Description
 
-Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
+The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-6-04
+- **Last Updated**: 2021-11-29
 - **Author**: Jose Hernandez, Splunk
 - **ID**: 14038953-e5f2-4daf-acff-5452062baf03
 
@@ -35,6 +37,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
 | ----------- | ----------- |--------------- |
 | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
 
+| [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access |
+
 #### Search
 
 ```
@@ -53,7 +57,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
 
 
 #### How To Implement
-You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints.
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 
 #### Required field
 * process_name
@@ -61,6 +65,7 @@ You must be ingesting windows endpoint data that tracks process activity, includ
 * dest_device_id
 * dest_user_id
 * process
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -75,7 +80,7 @@ None identified.
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 63.0 | 70 | 90 | Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
+| 63.0 | 70 | 90 | An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$. |
 
 
 
@@ -83,6 +88,7 @@ None identified.
 #### Reference
 
 * [https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml](https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
 
 
 
@@ -93,4 +99,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
similarity index 89%
rename from docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md
rename to docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
index e5bcfaa68b..ea6ac693df 100644
--- a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
@@ -3,7 +3,7 @@ title: "Deny Permission using Cacls Utility"
 excerpt: "File and Directory Permissions Modification"
 categories:
   - Endpoint
-last_modified_at: 2021-06-14
+last_modified_at: 2021-11-29
 toc: true
 toc_label: ""
 tags:
@@ -19,12 +19,12 @@ tags:
 
 #### Description
 
-This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files.
+The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-06-14
+- **Last Updated**: 2021-11-29
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: b76eae28-cd25-11eb-9c92-acde48001122
 
@@ -61,6 +61,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 * process_path
 * dest_user_id
 * process
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -68,7 +69,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 
 
 #### Known False Positives
-network administrator may use this windows utility but this is not a common practice.
+System administrators may use cacls utilities but this is not a common practice. Filter as needed.
 
 
 #### RBA
@@ -94,4 +95,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/deny_permission_using_cacls_utility.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/deny_permission_using_cacls_utility.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
similarity index 70%
rename from docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md
rename to docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
index 76a31f1aa5..cb83d13749 100644
--- a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md
+++ b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
@@ -3,7 +3,7 @@ title: "Detect Dump LSASS Memory using comsvcs"
 excerpt: "NTDS, OS Credential Dumping"
 categories:
   - Endpoint
-last_modified_at: 2020-09-15
+last_modified_at: 2021-11-29
 toc: true
 toc_label: ""
 tags:
@@ -21,12 +21,12 @@ tags:
 
 #### Description
 
-This search detects the memory of lsass.exe being dumped for offline credential theft attack.
+The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2020-09-15
+- **Last Updated**: 2021-11-29
 - **Author**: Jose Hernandez, Splunk
 - **ID**: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
 
@@ -44,11 +44,9 @@ This search detects the memory of lsass.exe being dumped for offline credential
 ```
 
 | from read_ssa_enriched_events() 
-| where "Endpoint_Processes" IN(_datamodels) 
-| eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
 | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true 
-| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id) 
-| eval body=create_map(["event_id", event_id, "process_name", process_name, "process", process]) 
+| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, "process_name", process_name, "process", process]) 
 | into write_ssa_detected_events();
 ```
 
@@ -72,14 +70,14 @@ You must be ingesting endpoint data that tracks process activity, including Wind
 
 
 #### Known False Positives
-None identified.
+False positives should be limited, filter as needed.
 
 
 #### RBA
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 70.0 | 70 | 100 | Malicious actor is dumping encoded credentials via Microsoft&#39;s native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
+| 70.0 | 70 | 100 | A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$. |
 
 
 
@@ -87,6 +85,7 @@ None identified.
 #### Reference
 
 * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll)
 
 
 
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
new file mode 100644
index 0000000000..d3151bc6e0
--- /dev/null
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -0,0 +1,137 @@
+---
+title: "Possible Lateral Movement PowerShell Spawn"
+excerpt: "Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShell"
+categories:
+  - Endpoint
+last_modified_at: 2021-11-29
+toc: true
+toc_label: ""
+tags:
+  - Remote Services
+  - Lateral Movement
+  - Distributed Component Object Model
+  - Lateral Movement
+  - Windows Remote Management
+  - Lateral Movement
+  - Windows Management Instrumentation
+  - Execution
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Windows Service
+  - Persistence
+  - Privilege Escalation
+  - PowerShell
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
+
+- **Type**: TTP
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-11-29
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: cb909b3e-512b-11ec-aa31-3e22fbd008af
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+| [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
+
+| [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement |
+
+| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
+
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `possible_lateral_movement_powershell_spawn_filter`
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### Kill Chain Phase
+* Lateral Movement
+* Malicious PowerShell
+
+
+#### Known False Positives
+Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 45.0 | 90 | 50 | A PowerShell process was spawned as a child process of typically abused processes on $dest$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1021/003](https://attack.mitre.org/techniques/T1021/003)
+* [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/)
+* [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/)
+* [https://attack.mitre.org/techniques/T1053.005/](https://attack.mitre.org/techniques/T1053.005/)
+* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
new file mode 100644
index 0000000000..220322b755
--- /dev/null
+++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
@@ -0,0 +1,110 @@
+---
+title: "Randomly Generated Scheduled Task Name"
+excerpt: "Scheduled Task/Job, Scheduled Task"
+categories:
+  - Endpoint
+last_modified_at: 2021-11-29
+toc: true
+toc_label: ""
+tags:
+  - Scheduled Task/Job
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this, this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec, typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon &gt; 3` should be customized by users. The Command field can be used to determine if the task has malicious intent or not.
+
+- **Type**: Hunting
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-11-29
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 9d22a780-5165-11ec-ad4f-3e22fbd008af
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+#### Search
+
+```
+ `wineventlog_security` EventCode=4698 
+| xmlkv Message 
+| lookup ut_shannon_lookup word as Task_Name 
+| where ut_shannon > 3 
+| table  _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden 
+| `randomly_generated_scheduled_task_name_filter`
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required.
+
+#### Required field
+* _time
+* dest
+* Task_Name
+* Description
+* Command
+
+
+#### Kill Chain Phase
+* Privilege Escalation
+* Lateral Movement
+* Persistence
+
+
+#### Known False Positives
+Legitimate applications may use random Scheduled Task names.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 45.0 | 90 | 50 | A windows scheduled task with a suspicious task name was created on $dest$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
+* [https://splunkbase.splunk.com/app/2734/](https://splunkbase.splunk.com/app/2734/)
+* [https://en.wikipedia.org/wiki/Entropy_(information_theory)](https://en.wikipedia.org/wiki/Entropy_(information_theory))
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
new file mode 100644
index 0000000000..5979cf17df
--- /dev/null
+++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
@@ -0,0 +1,106 @@
+---
+title: "Randomly Generated Windows Service Name"
+excerpt: "Create or Modify System Process, Windows Service"
+categories:
+  - Endpoint
+last_modified_at: 2021-11-29
+toc: true
+toc_label: ""
+tags:
+  - Create or Modify System Process
+  - Persistence
+  - Privilege Escalation
+  - Windows Service
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this, this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application. Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket, typically create a Windows Service with a random service name on the victim host. This hunting analytic may help defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon &gt; 3` should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not.
+
+- **Type**: Hunting
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-11-29
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 2032a95a-5165-11ec-a2c3-3e22fbd008af
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation |
+
+| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |
+
+#### Search
+
+```
+ `wineventlog_system` EventCode=7045 
+| lookup ut_shannon_lookup word as Service_Name 
+| where ut_shannon > 3 
+| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name 
+| `randomly_generated_windows_service_name_filter` 
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. The Windows TA as well as the URL ToolBox application are also required.
+
+#### Required field
+* _time
+* EventCode
+* ComputerName
+* Service_File_Name
+* Service_Type
+* Service_Name
+* Service_Start_Type
+
+
+#### Kill Chain Phase
+* Privilege Escalation
+* Lateral Movement
+
+
+#### Known False Positives
+Legitimate applications may use random Windows Service names.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 45.0 | 90 | 50 | A Windows Service with a suspicious service name was installed on $ComputerName$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/randomly_generated_windows_service_name.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-11-30-delete_a_net_user.md b/docs/_posts/2021-11-30-delete_a_net_user.md
index a342b84c70..fb9fc83d25 100644
--- a/docs/_posts/2021-11-30-delete_a_net_user.md
+++ b/docs/_posts/2021-11-30-delete_a_net_user.md
@@ -41,7 +41,7 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
 
 | from read_ssa_enriched_events() 
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%") AND (process_name="net1.exe" OR process_name="net.exe") 
+| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") 
 | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
 | into write_ssa_detected_events();
 ```
@@ -52,7 +52,7 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
 
 
 #### How To Implement
-o successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
 
 #### Required field
 * _time
diff --git a/docs/_posts/2021-12-01-disable_net_user_account.md b/docs/_posts/2021-11-30-disable_net_user_account.md
similarity index 92%
rename from docs/_posts/2021-12-01-disable_net_user_account.md
rename to docs/_posts/2021-11-30-disable_net_user_account.md
index fdca976934..b2d4b530bb 100644
--- a/docs/_posts/2021-12-01-disable_net_user_account.md
+++ b/docs/_posts/2021-11-30-disable_net_user_account.md
@@ -1,14 +1,19 @@
 ---
 title: "Disable Net User Account"
-excerpt: "Service Stop"
+excerpt: "Service Stop, Valid Accounts"
 categories:
   - Endpoint
-last_modified_at: 2021-12-01
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
   - Service Stop
   - Impact
+  - Valid Accounts
+  - Defense Evasion
+  - Persistence
+  - Privilege Escalation
+  - Initial Access
   - Splunk Behavioral Analytics
   - Endpoint_Processes
 ---
@@ -24,7 +29,7 @@ This analytic will identify a suspicious command-line that disables a user accou
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-12-01
+- **Last Updated**: 2021-11-30
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: ba858b08-d26c-11eb-af9b-acde48001122
 
@@ -35,6 +40,8 @@ This analytic will identify a suspicious command-line that disables a user accou
 | ----------- | ----------- |--------------- |
 | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
 
+| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+
 #### Search
 
 ```
diff --git a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
similarity index 76%
rename from docs/_posts/2021-2-1-first_time_seen_command_line_argument.md
rename to docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
index 6084c9da04..c6aa349205 100644
--- a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
@@ -1,15 +1,14 @@
 ---
 title: "First time seen command line argument"
-excerpt: "Command and Scripting Interpreter, Regsvr32, Indirect Command Execution"
+excerpt: "Command and Scripting Interpreter, Indirect Command Execution"
 categories:
   - Endpoint
-last_modified_at: 2021-2-1
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
   - Command and Scripting Interpreter
   - Execution
-  - Regsvr32
   - Indirect Command Execution
   - Defense Evasion
   - Splunk Behavioral Analytics
@@ -22,12 +21,12 @@ tags:
 
 #### Description
 
-This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel.
+This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. &#39;The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it&#39;s been found on this endpoint.&#39;
 
 - **Type**: Anomaly
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-2-1
+- **Last Updated**: 2021-11-30
 - **Author**: Ignacio Bermudez Corrales, Splunk
 - **ID**: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
 
@@ -38,8 +37,6 @@ This search looks for command-line arguments that use a `/c` parameter to execut
 | ----------- | ----------- |--------------- |
 | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
 
-| [T1117](https://attack.mitre.org/techniques/T1117/) | Regsvr32 |  |
-
 | [T1202](https://attack.mitre.org/techniques/T1202/) | Indirect Command Execution | Defense Evasion |
 
 #### Search
@@ -64,7 +61,7 @@ This search looks for command-line arguments that use a `/c` parameter to execut
 
 
 #### How To Implement
-You must be populating the endpoint data model for SSA and specifically the process_name and the process fields
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 
 #### Required field
 * process_name
@@ -72,6 +69,7 @@ You must be populating the endpoint data model for SSA and specifically the proc
 * dest_device_id
 * dest_user_id
 * process
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -80,14 +78,14 @@ You must be populating the endpoint data model for SSA and specifically the proc
 
 
 #### Known False Positives
-Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name
+Legitimate programs use command-line arguments to execute. Verify the command-line arguments to check what command/program is being executed. Filtering will be needed.
 
 
 #### RBA
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 30.0 | 50 | 60 | A cmd process $process_name$ with commandline $cmd_line$ try to execute command has not previously seen in host $dest_device_id$ |
+| 30.0 | 50 | 60 | A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$ |
 
 
 
@@ -102,4 +100,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/first_time_seen_command_line_argument.yml) \| *version*: **3**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/first_time_seen_command_line_argument.yml) \| *version*: **4**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
similarity index 88%
rename from docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md
rename to docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
index 835a164590..db17a43182 100644
--- a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
@@ -3,7 +3,7 @@ title: "Grant Permission Using Cacls Utility"
 excerpt: "File and Directory Permissions Modification"
 categories:
   - Endpoint
-last_modified_at: 2021-06-14
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
@@ -19,12 +19,12 @@ tags:
 
 #### Description
 
-This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft, ransomware and coinminer scripts to evade detections and restrict access to their component files.
+The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-06-14
+- **Last Updated**: 2021-11-30
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: c6da561a-cd29-11eb-ae65-acde48001122
 
@@ -61,6 +61,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 * process_path
 * dest_user_id
 * process
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -68,7 +69,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 
 
 #### Known False Positives
-network administrator may use this windows utility but this is not a common practice.
+System administrators may use cacls utilities but this is not a common practice. Filter as needed.
 
 
 #### RBA
@@ -94,4 +95,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/grant_permission_using_cacls_utility.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/grant_permission_using_cacls_utility.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
similarity index 93%
rename from docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md
rename to docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
index b50d327eec..a3cbf9e808 100644
--- a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md
+++ b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
@@ -3,7 +3,7 @@ title: "Modify ACLs Permission Of Files Or Folders"
 excerpt: "File and Directory Permissions Modification"
 categories:
   - Endpoint
-last_modified_at: 2021-06-15
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
@@ -19,12 +19,12 @@ tags:
 
 #### Description
 
-This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so.
+This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior raises suspicion if this command is seen on an endpoint utilized by an account with no permission to do so.
 
 - **Type**: Anomaly
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-06-15
+- **Last Updated**: 2021-11-30
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 9ae9a48a-cdbe-11eb-875a-acde48001122
 
@@ -61,6 +61,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 * process_path
 * dest_user_id
 * process
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -68,7 +69,7 @@ To successfully implement this search, you need to be ingesting logs with the pr
 
 
 #### Known False Positives
-network administrator may use this windows utility. filter is needed.
+System administrators may use this windows utility. filter is needed.
 
 
 #### RBA
@@ -94,4 +95,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/modify_acls_permission_of_files_or_folders.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/modify_acls_permission_of_files_or_folders.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_at_the_destination_device.md b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
similarity index 85%
rename from docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
rename to docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
index b3dbae4547..45c68cc56e 100644
--- a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
+++ b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
@@ -3,7 +3,7 @@ title: "Potential Pass the Token or Hash Observed at the Destination Device"
 excerpt: "Use Alternate Authentication Material, Pass the Hash"
 categories:
   - Endpoint
-last_modified_at: 2021-11-05
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
@@ -23,12 +23,12 @@ tags:
 
 #### Description
 
-This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device.
+This detection identifies potential Pass the Token or Pass the Hash credential stealing. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
-- **Last Updated**: 2021-11-05
+- **Last Updated**: 2021-11-30
 - **Author**: Stanislav Miskovic, Splunk
 - **ID**: 82e76b80-5cdb-4899-9b43-85dbe777b36d
 
@@ -47,7 +47,7 @@ This detection identifies potential Pass the Token or Pass the Hash credential e
 
 | from read_ssa_enriched_events() 
 | where "Authentication" IN(_datamodels) 
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"), "string", null))
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
 | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos") AND dest_user_id != null AND dest_device_id != null
 
@@ -57,13 +57,13 @@ This detection identifies potential Pass the Token or Pass the Hash credential e
 
 | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50)  AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
-| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
+| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime, "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
 
 | into write_ssa_detected_events();
 ```
 
 #### Associated Analytic Story
-* [Lateral Movement](/stories/lateral_movement)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 
 
 #### How To Implement
@@ -98,6 +98,7 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc
 #### Reference
 
 * [https://attack.mitre.org/techniques/T1550/002/](https://attack.mitre.org/techniques/T1550/002/)
+* [https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/](https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/)
 
 
 
@@ -108,4 +109,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
similarity index 89%
rename from docs/_posts/2021-05-20-rare_parent-child_process_relationship.md
rename to docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
index a45910e86f..5b01c4cab5 100644
--- a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md
+++ b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
@@ -3,7 +3,7 @@ title: "Rare Parent-Child Process Relationship"
 excerpt: "Exploitation for Client Execution, Command and Scripting Interpreter, Scheduled Task/Job, Software Deployment Tools"
 categories:
   - Endpoint
-last_modified_at: 2021-05-20
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
@@ -28,12 +28,12 @@ tags:
 
 #### Description
 
-An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
+An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This analytic leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 
 - **Type**: Anomaly
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-05-20
+- **Last Updated**: 2021-11-30
 - **Author**: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 - **ID**: cf090c78-bcc6-11eb-8529-0242ac130003
 
@@ -82,6 +82,7 @@ Collect endpoint data such as sysmon or 4688 events.
 * _time
 * dest_device_id
 * dest_user_id
+* cmd_line
 
 
 #### Kill Chain Phase
@@ -89,8 +90,7 @@ Collect endpoint data such as sysmon or 4688 events.
 
 
 #### Known False Positives
-Some custom tools used by admins could be used rarely to launch remotely applications. This might trigger false positives at the beginning when it hasn&#39;t collected yet enough data to construct the baseline.
-
+Some custom tools used by administrators could be used rarely to launch remotely applications. This might trigger false positives at the beginning when it has not collected yet enough data to construct the baseline.
 
 
 
@@ -98,6 +98,9 @@ Some custom tools used by admins could be used rarely to launch remotely applica
 
 #### Reference
 
+* [https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries](https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries)
+
+
 
 #### Test Dataset
 Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
@@ -106,4 +109,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rare_parent-child_process_relationship.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rare_parent-child_process_relationship.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
similarity index 89%
rename from docs/_posts/2021-06-21-resize_shadowstorage_volume.md
rename to docs/_posts/2021-11-30-resize_shadowstorage_volume.md
index abce666679..486182f221 100644
--- a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
@@ -3,7 +3,7 @@ title: "Resize Shadowstorage Volume"
 excerpt: "Service Stop"
 categories:
   - Endpoint
-last_modified_at: 2021-06-21
+last_modified_at: 2021-11-30
 toc: true
 toc_label: ""
 tags:
@@ -19,12 +19,12 @@ tags:
 
 #### Description
 
-The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible
+The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage.
 
 - **Type**: TTP
 - **Product**: Splunk Behavioral Analytics
 - **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
-- **Last Updated**: 2021-06-21
+- **Last Updated**: 2021-11-30
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: dbc30554-d27e-11eb-9e5e-acde48001122
 
@@ -97,4 +97,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/resize_shadowstorage_volume.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/resize_shadowstorage_volume.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
new file mode 100644
index 0000000000..e5ad7cad7b
--- /dev/null
+++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
@@ -0,0 +1,107 @@
+---
+title: "Unusual Number of Computer Service Tickets Requested"
+excerpt: "Valid Accounts"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-01
+toc: true
+toc_label: ""
+tags:
+  - Valid Accounts
+  - Defense Evasion
+  - Persistence
+  - Privilege Escalation
+  - Initial Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of service requests. To customize this analytic, users can try different combinations of the `bucket` span time,  the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+- **Type**: Hunting
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-12-01
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: ac3b81c0-52f4-11ec-ac44-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+
+#### Search
+
+```
+ `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*" 
+| bucket span=2m _time 
+| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name 
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name 
+| eval upperBound=(comp_avg+comp_std*3) 
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) 
+| `unusual_number_of_computer_service_tickets_requested_filter`
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+
+#### Required field
+* _time
+* EventCode
+* Ticket_Options
+* Ticket_Encryption_Type
+* dest
+* service
+* service_id
+
+
+#### Kill Chain Phase
+* Reconnaissance
+* Exploitation
+* Lateral Movement
+
+
+#### Known False Positives
+An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 70 | 60 | None |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
new file mode 100644
index 0000000000..68d8b11af7
--- /dev/null
+++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
@@ -0,0 +1,106 @@
+---
+title: "Unusual Number of Remote Endpoint Authentication Events"
+excerpt: "Valid Accounts"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-01
+toc: true
+toc_label: ""
+tags:
+  - Valid Accounts
+  - Defense Evasion
+  - Persistence
+  - Privilege Escalation
+  - Initial Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate or build datasets for it, use at your own risk!
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this analytic, users can try different combinations of the `bucket` span time,  the calculation of the `upperBound` field as well as the Outlier calculation. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+- **Type**: Hunting
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2021-12-01
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: acb5dc74-5324-11ec-a36d-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
+
+#### Search
+
+```
+ `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" 
+| eval Source_Account = mvindex(Account_Name, 1) 
+| bucket span=2m _time 
+| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account 
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account 
+| eval upperBound=(comp_avg+comp_std*3) 
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) `unusual_number_of_remote_endpoint_authentication_events_filter`
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+
+#### Required field
+* _time
+* EventCode
+* Logon_Type
+* Caller_Process_Name
+* Security_ID
+* Account_Name
+* ComputerName
+
+
+#### Kill Chain Phase
+* Reconnaissance
+* Lateral Movement
+
+
+#### Known False Positives
+An single endpoint authenticating to a large number of hosts is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 70 | 60 | None |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
new file mode 100644
index 0000000000..ebd83b1027
--- /dev/null
+++ b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
@@ -0,0 +1,104 @@
+---
+title: "Detect RClone Command-Line Usage"
+excerpt: "Automated Exfiltration"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-03
+toc: true
+toc_label: ""
+tags:
+  - Automated Exfiltration
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-03
+- **Author**: Michael Haag, Splunk
+- **ID**: e8b74268-5454-11ec-a799-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| where "Endpoint_Processes" IN(_datamodels) 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%") OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) 
+| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Exfiltration
+
+
+#### Known False Positives
+False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service to move files or folders. |
+
+
+
+
+#### Reference
+
+* [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/)
+* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/)
+* [https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/](https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rclone_command-line_usage.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
new file mode 100644
index 0000000000..63f17f0416
--- /dev/null
+++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
@@ -0,0 +1,102 @@
+---
+title: "Short Lived Scheduled Task"
+excerpt: "Scheduled Task"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-03
+toc: true
+toc_label: ""
+tags:
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic leverages Windows Security EventCode 4698, `A scheduled task was created` and Windows Security EventCode 4699, `A scheduled task was deleted` to identify scheduled tasks created and deleted in less than 30 seconds. This behavior may represent a lateral movement attack abusing the Task Scheduler to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution.
+
+- **Type**: TTP
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: 
+- **Last Updated**: 2021-12-03
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 6fa31414-546e-11ec-adfa-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+#### Search
+
+```
+ `wineventlog_security` EventCode=4698 OR EventCode=4699 
+| xmlkv Message 
+| transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) 
+| eval short_lived=case((duration<30),"TRUE") 
+| search  short_lived = TRUE 
+| table _time, ComputerName, Account_Name, Command, Task_Name, short_lived 
+| `short_lived_scheduled_task_filter` 
+```
+
+#### Associated Analytic Story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
+
+#### Required field
+* _time
+* dest
+* ComputerName
+* Account_Name
+* Task_Name
+* Description
+* Command
+
+
+#### Kill Chain Phase
+* Lateral Movement
+
+
+#### Known False Positives
+Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ |
+
+
+
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/)
+* [https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/short_lived_scheduled_task.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
new file mode 100644
index 0000000000..38035003f0
--- /dev/null
+++ b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
@@ -0,0 +1,108 @@
+---
+title: "Windows Curl Upload to Remote Destination"
+excerpt: "Ingress Tool Transfer"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-03
+toc: true
+toc_label: ""
+tags:
+  - Ingress Tool Transfer
+  - Command And Control
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \
+`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
+`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
+HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
+Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-03
+- **Author**: Michael Haag, Splunk
+- **ID**: cc8d046a-543b-11ec-b864-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| where "Endpoint_Processes" IN(_datamodels) 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
+
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) 
+| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Exfiltration
+
+
+#### Known False Positives
+False positives may be limited to source control applications and may be required to be filtered out.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination. |
+
+
+
+
+#### Reference
+
+* [https://everything.curl.dev/usingcurl/uploads](https://everything.curl.dev/usingcurl/uploads)
+* [https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409](https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409)
+* [https://twitter.com/d1r4c/status/1279042657508081664?s=20](https://twitter.com/d1r4c/status/1279042657508081664?s=20)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
new file mode 100644
index 0000000000..cfca2f917e
--- /dev/null
+++ b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
@@ -0,0 +1,99 @@
+---
+title: "BCDEdit Failure Recovery Modification"
+excerpt: "Inhibit System Recovery"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-07
+toc: true
+toc_label: ""
+tags:
+  - Inhibit System Recovery
+  - Impact
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-07
+- **Author**: Michael Haag, Splunk
+- **ID**: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Actions on Objectives
+
+
+#### Known False Positives
+Administrators may modify the boot configuration.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 100 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the endpoint. |
+
+
+
+
+#### Reference
+
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/bcdedit_failure_recovery_modification.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
new file mode 100644
index 0000000000..98a2b60fac
--- /dev/null
+++ b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
@@ -0,0 +1,105 @@
+---
+title: "DNS Exfiltration Using Nslookup App"
+excerpt: "Exfiltration Over Alternative Protocol"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-07
+toc: true
+toc_label: ""
+tags:
+  - Exfiltration Over Alternative Protocol
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-07
+- **Author**: Michael Haag, Splunk
+- **ID**: 2452e632-9e0d-11eb-34ba-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| where "Endpoint_Processes" IN(_datamodels) 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) 
+| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Dynamic DNS](/stories/dynamic_dns)
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 72.0 | 90 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration. |
+
+
+
+
+#### Reference
+
+* [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html)
+* [https://www.varonis.com/blog/dns-tunneling/](https://www.varonis.com/blog/dns-tunneling/)
+* [https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/dns_exfiltration_using_nslookup_app.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-07-fsutil_zeroing_file.md b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
new file mode 100644
index 0000000000..c0205bfdcb
--- /dev/null
+++ b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
@@ -0,0 +1,98 @@
+---
+title: "Fsutil Zeroing File"
+excerpt: "Indicator Removal on Host"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-07
+toc: true
+toc_label: ""
+tags:
+  - Indicator Removal on Host
+  - Defense Evasion
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-07
+- **Author**: Michael Haag, Splunk
+- **ID**: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND (like (cmd_line, "%setzerodata%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Ransomware](/stories/ransomware)
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+System administrators or scripts may delete user accounts via this technique. Filter as needed.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 54.0 | 60 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion. |
+
+
+
+
+#### Reference
+
+* [https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/](https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/)
+* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/fsutil_zeroing_file.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
new file mode 100644
index 0000000000..a1fa6e4f40
--- /dev/null
+++ b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
@@ -0,0 +1,101 @@
+---
+title: "WBAdmin Delete System Backups"
+excerpt: "Inhibit System Recovery"
+categories:
+  - Endpoint
+last_modified_at: 2021-12-07
+toc: true
+toc_label: ""
+tags:
+  - Inhibit System Recovery
+  - Impact
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery.
+
+- **Type**: TTP
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2021-12-07
+- **Author**: Michael Haag, Splunk
+- **ID**: 71efbf52-4dbb-4c00-a520-306aa546cbb7
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- |--------------- |
+| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%") 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Associated Analytic Story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+#### Known False Positives
+Administrators may modify the boot configuration.
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups. |
+
+
+
+
+#### Reference
+
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md)
+* [https://thedfirreport.com/2020/10/08/ryuks-return/](https://thedfirreport.com/2020/10/08/ryuks-return/)
+* [https://attack.mitre.org/techniques/T1490/](https://attack.mitre.org/techniques/T1490/)
+* [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wbadmin_delete_system_backups.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/active_directory_lateral_movement.md b/docs/_stories/active_directory_lateral_movement.md
new file mode 100644
index 0000000000..14d00cc808
--- /dev/null
+++ b/docs/_stories/active_directory_lateral_movement.md
@@ -0,0 +1,84 @@
+---
+title: "Active Directory Lateral Movement"
+last_modified_at: 2021-12-09
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Authentication
+  - Endpoint
+  - Network_Traffic
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication), [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Last Updated**: 2021-12-09
+- **Author**: David Dorsey, Mauricio Velazco Splunk
+- **ID**: 399d65dc-1f08-499b-a259-aad9051f38ad
+
+#### Narrative
+
+Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
+Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
+An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders.\
+If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. \
+ It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software.
+
+#### Detections
+
+| Name        | Technique   | Type         |
+| ----------- | ----------- |--------------|
+| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
+| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
+| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting |
+| [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
+| [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service) | TTP |
+| [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | TTP |
+| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
+| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP |
+| [Randomly Generated Scheduled Task Name](/endpoint/randomly_generated_scheduled_task_name/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | Hunting |
+| [Randomly Generated Windows Service Name](/endpoint/randomly_generated_windows_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | Hunting |
+| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly |
+| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Hunting |
+| [Remote Process Instantiation via DCOM and PowerShell](/endpoint/remote_process_instantiation_via_dcom_and_powershell/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP |
+| [Remote Process Instantiation via DCOM and PowerShell Script Block](/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP |
+| [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
+| [Remote Process Instantiation via WMI and PowerShell](/endpoint/remote_process_instantiation_via_wmi_and_powershell/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
+| [Remote Process Instantiation via WMI and PowerShell Script Block](/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
+| [Remote Process Instantiation via WinRM and PowerShell](/endpoint/remote_process_instantiation_via_winrm_and_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
+| [Remote Process Instantiation via WinRM and PowerShell Script Block](/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
+| [Remote Process Instantiation via WinRM and Winrs](/endpoint/remote_process_instantiation_via_winrm_and_winrs/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
+| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)) | TTP |
+| [Scheduled Task Initiation on Remote Endpoint](/endpoint/scheduled_task_initiation_on_remote_endpoint/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | TTP |
+| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
+| [Services LOLBAS Execution Process Spawn](/endpoint/services_lolbas_execution_process_spawn/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Short Lived Scheduled Task](/endpoint/short_lived_scheduled_task/) | [Scheduled Task](/tags/#scheduled-task) | TTP |
+| [Svchost LOLBAS Execution Process Spawn](/endpoint/svchost_lolbas_execution_process_spawn/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | TTP |
+| [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [Unusual Number of Remote Endpoint Authentication Events](/endpoint/unusual_number_of_remote_endpoint_authentication_events/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
+| [Windows Service Created With Suspicious Service Path](/endpoint/windows_service_created_with_suspicious_service_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP |
+| [Windows Service Created Within Public Path](/endpoint/windows_service_created_within_public_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Wmiprsve LOLBAS Execution Process Spawn](/endpoint/wmiprsve_lolbas_execution_process_spawn/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
+| [Wsmprovhost LOLBAS Execution Process Spawn](/endpoint/wsmprovhost_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
+
+#### Reference
+
+* [https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html](https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html)
+* [http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco](http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/active_directory_lateral_movement.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_stories/command_and_control.md b/docs/_stories/command_and_control.md
index 1a8da8e6b8..69411e5d8c 100644
--- a/docs/_stories/command_and_control.md
+++ b/docs/_stories/command_and_control.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Resolution
   - Network_Traffic
 ---
@@ -19,7 +20,7 @@ tags:
 Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
 - **Last Updated**: 2018-06-01
 - **Author**: Rico Valdez, Splunk
 - **ID**: 943773c6-c4de-4f38-89a8-0b92f98804d8
@@ -34,6 +35,7 @@ Because this communication is so critical for an adversary, they often use techn
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
+| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly |
 | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
 | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP |
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index a1b4611e43..1bae69e6b5 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -35,27 +35,14 @@ The detection searches in this Analytic Story monitor access to the Local Securi
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
-| [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
-| [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP |
-| [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
diff --git a/docs/_stories/darkside_ransomware.md b/docs/_stories/darkside_ransomware.md
index 95ab2cb837..f57b0c89ec 100644
--- a/docs/_stories/darkside_ransomware.md
+++ b/docs/_stories/darkside_ransomware.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2021-05-12
 - **Author**: Bhavin Patel, Splunk
 - **ID**: 507edc74-13d5-4339-878e-b9114ded1f35
@@ -40,6 +41,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
 | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
+| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
 | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting |
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting |
 | [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
diff --git a/docs/_stories/data_exfiltration.md b/docs/_stories/data_exfiltration.md
index 0625e110f5..ec71ecb49a 100644
--- a/docs/_stories/data_exfiltration.md
+++ b/docs/_stories/data_exfiltration.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
 ---
 
@@ -18,7 +19,7 @@ tags:
 The stealing of data by an adversary.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
 - **Last Updated**: 2020-10-21
 - **Author**: Shannon Davis, Splunk
 - **ID**: 66b0fe0c-1351-11eb-adc1-0242ac120002
@@ -32,6 +33,7 @@ Exfiltration comes in many flavors.  Adversaries can collect data over encrypted
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
+| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | TTP |
 | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP |
 | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
diff --git a/docs/_stories/dynamic_dns.md b/docs/_stories/dynamic_dns.md
index 7b06511608..fcd1b96af5 100644
--- a/docs/_stories/dynamic_dns.md
+++ b/docs/_stories/dynamic_dns.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Resolution
 ---
 
@@ -18,7 +19,7 @@ tags:
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
 - **Last Updated**: 2018-09-06
 - **Author**: Bhavin Patel, Splunk
 - **ID**: 8169f17b-ef68-4b59-aae8-586907301221
@@ -32,6 +33,7 @@ Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
+| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP |
 | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
 
diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md
index 39e7418f00..6ce31ca540 100644
--- a/docs/_stories/ingress_tool_transfer.md
+++ b/docs/_stories/ingress_tool_transfer.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2021-03-24
 - **Author**: Michael Haag, Splunk
 - **ID**: b3782036-8cbd-11eb-9d8e-acde48001122
@@ -38,6 +39,7 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors
 | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 
 #### Reference
 
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index f4ca0073c3..0b0cea91f4 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -8,7 +8,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
-  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -18,7 +17,7 @@ tags:
 Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
 - **Last Updated**: 2017-08-23
 - **Author**: David Dorsey, Splunk
 - **ID**: 2c8ff66e-0b57-42af-8ad7-912438a403fc
@@ -44,18 +43,12 @@ Most recently we have added new content related to PowerShell Script Block loggi
 | ----------- | ----------- |--------------|
 | [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
-| [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP |
-| [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP |
 | [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting |
 | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting |
 | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | TTP |
 | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting |
 | [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md
index ef54043c0a..8f1d66b5d3 100644
--- a/docs/_stories/ransomware.md
+++ b/docs/_stories/ransomware.md
@@ -36,9 +36,10 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
 | [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
 | [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting |
@@ -48,6 +49,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
 | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
+| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting |
 | [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP |
 | [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP |
@@ -55,13 +57,14 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
 | [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
-| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop), [Valid Accounts](/tags/#valid-accounts) | TTP |
 | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | Anomaly |
 | [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly |
 | [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly |
 | [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic) | TTP |
 | [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
+| [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP |
@@ -95,6 +98,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
 | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) |  | Anomaly |
 | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) |  | Anomaly |
 | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
 | [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
 | [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
diff --git a/docs/_stories/ryuk_ransomware.md b/docs/_stories/ryuk_ransomware.md
index eda620fe81..ac8145245f 100644
--- a/docs/_stories/ryuk_ransomware.md
+++ b/docs/_stories/ryuk_ransomware.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
 ---
 
@@ -18,7 +19,7 @@ tags:
 Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
 - **Last Updated**: 2020-11-06
 - **Author**: Jose Hernandez, Splunk
 - **ID**: 507edc74-13d5-4339-878e-b9744ded1f35
@@ -32,6 +33,7 @@ Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) o
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting |
 | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting |
 | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP |
@@ -42,6 +44,7 @@ Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) o
 | [Spike in File Writes](/endpoint/spike_in_file_writes/) |  | Anomaly |
 | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
+| [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
diff --git a/docs/_stories/suspicious_dns_traffic.md b/docs/_stories/suspicious_dns_traffic.md
index 01df9d4326..225237c3c9 100644
--- a/docs/_stories/suspicious_dns_traffic.md
+++ b/docs/_stories/suspicious_dns_traffic.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Resolution
 ---
 
@@ -18,7 +19,7 @@ tags:
 Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
 - **Last Updated**: 2017-09-18
 - **Author**: Rico Valdez, Splunk
 - **ID**: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56
@@ -32,6 +33,7 @@ Although DNS is one of the fundamental underlying protocols that make the Intern
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
+| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP |
 | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly |
 | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly |
 | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP |
diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md
index 8aa471f5c3..ad289fd919 100644
--- a/docs/_stories/unusual_processes.md
+++ b/docs/_stories/unusual_processes.md
@@ -34,14 +34,9 @@ In the event an unusual process is identified, it is imperative to better unders
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Detect Rare Executables](/endpoint/detect_rare_executables/) |  | Anomaly |
 | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | TTP |
-| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
+| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
 | [More than usual number of LOLBAS applications in short time period](/endpoint/more_than_usual_number_of_lolbas_applications_in_short_time_period/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly |
 | [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
diff --git a/docs/_stories/windows_discovery_techniques.md b/docs/_stories/windows_discovery_techniques.md
index 56c035fb1d..bad982e627 100644
--- a/docs/_stories/windows_discovery_techniques.md
+++ b/docs/_stories/windows_discovery_techniques.md
@@ -8,7 +8,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  - Endpoint_Processes
+  - Endpoint
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -18,7 +18,7 @@ tags:
 Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.
 
 - **Product**: Splunk Behavioral Analytics, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
 - **Last Updated**: 2021-03-04
 - **Author**: Michael Hart, Splunk
 - **ID**: f7aba570-7d59-11eb-825e-acde48001122
@@ -31,21 +31,7 @@ Attackers may not have much if any insight into their target's environment befor
 
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Reconnaissance and Access to Accounts and Groups via Mimikatz modules](/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP |
-| [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
-| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software](/tags/#software), [Network Service Scanning](/tags/#network-service-scanning), [Query Registry](/tags/#query-registry), [System Service Discovery](/tags/#system-service-discovery), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Software Discovery](/tags/#software-discovery) | TTP |
-| [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | TTP |
-| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
-| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
-| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Account Manipulation](/tags/#account-manipulation), [Domain Properties](/tags/#domain-properties), [Valid Accounts](/tags/#valid-accounts), [Credentials](/tags/#credentials), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Network Trust Dependencies](/tags/#network-trust-dependencies) | TTP |
-| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Software](/tags/#software), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
+| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting |
 
 #### Reference
 
diff --git a/docs/_stories/windows_log_manipulation.md b/docs/_stories/windows_log_manipulation.md
index 7c892f1278..07b1bc8d8b 100644
--- a/docs/_stories/windows_log_manipulation.md
+++ b/docs/_stories/windows_log_manipulation.md
@@ -33,7 +33,6 @@ The Analytic Story gives users two different ways to detect manipulation of Wind
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
-| [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP |
 | [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md
index e481599407..2ac45b788a 100644
--- a/docs/_stories/windows_persistence_techniques.md
+++ b/docs/_stories/windows_persistence_techniques.md
@@ -8,7 +8,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
-  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -18,7 +17,7 @@ tags:
 Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
 - **Last Updated**: 2018-05-31
 - **Author**: Bhavin Patel, Splunk
 - **ID**: 30874d4f-20a1-488f-85ec-5d52ef74e3f9
@@ -37,11 +36,6 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
-| [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP |
-| [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Illegal Management of Active Directory Elements and Policies via DSInternals modules](/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Illegal Management of Computers and Active Directory Elements via PowerSploit modules](/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP |
-| [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -53,9 +47,6 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP |
-| [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
-| [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
 | [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
diff --git a/docs/_stories/windows_privilege_escalation.md b/docs/_stories/windows_privilege_escalation.md
index d1d3a40b8d..1cd79462b7 100644
--- a/docs/_stories/windows_privilege_escalation.md
+++ b/docs/_stories/windows_privilege_escalation.md
@@ -8,7 +8,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
-  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -18,7 +17,7 @@ tags:
 Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
 - **Last Updated**: 2020-02-04
 - **Author**: David Dorsey, Splunk
 - **ID**: 644e22d3-598a-429c-a007-16fdb802cae5
@@ -35,12 +34,10 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain
 | [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features) | TTP |
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
-| [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP |
 | [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft) | Hunting |
 | [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP |
diff --git a/docs/_stories/windows_service_abuse.md b/docs/_stories/windows_service_abuse.md
index 751b73cacf..74d1a37807 100644
--- a/docs/_stories/windows_service_abuse.md
+++ b/docs/_stories/windows_service_abuse.md
@@ -8,7 +8,6 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
-  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -18,7 +17,7 @@ tags:
 Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
 - **Last Updated**: 2017-11-02
 - **Author**: Rico Valdez, Splunk
 - **ID**: 6dbd810e-f66d-414b-8dfc-e46de55cbfe2
@@ -32,8 +31,6 @@ The Windows operating system uses a services architecture to allow for running c
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly |
-| [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP |
-| [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP |
 | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP |
 
diff --git a/docs/_stories/xmrig.md b/docs/_stories/xmrig.md
index 0e4c24f7e0..731b48a0d3 100644
--- a/docs/_stories/xmrig.md
+++ b/docs/_stories/xmrig.md
@@ -32,12 +32,12 @@ XMRig is a high performance, open source, cross platform RandomX, KawPow, Crypto
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP |
-| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Delete A Net User](/endpoint/delete_a_net_user/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly |
 | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
 | [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
-| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP |
+| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop), [Valid Accounts](/tags/#valid-accounts) | TTP |
 | [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
 | [Download Files Using Telegram](/endpoint/download_files_using_telegram/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
diff --git a/docs/assets/css/main.scss b/docs/assets/css/main.scss
index 23346e773b..98579fbbfb 100644
--- a/docs/assets/css/main.scss
+++ b/docs/assets/css/main.scss
@@ -5,4 +5,37 @@
 @charset "utf-8";
 
 @import "minimal-mistakes/skins/{{ site.minimal_mistakes_skin | default: 'default' }}"; // skin
-@import "minimal-mistakes"; // main partials
\ No newline at end of file
+@import "minimal-mistakes"; // main partials
+
+
+body {
+  word-wrap: break-word;
+  overflow-wrap: break-word;
+}
+
+code,
+samp {
+  white-space: pre-wrap;
+}
+
+p > code,
+li > code,
+samp {
+  border-radius: .25em;
+  margin: 0 -.03125em;
+  padding: .0625em .25em 0; /* breathing room for inline code that has a different background or an outline */
+}
+
+article {
+  margin: 1em;
+}
+
+.highlight {
+  margin: 1em -1em; /* -1em left/right margins for full-bleed code samples */
+  padding: 1em;
+}
+
+.code-header {
+  display: flex;
+  justify-content: flex-end;
+}
diff --git a/docs/index.markdown b/docs/index.markdown
index 3dc35d1d6b..d8078ad4b6 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -9,12 +9,12 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **714** detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **684** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
     title: "Detections"
-    excerpt: "See all **714** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **684** Splunk Analytics built to find evil 😈."
     url: "/detections"
     btn_class: "btn--primary"
     btn_label: "Explore"
@@ -28,7 +28,7 @@ feature_row:
   - image_path: /static/feature_playbooks.png
     alt: "100% free"
     title: "Playbooks"
-    excerpt: "See all **11** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **14** sets of steps 🐾 to automatically response to a threat."
     url: "/playbooks"
     btn_class: "btn--primary"
     btn_label: "Explore"
diff --git a/playbooks/activedirectory_reset_password.json b/playbooks/activedirectory_reset_password.json
new file mode 100644
index 0000000000..2a5f022a36
--- /dev/null
+++ b/playbooks/activedirectory_reset_password.json
@@ -0,0 +1,2329 @@
+{
+    "blockly": false,
+    "blockly_xml": "<xml></xml>",
+    "category": "Use Cases",
+    "coa": {
+        "data": {
+            "clean": true,
+            "code_block": "from random import randint\nfrom random import shuffle",
+            "description": "This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.",
+            "joint": {
+                "cells": [
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "27ea0953-b4ce-4902-8ece-63e24eae1d1e",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "23da15dd-a900-4675-80fc-8278f452b007",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "3ba40b74-3829-4cf7-8a11-6df171d3f874",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 14
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "6dd2b606-b2ce-4ffb-8131-c0acc1a1ffe0",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "3ba40b74-3829-4cf7-8a11-6df171d3f874",
+                            "port": "out-1",
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "7cecdc7c-0289-4151-be2f-87a24bd0b1da",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 16
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "197ac0dd-c42a-43a2-a97c-8ee3120d9a6f",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "7cecdc7c-0289-4151-be2f-87a24bd0b1da",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "398259e5-8720-484b-a46b-ebe664b02687",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 17
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "c11890e9-62ac-43d6-9cef-8f2ed68f88b2",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "398259e5-8720-484b-a46b-ebe664b02687",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "fb2817ec-55f2-4baf-a578-4ea49fdae81a",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 19
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "f1b0583c-1735-4c91-a6af-146682766127",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "7cecdc7c-0289-4151-be2f-87a24bd0b1da",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "5210febc-fbbb-4879-b338-c8f349c0a9c0",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 22
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "10428cae-be4e-46dc-99c8-88724df2b0e9",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "5210febc-fbbb-4879-b338-c8f349c0a9c0",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "10cc4157-7f8e-4dc0-91eb-22e60ff84c02",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 24
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "54d586c2-b91a-47ca-8638-ae343466c5d2",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "10cc4157-7f8e-4dc0-91eb-22e60ff84c02",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "fb2817ec-55f2-4baf-a578-4ea49fdae81a",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 25
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "84ef3f58-73e1-47b9-b331-04926d73c00e",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "3ba40b74-3829-4cf7-8a11-6df171d3f874",
+                            "port": "out-2",
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "456dd1f4-e8be-4f08-93e4-53340f34c3f5",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 27
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "dceb1651-6554-4b0a-90a5-366e0dae1c79",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "456dd1f4-e8be-4f08-93e4-53340f34c3f5",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "bf0b85aa-0086-4b5d-a690-281f55555dd3",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 29
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "760bf213-d7a5-41e9-a385-e8927d27fc93",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "bf0b85aa-0086-4b5d-a690-281f55555dd3",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "fb2817ec-55f2-4baf-a578-4ea49fdae81a",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 31
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "20b16b2c-253c-41e7-8a12-9d4f83285c17",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "83d4f311-84e7-42df-bca6-0fcb9ba484d7",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "23da15dd-a900-4675-80fc-8278f452b007",
+                            "port": null,
+                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 58
+                    },
+                    {
+                        "0": "S",
+                        "1": "T",
+                        "2": "A",
+                        "3": "R",
+                        "4": "T",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "ref-x": 33,
+                                "ref-y": 8,
+                                "text": "START"
+                            },
+                            "g.code image": {
+                                "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "ref-x": 13,
+                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'decision_2' block\n    decision_2(container=container)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "def on_start(container):\n    phantom.debug('on_start() called')\n\n    reset_password(container=container)\n\n    return",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": true,
+                        "has_custom_block": true,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "83d4f311-84e7-42df-bca6-0fcb9ba484d7",
+                        "inPorts": [],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 24,
+                        "line_start": 17,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 1,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 80,
+                            "y": 100
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "START",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 120
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 1
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def reset_option(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('reset_option() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"reset_password:action_result.summary.responses.0\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        generate_password(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    format_decline_msg(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "reset option",
+                        "description": "",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "3ba40b74-3829-4cf7-8a11-6df171d3f874",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 113,
+                        "line_start": 92,
+                        "name": "decision",
+                        "notes": "Follow direction of the prompt for resetting the user's password\n\nGREEN: Proceed with reset\nPURPLE: Proceed to end (with notes)",
+                        "number": 1,
+                        "order": 4,
+                        "outPorts": [
+                            "out-1",
+                            "out-2"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "reset_password:action_result.summary.responses.0",
+                                        "value": "Yes"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 380,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "reset_option",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 122
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format decline msg"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_decline_msg(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_decline_msg() called')\n    \n    template = \"\"\"Analyst declined to reset password for user: {0}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.compromisedUserName\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_decline_msg\")\n\n    add_comment_no_reset(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format decline msg",
+                        "description": "Formats a message stating the user declined to reset the password",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "456dd1f4-e8be-4f08-93e4-53340f34c3f5",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 189,
+                        "line_start": 173,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Formats a message stating the user declined to reset the password",
+                        "number": 2,
+                        "order": 8,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "artifact:*.cef.compromisedUserName"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 520,
+                            "y": 220
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_decline_msg",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "Analyst declined to reset password for user: {0}",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 127
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "add comment no reset"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def add_comment_no_reset(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('add_comment_no_reset() called')\n\n    formatted_data_1 = phantom.get_format_data(name='format_decline_msg')\n\n    phantom.comment(container=container, comment=formatted_data_1)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "format_decline_msg:formatted_data",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "add comment no reset",
+                        "description": "Add the comment notifying the reader that the password reset was declined",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "bf0b85aa-0086-4b5d-a690-281f55555dd3",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 201,
+                        "line_start": 192,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "Add the comment notifying the reader that the password reset was declined",
+                        "number": 3,
+                        "order": 9,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1000,
+                            "y": 220
+                        },
+                        "previous_function": "",
+                        "previous_name": "add_comment_no_reset",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 130
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format pwd message"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_pwd_message(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_pwd_message() called')\n    \n    template = \"\"\"Reset user {0} password to {1}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.compromisedUserName\",\n        \"generate_password:custom_function:strong_password\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_pwd_message\")\n\n    add_comment_pwd_reset(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format pwd message",
+                        "description": "Formats a message about the password reset to provide in the comments",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "5210febc-fbbb-4879-b338-c8f349c0a9c0",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 170,
+                        "line_start": 153,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Formats a message about the password reset to provide in the comments",
+                        "number": 1,
+                        "order": 7,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "artifact:*.cef.compromisedUserName"
+                            },
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "generate_password:custom_function:strong_password"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 760,
+                            "y": -60
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_pwd_message",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "Reset user {0} password to {1}",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 132
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "add comment pwd reset"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def add_comment_pwd_reset(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('add_comment_pwd_reset() called')\n\n    formatted_data_1 = phantom.get_format_data(name='format_pwd_message')\n\n    phantom.comment(container=container, comment=formatted_data_1)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "format_pwd_message:formatted_data",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "add comment pwd reset",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "10cc4157-7f8e-4dc0-91eb-22e60ff84c02",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 150,
+                        "line_start": 141,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "This block adds a comment to the Activities pane stating which user had their password reset and the new password",
+                        "number": 2,
+                        "order": 6,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1000,
+                            "y": -60
+                        },
+                        "previous_function": "",
+                        "previous_name": "add_comment_pwd_reset",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 135
+                    },
+                    {
+                        "0": "E",
+                        "1": "N",
+                        "2": "D",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".title": {
+                                "text": "END"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "reset ad password, reset password, reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "fb2817ec-55f2-4baf-a578-4ea49fdae81a",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 214,
+                        "line_start": 201,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 10,
+                        "outPorts": [],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1240,
+                            "y": 180
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "END",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 137
+                    },
+                    {
+                        "action": "set password",
+                        "action_type": "contain",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "new_password": "generate_password:custom_function:strong_password",
+                            "username": "artifact:*.cef.compromisedUserName"
+                        },
+                        "angle": 0,
+                        "app": "",
+                        "appid": "",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "set password",
+                                "actions": [
+                                    "run query",
+                                    "list users",
+                                    "get system info",
+                                    "list services",
+                                    "get users",
+                                    "reset password",
+                                    "set password",
+                                    "get system attributes",
+                                    "get user attributes",
+                                    "set system attribute",
+                                    "change system ou",
+                                    "list user groups",
+                                    "enable user",
+                                    "disable user",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "LDAP",
+                                "app_version": "1.2.40",
+                                "appid": "84110F27-6602-4DC8-A6F2-0311B1720BF8",
+                                "asset_name": "active directory",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "new_password": "generate_password:custom_function:strong_password",
+                                    "username": "artifact:*.cef.compromisedUserName"
+                                },
+                                "has_app": true,
+                                "id": 22,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "active directory",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.new_password",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "abc@123"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Username",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "user name",
+                                            "ldap distinguished name"
+                                        ],
+                                        "data_path": "action_result.parameter.username",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test_user3"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.summary",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "column_name": "Message",
+                                        "column_order": 1,
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "User password changed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "new_password": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Password string to set",
+                                        "key": "new_password",
+                                        "order": 1,
+                                        "required": true
+                                    },
+                                    "username": {
+                                        "contains": [
+                                            "user name",
+                                            "ldap distinguished name"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Username to change password of",
+                                        "key": "username",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "Windows Server",
+                                "product_vendor": "Microsoft",
+                                "targets": "22",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "reset ad password"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Contain"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def reset_ad_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('reset_ad_password() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    generate_password__strong_password = json.loads(phantom.get_run_data(key='generate_password:strong_password'))\n    # collect data for 'reset_ad_password' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.compromisedUserName', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'reset_ad_password' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'username': container_item[0],\n                'new_password': generate_password__strong_password,\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"set password\", parameters=parameters, assets=['active directory'], name=\"reset_ad_password\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "reset ad password",
+                        "delay": 0,
+                        "description": "Reset the Active Directory password of the user to the generated password",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "398259e5-8720-484b-a46b-ebe664b02687",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 141,
+                        "line_start": 116,
+                        "message": "Configuring now",
+                        "name": "set password",
+                        "notes": "Reset the Active Directory password of the user to the generated password",
+                        "number": 1,
+                        "order": 5,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1000,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "reset_ad_password",
+                        "required_params": {
+                            "new_password": true,
+                            "username": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "action_assets",
+                        "status": "",
+                        "title": "Contain",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 138
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "approver": "admin",
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 1
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def reset_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('reset_password() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"Found the account \\\"{0}\\\" has a compromised credential! Would you like to automatically reset the password?\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.compromisedUserName\",\n    ]\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"reset_password\", parameters=parameters, response_types=response_types, callback=reset_option)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "reset password",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "23da15dd-a900-4675-80fc-8278f452b007",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 92,
+                        "line_start": 62,
+                        "message": "Found the account \"{0}\" has a compromised credential! Would you like to automatically reset the password?",
+                        "name": "prompt",
+                        "notes": "Prompts the user if they'd like to reset the password in Active Directory",
+                        "number": 1,
+                        "order": 3,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "artifact:*.cef.compromisedUserName"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 240,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "reset_password",
+                        "respond_in": "30",
+                        "response_key": "Message",
+                        "response_options": [],
+                        "response_type": "list",
+                        "responses": [
+                            {
+                                "response_key": "Yes/No",
+                                "response_options": [
+                                    "Yes",
+                                    "No"
+                                ],
+                                "response_prompt": "",
+                                "response_type": "list"
+                            }
+                        ],
+                        "show_number": true,
+                        "size": {
+                            "height": 80,
+                            "width": 80
+                        },
+                        "state": "prompt",
+                        "status": "",
+                        "type": "coa.Prompt",
+                        "warn": false,
+                        "z": 139
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".functionBlock": {
+                                "text": "generate password"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "custom function"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 1
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn_grey.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def generate_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('generate_password() called')\n    \n    input_parameter_0 = \"\"\n\n    generate_password__strong_password = None\n\n    ################################################################################\n    ## Custom Code Start\n    ################################################################################\n\n    alpha = 'abcdefghijklmnopqrstuvwxyz'\n    num = '0123456789'\n    special = '!@#$%^&*('\n    \n    pwd = ''\n    for i in range(5):\n        pwd += alpha[randint(0, len(alpha)-1)]\n        pwd += (alpha[randint(0, len(alpha)-1)]).upper()\n        pwd += num[randint(0, len(num)-1)]\n        pwd += special[randint(0, len(special)-1)]\n    r = list(pwd)\n    shuffle(r)\n    generate_password__strong_password = ''.join(r)\n\n    ################################################################################\n    ## Custom Code End\n    ################################################################################\n\n    phantom.save_run_data(key='generate_password:strong_password', value=json.dumps(generate_password__strong_password))\n    reset_ad_password(container=container)\n    format_pwd_message(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "reset password",
+                        "connection_type": "action",
+                        "customCodeEndLineOffset": 8,
+                        "customCodeStartLine": 10,
+                        "custom_callback": "",
+                        "custom_code": "def generate_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('custom_function_1() called')\n    input_parameter_0 = \"\"\n\n    generate_password__strong_password = None\n\n    ################################################################################\n    ## Custom Code Start\n    ################################################################################\n\n    alpha = 'abcdefghijklmnopqrstuvwxyz'\n    num = '0123456789'\n    special = '!@#$%^&*('\n    \n    pwd = ''\n    for i in range(5):\n        pwd += alpha[randint(0, len(alpha)-1)]\n        pwd += (alpha[randint(0, len(alpha)-1)]).upper()\n        pwd += num[randint(0, len(num)-1)]\n        pwd += special[randint(0, len(special)-1)]\n    r = list(pwd)\n    shuffle(r)\n    generate_password__strong_password = ''.join(r)\n\n    ################################################################################\n    ## Custom Code End\n    ################################################################################\n\n    phantom.save_run_data(key='custom_function_1:strong_password', value=json.dumps(generate_password__strong_password))\n\n    return",
+                        "custom_join": "",
+                        "custom_name": "generate password",
+                        "description": "Custom code block that generates a strong random password",
+                        "functionBlock": "custom function",
+                        "has_custom": true,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "7cecdc7c-0289-4151-be2f-87a24bd0b1da",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "legacy": true,
+                        "line_end": 62,
+                        "line_start": 27,
+                        "message": "Configuring now",
+                        "name": "custom function",
+                        "notes": "Custom code block that generates a strong random password",
+                        "number": 1,
+                        "order": 2,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "outputVariables": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "strong_password"
+                            }
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": ""
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 520,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "generate_password",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "custom function",
+                        "status": "deprecating",
+                        "title": "custom function",
+                        "type": "coa.FunctionBlock",
+                        "userGeneratedCode": "\n    alpha = 'abcdefghijklmnopqrstuvwxyz'\n    num = '0123456789'\n    special = '!@#$%^&*('\n    \n    pwd = ''\n    for i in range(5):\n        pwd += alpha[randint(0, len(alpha)-1)]\n        pwd += (alpha[randint(0, len(alpha)-1)]).upper()\n        pwd += num[randint(0, len(num)-1)]\n        pwd += special[randint(0, len(special)-1)]\n    r = list(pwd)\n    shuffle(r)\n    generate_password__strong_password = ''.join(r)\n",
+                        "warn": false,
+                        "z": 140
+                    }
+                ]
+            },
+            "notes": "This playbook uses the following Apps:\n - LDAP (set password) - reset the password of a user\n\nDeployment Notes:\n - This playbook works on artifacts with artifact:*.cef.compromisedUserName which can be created as shown in the playbook \"recorded_future_handle_leaked_credentials\"\n - The prompt is hard-coded to use \"admin\" as the user, so change it to the correct user or role"
+        },
+        "python_version": "3",
+        "schema": 4,
+        "version": "4.10.0.40677"
+    },
+    "create_time": "2020-12-08T16:37:21.322527+00:00",
+    "draft_mode": false,
+    "labels": [
+        "events"
+    ],
+    "tags": [],
+    "misc": {
+        "apps_list": [
+            "LDAP"
+        ]
+    }
+}
\ No newline at end of file
diff --git a/playbooks/activedirectory_reset_password.png b/playbooks/activedirectory_reset_password.png
new file mode 100644
index 0000000000..c9fa8f115c
Binary files /dev/null and b/playbooks/activedirectory_reset_password.png differ
diff --git a/playbooks/activedirectory_reset_password.py b/playbooks/activedirectory_reset_password.py
new file mode 100644
index 0000000000..0a009524c1
--- /dev/null
+++ b/playbooks/activedirectory_reset_password.py
@@ -0,0 +1,214 @@
+"""
+This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+##############################
+# Start - Global Code Block
+
+from random import randint
+from random import shuffle
+
+# End - Global Code block
+##############################
+
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    reset_password(container=container)
+
+    return
+
+"""
+Custom code block that generates a strong random password
+"""
+def generate_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('generate_password() called')
+    
+    input_parameter_0 = ""
+
+    generate_password__strong_password = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    alpha = 'abcdefghijklmnopqrstuvwxyz'
+    num = '0123456789'
+    special = '!@#$%^&*('
+    
+    pwd = ''
+    for i in range(5):
+        pwd += alpha[randint(0, len(alpha)-1)]
+        pwd += (alpha[randint(0, len(alpha)-1)]).upper()
+        pwd += num[randint(0, len(num)-1)]
+        pwd += special[randint(0, len(special)-1)]
+    r = list(pwd)
+    shuffle(r)
+    generate_password__strong_password = ''.join(r)
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key='generate_password:strong_password', value=json.dumps(generate_password__strong_password))
+    reset_ad_password(container=container)
+    format_pwd_message(container=container)
+
+    return
+
+def reset_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('reset_password() called')
+    
+    # set user and message variables for phantom.prompt call
+    user = "admin"
+    message = """Found the account \"{0}\" has a compromised credential! Would you like to automatically reset the password?"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "artifact:*.cef.compromisedUserName",
+    ]
+
+    #responses:
+    response_types = [
+        {
+            "prompt": "",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "Yes",
+                    "No",
+                ]
+            },
+        },
+    ]
+
+    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="reset_password", parameters=parameters, response_types=response_types, callback=reset_option)
+
+    return
+
+def reset_option(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('reset_option() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["reset_password:action_result.summary.responses.0", "==", "Yes"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        generate_password(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 2
+    format_decline_msg(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+Reset the Active Directory password of the user to the generated password
+"""
+def reset_ad_password(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('reset_ad_password() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    generate_password__strong_password = json.loads(phantom.get_run_data(key='generate_password:strong_password'))
+    # collect data for 'reset_ad_password' call
+    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.compromisedUserName', 'artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'reset_ad_password' call
+    for container_item in container_data:
+        if container_item[0]:
+            parameters.append({
+                'username': container_item[0],
+                'new_password': generate_password__strong_password,
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': container_item[1]},
+            })
+
+    phantom.act(action="set password", parameters=parameters, assets=['active directory'], name="reset_ad_password")
+
+    return
+
+def add_comment_pwd_reset(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('add_comment_pwd_reset() called')
+
+    formatted_data_1 = phantom.get_format_data(name='format_pwd_message')
+
+    phantom.comment(container=container, comment=formatted_data_1)
+
+    return
+
+"""
+Formats a message about the password reset to provide in the comments
+"""
+def format_pwd_message(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_pwd_message() called')
+    
+    template = """Reset user {0} password to {1}"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "artifact:*.cef.compromisedUserName",
+        "generate_password:custom_function:strong_password",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_pwd_message")
+
+    add_comment_pwd_reset(container=container)
+
+    return
+
+"""
+Formats a message stating the user declined to reset the password
+"""
+def format_decline_msg(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_decline_msg() called')
+    
+    template = """Analyst declined to reset password for user: {0}"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "artifact:*.cef.compromisedUserName",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_decline_msg")
+
+    add_comment_no_reset(container=container)
+
+    return
+
+"""
+Add the comment notifying the reader that the password reset was declined
+"""
+def add_comment_no_reset(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('add_comment_no_reset() called')
+
+    formatted_data_1 = phantom.get_format_data(name='format_decline_msg')
+
+    phantom.comment(container=container, comment=formatted_data_1)
+
+    return
+
+def on_finish(container, summary):
+    phantom.debug('on_finish() called')
+    # This function is called after all actions are completed.
+    # summary of all the action and/or all details of actions
+    # can be collected here.
+
+    # summary_json = phantom.get_summary()
+    # if 'result' in summary_json:
+        # for action_result in summary_json['result']:
+            # if 'action_run_id' in action_result:
+                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+                # phantom.debug(action_results)
+
+    return
\ No newline at end of file
diff --git a/playbooks/activedirectory_reset_password.yml b/playbooks/activedirectory_reset_password.yml
new file mode 100644
index 0000000000..103fee5823
--- /dev/null
+++ b/playbooks/activedirectory_reset_password.yml
@@ -0,0 +1,19 @@
+name: Active Directory Reset password
+id: fc0edc96-ff2b-48b0-9f6f-63da6783fd63
+version: 1
+date: '2020-12-08'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.
+playbook: activedirectory_reset_password
+how_to_implement: This playbook works on artifacts with artifact:*.cef.compromisedUserName which can be created as shown in the playbook "recorded_future_handle_leaked_credentials" - The prompt is hard-coded to use "admin" as the user, so change it to the correct user or role
+references: []
+app_list:
+- "LDAP"
+tags:
+  platform_tags:
+  - Response
+  playbook_fields:
+  - compromisedUserName
+  product:
+  - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/crowdstrike_malware_triage.json b/playbooks/crowdstrike_malware_triage.json
new file mode 100644
index 0000000000..588879e265
--- /dev/null
+++ b/playbooks/crowdstrike_malware_triage.json
@@ -0,0 +1,9686 @@
+{
+    "blockly": false,
+    "blockly_xml": "<xml></xml>",
+    "category": "Use Cases",
+    "misc": { "apps_list": ["CrowdStrike OAuth API"] },
+    "coa": {
+        "data": {
+            "clean": true,
+            "code_block": "",
+            "description": "Enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst's choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of \"detect\" or \"none\", and the endpoint can be optionally quarantined from the network.",
+            "hash": "79619e5a31b4302e5150a07fe13c32a2f669f176",
+            "joint": {
+                "cells": [
+                    {
+                        "0": "S",
+                        "1": "T",
+                        "2": "A",
+                        "3": "R",
+                        "4": "T",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "ref-x": 33,
+                                "ref-y": 8,
+                                "text": "START"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "ref-x": 13,
+                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'if_sha256_exists' block\n    if_sha256_exists(container=container)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "4fa5d104-e7c6-43d9-8485-4172636299a6",
+                        "inPorts": [],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 16,
+                        "line_start": 8,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 1,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": -560,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "START",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 26
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "e7df7f9c-7de3-4800-bb0c-a06f4b930e17",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "4fa5d104-e7c6-43d9-8485-4172636299a6",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 27
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "9a480146-1bcb-4d7e-ba1d-3737838fa170",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 45
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "9d7d3005-2b76-4c46-9a3e-0340a7b15461",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 62
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "e98a19a1-65ba-40d6-a3c3-49f6f9c63478",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "c0ae58bf-47b9-4b4d-92bf-0172765aafc6",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 67
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "abd2b302-0df4-4795-be1b-bf5ca53710b7",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 68
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "12e9a5e5-83c1-4056-9fcc-99bfafcb07ae",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 72
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "98bee464-56d3-471d-a0c8-c0d7fe380b87",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 77
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "46b3bc83-60ee-493f-bb85-519eca01c1f1",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 90
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "6de32435-c2b3-46d4-8e2b-cfed0ad4d5d2",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "0ab1d7d6-afc7-4a0d-b9f4-8079cf67c624",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 96
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "c973bc87-1068-4a4f-b77d-da57579d114c",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 99
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "438d8d1b-db6f-4005-a9dc-6b4f0dddfb55",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                            "port": "out-3",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "b827b91f-97e9-4a99-983a-bdb0b4eb98ce",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 101
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "d8de0ef2-d498-41d4-9c74-7b84550458d6",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "ea7fbdda-bb34-4d57-9973-03db50614381",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 108
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "4a76ade7-9d28-4cec-873a-2a41e5d65816",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 123
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "2976e19a-9a82-4e59-90de-8990cae42c3c",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "ea7fbdda-bb34-4d57-9973-03db50614381",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "44aeff0b-c413-4567-8916-e979e6c31fe0",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 129
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "dda15c41-a25c-4a4b-a82a-cff5f5d6c1c1",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 135
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "009d45df-a04f-4b81-9b48-7fd11e7519c7",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "583356d6-13eb-45bf-9d38-5cbe82358374",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 137
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "37948fb9-ef42-475e-897b-b5d7ab70c787",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "583356d6-13eb-45bf-9d38-5cbe82358374",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 142
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "77f22435-3a23-40cc-8db2-fb8a0d58d71c",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 158
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "7e7cfb9e-a76f-454a-8bb3-75834b3c43b5",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 169
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "f7faed44-e0ab-47b7-ac8e-0f9d359172e4",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "d5f48d34-ef50-4204-956c-7023b9846414",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 171
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "d6bcabed-8255-4f1c-be0f-56ba3de1a048",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
+                            "port": "out-3",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 185
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "9317d7f4-b334-4bf2-858d-a5e7342316a9",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "d04015bf-190d-415d-8fab-06f8f1276751",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 187
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "4c25afd4-6695-4f80-aff8-3e10cb1c2c87",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "d6ae9b4a-a027-4ce4-b4ea-15a67a35668d",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 191
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "211f8472-10ee-4574-acca-42911a6f30fa",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 194
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "e77c9eac-4850-48f5-8d35-895a8d05e027",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "a8b369f1-2a55-4e49-85da-a66c35534861",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 207
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "ab597937-b68a-4157-9f2e-5f751fdbc2e2",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "d5f48d34-ef50-4204-956c-7023b9846414",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "e67e9ce0-f06d-4687-b3ed-d5d24860ed82",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 214
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "e0fef39f-1fc8-4576-9c72-4174b190b878",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "d5f48d34-ef50-4204-956c-7023b9846414",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "8f1bc7f0-5b9e-4e9c-9159-ee6a2b73c0e5",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 216
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "f59e09bf-d4fd-453b-b411-73cebcf84946",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "a8b369f1-2a55-4e49-85da-a66c35534861",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "a51b3d43-d32c-4e5a-8e14-0a18c119d81a",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 221
+                    },
+                    {
+                        "0": "E",
+                        "1": "N",
+                        "2": "D",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".title": {
+                                "text": "END"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "create detect indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "a51b3d43-d32c-4e5a-8e14-0a18c119d81a",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 792,
+                        "line_start": 779,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 33,
+                        "outPorts": [],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1760,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "END",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 228
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "68b66efc-be78-468d-bb79-c78cea946d63",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 241
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 2
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def if_sha256_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('if_sha256_exists() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.fileHashSha256\", \"!=\", \"\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        filter_main_artifact(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    ignore_if_no_sha256(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "if sha256 exists",
+                        "description": "Ensure that the event has at least one artifact with a SHA256 file hash before attempting to process the event.",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "9438c5bf-bef5-455c-bf2a-8c3edd0e080f",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 66,
+                        "line_start": 46,
+                        "name": "decision",
+                        "notes": "Ensure that the event has at least one artifact with a SHA256 file hash before attempting to process the event.",
+                        "number": 2,
+                        "order": 3,
+                        "outPorts": [
+                            "out-1",
+                            "out-2"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "!=",
+                                        "data_type": "",
+                                        "param": "artifact:*.cef.fileHashSha256",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": -420,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "if_sha256_exists",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 252
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 1
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def filter_main_artifact(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_main_artifact() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        conditions=[\n            [\"artifact:*.label\", \"==\", \"event\"],\n        ],\n        name=\"filter_main_artifact:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        get_indicator_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "filter main artifact",
+                        "description": "Only process the main detection artifact, not any sub event artifacts.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "ffbb7b76-3326-4a51-aeb9-b60c5a82893a",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 208,
+                        "line_start": 191,
+                        "name": "filter",
+                        "notes": "Only process the main detection artifact, not any sub event artifacts.",
+                        "number": 1,
+                        "order": 10,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "artifact:*.label",
+                                        "value": "event"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": -280,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "filter_main_artifact",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "filter",
+                        "status": "",
+                        "type": "coa.Filter",
+                        "warn": false,
+                        "z": 253
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "ignore if no sha256"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def ignore_if_no_sha256(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('ignore_if_no_sha256() called')\n\n    phantom.comment(container=container, comment=\"Ignoring alert because no SHA256 file hash was found\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "Ignoring alert because no SHA256 file hash was found",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "ignore if no sha256",
+                        "description": "End the playbook if no SHA256 file hash is found in any of the artifacts.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "c0ae58bf-47b9-4b4d-92bf-0172765aafc6",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 76,
+                        "line_start": 69,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "End the playbook if no SHA256 file hash is found in any of the artifacts.",
+                        "number": 1,
+                        "order": 4,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": -140,
+                            "y": 200
+                        },
+                        "previous_function": "",
+                        "previous_name": "ignore_if_no_sha256",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 255
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 4
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-2": {
+                                "port": {
+                                    "id": "out-3",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": -2
+                            },
+                            ".outPorts>.port-2>.port-body": {
+                                "port": {
+                                    "id": "out-3",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def indicator_policy_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('indicator_policy_decision() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"get_indicator_2:action_result.data.*.resources.*.policy\", \"==\", \"none\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        detection_policy_none(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # check for 'elif' condition 2\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"get_indicator_2:action_result.data.*.resources.*.policy\", \"==\", \"detect\"],\n        ])\n\n    # call connected blocks if condition 2 matched\n    if matched:\n        escalate_severity_to_high(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        format_repeat_note(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 3\n    comment_unexpected_policy(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "indicator policy decision",
+                        "description": "Handle the Indicator differently if the policy is \"detect\", \"none\", or other.",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "44f59298-23fc-4206-b2bb-672cb157944e",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 246,
+                        "line_start": 211,
+                        "name": "decision",
+                        "notes": "Handle the Indicator differently if the policy is \"detect\", \"none\", or other.",
+                        "number": 4,
+                        "order": 11,
+                        "outPorts": [
+                            "out-1",
+                            "out-2",
+                            "out-3"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "get_indicator_2:action_result.data.*.resources.*.policy",
+                                        "value": "none"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "get_indicator_2:action_result.data.*.resources.*.policy",
+                                        "value": "detect"
+                                    }
+                                ],
+                                "display": "Else If",
+                                "logic": "and",
+                                "type": "elif"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 180,
+                            "y": 340
+                        },
+                        "previous_function": "",
+                        "previous_name": "indicator_policy_decision",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 258
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "set status",
+                        "attrs": {
+                            ".api": {
+                                "text": "close event"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def close_event(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('close_event() called')\n\n    phantom.set_status(container=container, status=\"Closed\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "key": "set-status",
+                                "setStatusStatus": "Closed",
+                                "setStatusStatus_display": "Closed"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "close event",
+                        "description": "Close the event because the Indicator policy is \"none\", meaning the detection is a false positive.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "44aeff0b-c413-4567-8916-e979e6c31fe0",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 357,
+                        "line_start": 350,
+                        "message": "Configuring now",
+                        "name": "set status",
+                        "notes": "Close the event because the Indicator policy is \"none\", meaning the detection is a false positive.",
+                        "number": 8,
+                        "order": 16,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 560,
+                            "y": 340
+                        },
+                        "previous_function": "",
+                        "previous_name": "close_event",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 260
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "set severity",
+                        "attrs": {
+                            ".api": {
+                                "text": "escalate severity to high"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def escalate_severity_to_high(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('escalate_severity_to_high() called')\n\n    phantom.set_severity(container=container, severity=\"High\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "key": "set-severity",
+                                "setSeveritySeverity": "High",
+                                "setSeveritySeverity_display": "High"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "escalate severity to high",
+                        "description": "Escalate the event because the Indicator policy is \"detect\", meaning the event is a true positive.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "0ab1d7d6-afc7-4a0d-b9f4-8079cf67c624",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 136,
+                        "line_start": 129,
+                        "message": "Configuring now",
+                        "name": "set severity",
+                        "notes": "Escalate the event because the Indicator policy is \"detect\", meaning the event is a true positive.",
+                        "number": 3,
+                        "order": 7,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 320,
+                            "y": 480
+                        },
+                        "previous_function": "",
+                        "previous_name": "escalate_severity_to_high",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 261
+                    },
+                    {
+                        "action": "get process detail",
+                        "action_type": "investigate",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "falcon_process_id": "list_processes_with_hash:action_result.data.*.falcon_process_id"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "get process detail",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "falcon_process_id": "list_processes_with_hash:action_result.data.*.falcon_process_id"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "column_name": "Status",
+                                        "column_order": 1,
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Falcon Process ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "falcon process id"
+                                        ],
+                                        "data_path": "action_result.parameter.falcon_process_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Command Line",
+                                        "column_order": 2,
+                                        "data_path": "action_result.data.*.command_line",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "C:\test\test.exe"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Crowdstrike Device ID",
+                                        "column_order": 6,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.data.*.device_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "07c312fabcb8473454d0a16f118928fg"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "File Name",
+                                        "column_order": 3,
+                                        "contains": [
+                                            "file name"
+                                        ],
+                                        "data_path": "action_result.data.*.file_name",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "\testdata\test\test\test.exe"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "pid"
+                                        ],
+                                        "data_path": "action_result.data.*.process_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "pid"
+                                        ],
+                                        "data_path": "action_result.data.*.process_id_local",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "16716090292999"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Start Timestamp",
+                                        "column_order": 4,
+                                        "data_path": "action_result.data.*.start_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-02-14T01:41:11Z"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Start Timestamp Raw",
+                                        "column_order": 7,
+                                        "data_path": "action_result.data.*.start_timestamp_raw",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "132261180718697221"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Stop Timestamp",
+                                        "column_order": 5,
+                                        "data_path": "action_result.data.*.stop_timestamp",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "column_name": "Stop TimestampRaw",
+                                        "column_order": 8,
+                                        "data_path": "action_result.data.*.stop_timestamp_raw",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.summary",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Process details fetched successfully"
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "falcon_process_id": {
+                                        "contains": [
+                                            "falcon process id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Process ID from previous Falcon IOC search",
+                                        "key": "falcon_process_id",
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "get process details"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Investigate"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def get_process_details(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('get_process_details() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_process_details' call\n    results_data_1 = phantom.collect2(container=container, datapath=['list_processes_with_hash:action_result.data.*.falcon_process_id', 'list_processes_with_hash:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_process_details' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'falcon_process_id': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"get process detail\", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name=\"get_process_details\", parent_action=action)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "list processes with hash",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "get process details",
+                        "delay": 0,
+                        "description": "Fetch additional information about each process listed in the previous step.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "583356d6-13eb-45bf-9d38-5cbe82358374",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 410,
+                        "line_start": 387,
+                        "message": "Configuring now",
+                        "name": "get process detail",
+                        "notes": "Fetch additional information about each process listed in the previous step.",
+                        "number": 1,
+                        "order": 18,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 480,
+                            "y": -80
+                        },
+                        "previous_function": "",
+                        "previous_name": "get_process_details",
+                        "required_params": {
+                            "falcon_process_id": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Investigate",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 265
+                    },
+                    {
+                        "action": "get system info",
+                        "action_type": "investigate",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "id": "hunt_file_1:action_result.data.*.device_id"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "get system info",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "id": "hunt_file_1:action_result.data.*.device_id"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.service_pack_minor",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "0"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.build_number",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "17134"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.mac_address",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "00-0c-29-a0-10-27"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.uninstall_protection",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "ENABLED"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.applied_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2019-02-08T02:39:21.726331953Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.settings_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "f472bd8e"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "remote-response"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2019-02-08T02:36:05.073298048Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.remote_response.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "6c74313d6c864180bd759c3235dbd550"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.device_control.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.device_control.applied_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-05-12T17:24:23.856260169Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.device_control.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-05-12T17:24:12.52970392Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.device_control.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "device-control"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.device_control.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "cb4babb273274f79a91e8a0e84164916"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.applied_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-04-16T02:44:27.694202488Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.settings_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "f48b1bd1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "globalconfig"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-04-16T02:42:41.826629904Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.global_config.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "49ee9efc99164562ad89640955f372ce"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.service_pack_major",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "0"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.local_ip",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "10.1.18.49"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.pointer_size",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "8"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.applied_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-07-08T03:12:30.212194872Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "firewall"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.rule_set_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018f9894359493cb756bfa7dd3357a6"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2020-07-08T03:07:38.48127371Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.firewall.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018f9894359493cb756bfa7dd3357a6"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.parameter.id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "0498d1102b23481162ff846d0633e14c"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.agent_load_flags",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "3"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.agent_local_time",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2015-07-31T14:07:42.816Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.agent_version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2.0.0010.3005"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.bios_manufacturer",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Phoenix Technologies LTD"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.bios_version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "6.00"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.data.*.cid",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "3f40c380adc74a3187c27252c0227cff"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.config_id_base",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "65994752"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.config_id_build",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "3005"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.config_id_platform",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "3"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Crowdstrike Device ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.data.*.device_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "0498d1102b23481162ff846d0633e14c"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.prevention.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.prevention.applied_date",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.prevention.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:39:31.220730539Z"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.data.*.device_policies.prevention.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "f81459e0d85b4bc7b3ad14ad40889042"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.prevention.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "prevention"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.prevention.settings_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "87cb8b2e"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.applied_date",
+                                        "data_type": "string",
+                                        "example_values": []
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:39:31.220769757Z"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "62a3908297584c52bdafaa7fdf3c3bdd"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "sensor-update"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.device_policies.sensor_update.settings_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "65994753|3|2|automatic"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "ip"
+                                        ],
+                                        "data_path": "action_result.data.*.external_ip",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "50.18.218.205"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.first_seen",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:38:09Z"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "sha256"
+                                        ],
+                                        "data_path": "action_result.data.*.group_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "e2a8b394c0e62960747ff5d64a335162b36ba4c5a54ee6499b438b94e5269ae8"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.data.*.groups",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "873560309d1b4686a6cee666575e7a93"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Hostname",
+                                        "column_order": 1,
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.data.*.hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "TheNarrowSea",
+                                            "CentOS70"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Last Seen",
+                                        "column_order": 2,
+                                        "data_path": "action_result.data.*.last_seen",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:39:34Z"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "domain"
+                                        ],
+                                        "data_path": "action_result.data.*.machine_domain",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "VICTIMNET.local"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.major_version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "6"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.meta.version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "6",
+                                            "106635"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.minor_version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.modified_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:40:09Z"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "OS Version",
+                                        "column_order": 3,
+                                        "data_path": "action_result.data.*.os_version",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Windows Server 2008 R2",
+                                            "CentOS 7"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.ou",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.platform_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "0",
+                                            "3"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Platform",
+                                        "column_order": 4,
+                                        "data_path": "action_result.data.*.platform_name",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Windows"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.policies.*.applied",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.policies.*.applied_date",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.policies.*.assigned_date",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-03-10T15:39:31.220730539Z"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.data.*.policies.*.policy_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "f81459e0d85b4bc7b3ad14ad40889042"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.policies.*.policy_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "prevention"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.policies.*.settings_hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "87cb8b2e"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.product_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "3"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.product_type_desc",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Server"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.provision_status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Provisioned"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.release_group",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.site_name",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Default-First-Site-Name"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.slow_changing_modified_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-04-23T22:52:27Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "normal"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.system_manufacturer",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "VMware, Inc."
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.system_product_name",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "VMware Virtual Platform"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.summary.hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "TheNarrowSea"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Device details fetched successfully"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "id": {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Device ID from previous Crowdstrike IOC search",
+                                        "key": "id",
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "get system info"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Investigate"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('get_system_info_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_system_info_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.device_id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_system_info_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'id': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"get system info\", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name=\"get_system_info_1\", parent_action=action)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "hunt file",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "delay": 0,
+                        "description": "Fetch additional information about each machine listed in the previous step.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "005c6087-3fe9-4e37-89f7-f170dd34412b",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 293,
+                        "line_start": 270,
+                        "message": "Configuring now",
+                        "name": "get system info",
+                        "notes": "Fetch additional information about each machine listed in the previous step.",
+                        "number": 1,
+                        "order": 14,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 480,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "get_system_info_1",
+                        "required_params": {
+                            "id": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Investigate",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 267
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format detect description"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_detect_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_detect_description() called')\n    \n    template = \"\"\"This indicator was created by Phantom in the playbook crowdstrike_malware_triage to detect and block process executions based on the file hash first seen in {0} and processed in Phantom as {1}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n        \"container:url\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_detect_description\")\n\n    create_detect_indicator(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format detect description",
+                        "description": "Format a description to provide when creating an Indicator with a policy of \"detect\".",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "0f9d0bb7-4931-4e17-b50f-03ff0551c70d",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 615,
+                        "line_start": 598,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Format a description to provide when creating an Indicator with a policy of \"detect\".",
+                        "number": 5,
+                        "order": 25,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
+                            },
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "container:url"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1280,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_detect_description",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "This indicator was created by Phantom in the playbook crowdstrike_malware_triage to detect and block process executions based on the file hash first seen in {0} and processed in Phantom as {1}",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 276
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "comment no indicator"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def comment_no_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('comment_no_indicator() called')\n\n    phantom.comment(container=container, comment=\"The analyst decided not to create a custom indicator for the file hash.\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "The analyst decided not to create a custom indicator for the file hash.",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "comment no indicator",
+                        "description": "Explain in a comment that no Indicator will be created.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "d6ae9b4a-a027-4ce4-b4ea-15a67a35668d",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 595,
+                        "line_start": 588,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "Explain in a comment that no Indicator will be created.",
+                        "number": 9,
+                        "order": 24,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1280,
+                            "y": -80
+                        },
+                        "previous_function": "",
+                        "previous_name": "comment_no_indicator",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 281
+                    },
+                    {
+                        "action": "upload indicator",
+                        "action_type": "contain",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "description": "",
+                            "expiration": "",
+                            "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+                            "policy": "detect",
+                            "share_level": "red",
+                            "source": ""
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "upload indicator",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "description": "",
+                                    "expiration": "",
+                                    "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+                                    "policy": "detect",
+                                    "share_level": "red",
+                                    "source": ""
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.description",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test description"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.expiration",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            10
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain",
+                                            "ip"
+                                        ],
+                                        "data_path": "action_result.parameter.ioc",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.policy",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "detect"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.share_level",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "red"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.source",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test source"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.summary",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "IOC Uploaded to create alert"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "description": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator description",
+                                        "key": "description",
+                                        "order": 5,
+                                        "required": false
+                                    },
+                                    "expiration": {
+                                        "data_type": "numeric",
+                                        "default": null,
+                                        "description": "Alert lifetime in days (Valid for domains and ips only)",
+                                        "key": "expiration",
+                                        "order": 3,
+                                        "required": false
+                                    },
+                                    "ioc": {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain",
+                                            "ip"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Input domain, ip, or hash ioc",
+                                        "key": "ioc",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": true
+                                    },
+                                    "policy": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Enforcement Policy (in case of detection)",
+                                        "key": "policy",
+                                        "order": 1,
+                                        "required": true,
+                                        "value_list": [
+                                            "detect",
+                                            "none"
+                                        ]
+                                    },
+                                    "share_level": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator share level",
+                                        "key": "share_level",
+                                        "order": 2,
+                                        "required": false,
+                                        "value_list": [
+                                            "red"
+                                        ]
+                                    },
+                                    "source": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator Originating source",
+                                        "key": "source",
+                                        "order": 4,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "create detect indicator"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Contain"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def create_detect_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('create_detect_indicator() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_detect_indicator' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'create_detect_indicator' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'ioc': filtered_artifacts_item_1[0],\n                'policy': \"detect\",\n                'source': \"\",\n                'expiration': \"\",\n                'description': \"\",\n                'share_level': \"red\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"upload indicator\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"create_detect_indicator\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "create detect indicator",
+                        "delay": 0,
+                        "description": "Create an Indicator to detect and block this file hash.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "a8b369f1-2a55-4e49-85da-a66c35534861",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 646,
+                        "line_start": 618,
+                        "message": "Configuring now",
+                        "name": "upload indicator",
+                        "notes": "Create an Indicator to detect and block this file hash.",
+                        "number": 2,
+                        "order": 26,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1520,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "create_detect_indicator",
+                        "required_params": {
+                            "ioc": true,
+                            "policy": true
+                        },
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Contain",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 282
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format repeat note"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_repeat_note() called')\n    \n    template = \"\"\"CrowdStrike detected a file on an endpoint which matched a previously detected file hash: \n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\\\\\{4} |\n| CrowdStrike Detection Link | {5} |  \n\n---\n\nThis event will have the severity escalated to high, and should be investigated further.\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_repeat_note\")\n\n    add_repeat_note(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format repeat note",
+                        "description": "Format a note to summarize all known information about the event.",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "a03011e0-61d6-4949-b0c2-03e18b844dba",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 172,
+                        "line_start": 139,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Format a note to summarize all known information about the event.",
+                        "number": 2,
+                        "order": 8,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName"
+                            },
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine"
+                            },
+                            {
+                                "position": 2,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                            },
+                            {
+                                "position": 3,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath"
+                            },
+                            {
+                                "position": 4,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName"
+                            },
+                            {
+                                "position": 5,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 320,
+                            "y": 620
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_repeat_note",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "CrowdStrike detected a file on an endpoint which matched a previously detected file hash: \n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\{4} |\n| CrowdStrike Detection Link | {5} |  \n\n---\n\nThis event will have the severity escalated to high, and should be investigated further.",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 284
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "detection policy none"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def detection_policy_none(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('detection_policy_none() called')\n\n    phantom.comment(container=container, comment=\"The file hash indicator has a detection policy of none, so previous investigations have found that the file is not harmful. This playbook will take no further action and the event will be closed.\")\n    close_event(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "The file hash indicator has a detection policy of none, so previous investigations have found that the file is not harmful. This playbook will take no further action and the event will be closed.",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "detection policy none",
+                        "description": "Add a comment to explain why the event is being closed.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "ea7fbdda-bb34-4d57-9973-03db50614381",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 267,
+                        "line_start": 259,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "Add a comment to explain why the event is being closed.",
+                        "number": 7,
+                        "order": 13,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 320,
+                            "y": 340
+                        },
+                        "previous_function": "",
+                        "previous_name": "detection_policy_none",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 287
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "837789d7-0479-4e6b-b678-3d036385f0ed",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "f41cc6f3-3db1-4909-b141-04c01050331f",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 289
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "7f5c6b2b-9839-4db7-acf7-6999c8469f60",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "f41cc6f3-3db1-4909-b141-04c01050331f",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 294
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "3ca96a50-53a8-4881-a653-6f4fe7ebc6d3",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
+                            "port": "out-1",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "4b535b2e-3be9-4a09-be52-dbbe8ada4228",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 301
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "0be99cce-991a-48a7-aa9e-ff9dfbd8ce9e",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
+                            "port": "out-2",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "dc3a4fa8-879c-49f9-8af9-3c050b7f1aba",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 307
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "comment no quarantine 1"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def comment_no_quarantine_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('comment_no_quarantine_1() called')\n\n    phantom.comment(container=container, comment=\"The analyst decided not to quarantine the endpoint.\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "The analyst decided not to quarantine the endpoint.",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "comment no quarantine 1",
+                        "description": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "e67e9ce0-f06d-4687-b3ed-d5d24860ed82",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 656,
+                        "line_start": 649,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
+                        "number": 10,
+                        "order": 27,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1280,
+                            "y": 340
+                        },
+                        "previous_function": "",
+                        "previous_name": "comment_no_quarantine_1",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 311
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "comment no quarantine 2"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def comment_no_quarantine_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('comment_no_quarantine_2() called')\n\n    phantom.comment(container=container, comment=\"The analyst decided not to quarantine the endpoint.\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "The analyst decided not to quarantine the endpoint.",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike known file quarantine",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "comment no quarantine 2",
+                        "description": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "dc3a4fa8-879c-49f9-8af9-3c050b7f1aba",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 779,
+                        "line_start": 772,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "Do not quarantine the endpoint because the analyst responded No in the prompt.",
+                        "number": 11,
+                        "order": 32,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1080,
+                            "y": 760
+                        },
+                        "previous_function": "",
+                        "previous_name": "comment_no_quarantine_2",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 312
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add note",
+                        "attrs": {
+                            ".api": {
+                                "text": "add repeat note"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def add_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('add_repeat_note() called')\n\n    formatted_data_1 = phantom.get_format_data(name='format_repeat_note')\n\n    note_title = \"Known Malicious File\"\n    note_content = formatted_data_1\n    note_format = \"markdown\"\n    phantom.add_note(container=container, note_type=\"general\", title=note_title, content=note_content, note_format=note_format)\n    crowdstrike_known_file_quarantine(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addNoteContent": "format_repeat_note:formatted_data",
+                                "addNoteNoteFormat": "markdown",
+                                "addNoteTitle": "Known Malicious File",
+                                "key": "add-note"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "add repeat note",
+                        "description": "Add a note to summarize the event information.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "278bf5f1-38a2-4a6c-924e-4f37b28fa60e",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 188,
+                        "line_start": 175,
+                        "message": "Configuring now",
+                        "name": "add note",
+                        "notes": "Add a note to summarize the event information.",
+                        "number": 4,
+                        "order": 9,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 560,
+                            "y": 620
+                        },
+                        "previous_function": "",
+                        "previous_name": "add_repeat_note",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 314
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 6
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def quarantine_decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_decision_1() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"crowdstrike_new_file_detection:action_result.summary.responses.1\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    comment_no_quarantine_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "quarantine decision 1",
+                        "description": "Check the quarantine device prompt response.",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "d5f48d34-ef50-4204-956c-7023b9846414",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 533,
+                        "line_start": 512,
+                        "name": "decision",
+                        "notes": "Check the quarantine device prompt response.",
+                        "number": 6,
+                        "order": 21,
+                        "outPorts": [
+                            "out-1",
+                            "out-2"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "crowdstrike_new_file_detection:action_result.summary.responses.1",
+                                        "value": "Yes"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1140,
+                            "y": 200
+                        },
+                        "previous_function": "",
+                        "previous_name": "quarantine_decision_1",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 318
+                    },
+                    {
+                        "action": "quarantine device",
+                        "action_type": "contain",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                            "hostname": ""
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "quarantine device",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                                    "hostname": ""
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.parameter.device_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "c70bbe8334aa47bd61046603eb27b15a"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.parameter.hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "CB-TEST-01"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Device ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.data.*.id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "c70bbe8334aa47bd61046603eb27b15a"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Path",
+                                        "column_order": 1,
+                                        "data_path": "action_result.data.*.path",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "/devices/entities/devices/v1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.summary.total_quarantined_device",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Device quarantined successfully"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "device_id": {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Comma-separated list of device IDs",
+                                        "key": "device_id",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "hostname": {
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Comma-separated list of hostnames",
+                                        "key": "hostname",
+                                        "order": 1,
+                                        "primary": true,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "quarantine device 1"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Contain"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_device_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'quarantine_device_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'quarantine_device_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        parameters.append({\n            'hostname': \"\",\n            'device_id': filtered_artifacts_item_1[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': filtered_artifacts_item_1[1]},\n        })\n\n    phantom.act(action=\"quarantine device\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"quarantine_device_1\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "quarantine device 1",
+                        "delay": 0,
+                        "description": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "8f1bc7f0-5b9e-4e9c-9159-ee6a2b73c0e5",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 682,
+                        "line_start": 659,
+                        "message": "Configuring now",
+                        "name": "quarantine device",
+                        "notes": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
+                        "number": 1,
+                        "order": 28,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1280,
+                            "y": 200
+                        },
+                        "previous_function": "",
+                        "previous_name": "quarantine_device_1",
+                        "required_params": {},
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Contain",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 321
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 7
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def quarantine_decision_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_decision_2() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"crowdstrike_known_file_quarantine:action_result.summary.responses.0\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        quarantine_device_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    comment_no_quarantine_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike known file quarantine",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "quarantine decision 2",
+                        "description": "Check if the analyst responded Yes or No to the quarantine.",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "98e3644d-2438-4cf7-8aaf-928647553f7b",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 743,
+                        "line_start": 722,
+                        "name": "decision",
+                        "notes": "Check if the analyst responded Yes or No to the quarantine.",
+                        "number": 7,
+                        "order": 30,
+                        "outPorts": [
+                            "out-1",
+                            "out-2"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "crowdstrike_known_file_quarantine:action_result.summary.responses.0",
+                                        "value": "Yes"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 940,
+                            "y": 620
+                        },
+                        "previous_function": "",
+                        "previous_name": "quarantine_decision_2",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 322
+                    },
+                    {
+                        "action": "quarantine device",
+                        "action_type": "contain",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                            "hostname": ""
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "quarantine device",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "device_id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                                    "hostname": ""
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.parameter.device_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "c70bbe8334aa47bd61046603eb27b15a"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.parameter.hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "CB-TEST-01"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Device ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.data.*.id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "c70bbe8334aa47bd61046603eb27b15a"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Path",
+                                        "column_order": 1,
+                                        "data_path": "action_result.data.*.path",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "/devices/entities/devices/v1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.summary.total_quarantined_device",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Device quarantined successfully"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "device_id": {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Comma-separated list of device IDs",
+                                        "key": "device_id",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "hostname": {
+                                        "contains": [
+                                            "host name"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Comma-separated list of hostnames",
+                                        "key": "hostname",
+                                        "order": 1,
+                                        "primary": true,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "quarantine device 2"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Contain"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def quarantine_device_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_device_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'quarantine_device_2' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'quarantine_device_2' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        parameters.append({\n            'hostname': \"\",\n            'device_id': filtered_artifacts_item_1[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': filtered_artifacts_item_1[1]},\n        })\n\n    phantom.act(action=\"quarantine device\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"quarantine_device_2\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike known file quarantine",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "delay": 0,
+                        "description": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "4b535b2e-3be9-4a09-be52-dbbe8ada4228",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 769,
+                        "line_start": 746,
+                        "message": "Configuring now",
+                        "name": "quarantine device",
+                        "notes": "Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.",
+                        "number": 2,
+                        "order": 31,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1080,
+                            "y": 620
+                        },
+                        "previous_function": "",
+                        "previous_name": "quarantine_device_2",
+                        "required_params": {},
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Contain",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 323
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format ignore description"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_ignore_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_ignore_description() called')\n    \n    template = \"\"\"This indicator was created by Phantom in the playbook crowdstrike_malware_triage to ignore CrowdStrike detections based on the file hash first seen in {0} and processed in Phantom as {1}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n        \"container:url\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_ignore_description\")\n\n    create_ignore_indicator(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format ignore description",
+                        "description": "Format a description to provide when creating an Indicator with a policy of \"none\".",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "da97de34-c6e5-47a8-bfcb-0a7ee4cca2a1",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 585,
+                        "line_start": 568,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Format a description to provide when creating an Indicator with a policy of \"none\".",
+                        "number": 4,
+                        "order": 23,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
+                            },
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "container:url"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1280,
+                            "y": -220
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_ignore_description",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "This indicator was created by Phantom in the playbook crowdstrike_malware_triage to ignore CrowdStrike detections based on the file hash first seen in {0} and processed in Phantom as {1}",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 324
+                    },
+                    {
+                        "action": "upload indicator",
+                        "action_type": "contain",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "description": "format_ignore_description:formatted_data",
+                            "expiration": "",
+                            "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+                            "policy": "none",
+                            "share_level": "red",
+                            "source": "Phantom Playbook crowdstrike_malware_triage"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "upload indicator",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "description": "format_ignore_description:formatted_data",
+                                    "expiration": "",
+                                    "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+                                    "policy": "none",
+                                    "share_level": "red",
+                                    "source": "Phantom Playbook crowdstrike_malware_triage"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.description",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test description"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.expiration",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            10
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain",
+                                            "ip"
+                                        ],
+                                        "data_path": "action_result.parameter.ioc",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.policy",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "detect"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.share_level",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "red"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.source",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test source"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.summary",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "IOC Uploaded to create alert"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "description": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator description",
+                                        "key": "description",
+                                        "order": 5,
+                                        "required": false
+                                    },
+                                    "expiration": {
+                                        "data_type": "numeric",
+                                        "default": null,
+                                        "description": "Alert lifetime in days (Valid for domains and ips only)",
+                                        "key": "expiration",
+                                        "order": 3,
+                                        "required": false
+                                    },
+                                    "ioc": {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain",
+                                            "ip"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Input domain, ip, or hash ioc",
+                                        "key": "ioc",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": true
+                                    },
+                                    "policy": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Enforcement Policy (in case of detection)",
+                                        "key": "policy",
+                                        "order": 1,
+                                        "required": true,
+                                        "value_list": [
+                                            "detect",
+                                            "none"
+                                        ]
+                                    },
+                                    "share_level": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator share level",
+                                        "key": "share_level",
+                                        "order": 2,
+                                        "required": false,
+                                        "value_list": [
+                                            "red"
+                                        ]
+                                    },
+                                    "source": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Indicator Originating source",
+                                        "key": "source",
+                                        "order": 4,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "create ignore indicator"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Contain"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def create_ignore_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('create_ignore_indicator() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_ignore_indicator' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n    formatted_data_1 = phantom.get_format_data(name='format_ignore_description')\n\n    parameters = []\n    \n    # build parameters list for 'create_ignore_indicator' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'ioc': filtered_artifacts_item_1[0],\n                'policy': \"none\",\n                'source': \"Phantom Playbook crowdstrike_malware_triage\",\n                'expiration': \"\",\n                'description': formatted_data_1,\n                'share_level': \"red\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"upload indicator\", parameters=parameters, assets=['crowdstrike_oauth'], name=\"create_ignore_indicator\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "create ignore indicator",
+                        "delay": 0,
+                        "description": "Create an Indicator in CrowdStrike with a policy of \"none\" to ignore detections based on this file hash in the future.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "d04015bf-190d-415d-8fab-06f8f1276751",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 565,
+                        "line_start": 536,
+                        "message": "Configuring now",
+                        "name": "upload indicator",
+                        "notes": "Create an Indicator in CrowdStrike with a policy of \"none\" to ignore detections based on this file hash in the future.",
+                        "number": 1,
+                        "order": 22,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1520,
+                            "y": -220
+                        },
+                        "previous_function": "",
+                        "previous_name": "create_ignore_indicator",
+                        "required_params": {
+                            "ioc": true,
+                            "policy": true
+                        },
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Contain",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 325
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "api": "add comment",
+                        "attrs": {
+                            ".api": {
+                                "text": "comment unexpected po..."
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "API"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def comment_unexpected_policy(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('comment_unexpected_policy() called')\n\n    phantom.comment(container=container, comment=\"The playbook received an unexpected indicator policy and needs to be extended to handle this situation.\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "color": "",
+                        "configured": [
+                            {
+                                "addCommentComment": "The playbook received an unexpected indicator policy and needs to be extended to handle this situation.",
+                                "key": "add-comment"
+                            }
+                        ],
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "comment unexpected policy",
+                        "description": "End processing because this playbook only expects \"none\" or \"detect\" as the Indicator policy.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "b827b91f-97e9-4a99-983a-bdb0b4eb98ce",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 256,
+                        "line_start": 249,
+                        "message": "Configuring now",
+                        "name": "add comment",
+                        "notes": "End processing because this playbook only expects \"none\" or \"detect\" as the Indicator policy.",
+                        "number": 5,
+                        "order": 12,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 320,
+                            "y": 200
+                        },
+                        "previous_function": "",
+                        "previous_name": "comment_unexpected_policy",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "api",
+                        "status": "",
+                        "title": "API",
+                        "type": "coa.API",
+                        "warn": false,
+                        "z": 326
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "format prompt"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_prompt() called')\n    \n    template = \"\"\"CrowdStrike detected the following suspicious activity on an endpoint:\n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\\\\\{4}\n| CrowdStrike Detection Link | {5} |\n| Details of processes associated with the file hash | <see \\\"get process details\\\" action results> |\n| Count of machines that have the file on disk | {6} |\n| System information of machines that have the file on disk | <see \\\"get system info\\\" action results> |\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName\",\n        \"filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink\",\n        \"hunt_file_1:action_result.summary.device_count\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_prompt\")\n\n    crowdstrike_new_file_detection(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "get system info, get process details",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "format prompt",
+                        "description": "Summarize all the gathered information to help the analyst decide a response in the prompt.",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "09fbbded-a2ad-433f-968d-40f3ae3c189e",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "def join_format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_format_prompt() called')\n    \n    # if the joined function has already been called, do nothing\n    if phantom.get_run_data(key='join_format_prompt_called'):\n        return\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['get_process_details']):\n        \n        # save the state that the joined function has now been called\n        phantom.save_run_data(key='join_format_prompt_called', value='format_prompt')\n        \n        # call connected block \"format_prompt\"\n        format_prompt(container=container, handle=handle)\n    \n    return",
+                        "join_optional": [
+                            "get_system_info_1"
+                        ],
+                        "join_start": 329,
+                        "line_end": 347,
+                        "line_start": 296,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "Summarize all the gathered information to help the analyst decide a response in the prompt.",
+                        "number": 3,
+                        "order": 15,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName"
+                            },
+                            {
+                                "position": 1,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine"
+                            },
+                            {
+                                "position": 2,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                            },
+                            {
+                                "position": 3,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath"
+                            },
+                            {
+                                "position": 4,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName"
+                            },
+                            {
+                                "position": 5,
+                                "type": "",
+                                "value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink"
+                            },
+                            {
+                                "position": 6,
+                                "type": "",
+                                "value": "hunt_file_1:action_result.summary.device_count"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 740,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "format_prompt",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "CrowdStrike detected the following suspicious activity on an endpoint:\n\n| Field | Value |\n|---|---|\n| Host | {0} |\n| Command Line | {1} |\n| SHA 256 | {2} |\n| File Path | {3}\\\\{4}\n| CrowdStrike Detection Link | {5} |\n| Details of processes associated with the file hash | <see \"get process details\" action results> |\n| Count of machines that have the file on disk | {6} |\n| System information of machines that have the file on disk | <see \"get system info\" action results> |",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 328
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 5
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-2": {
+                                "port": {
+                                    "id": "out-3",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": -2
+                            },
+                            ".outPorts>.port-2>.port-body": {
+                                "port": {
+                                    "id": "out-3",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def indicator_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('indicator_decision() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"No, do not create an Indicator in CrowdStrike at this time.\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        comment_no_indicator(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # check for 'elif' condition 2\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n        ])\n\n    # call connected blocks if condition 2 matched\n    if matched:\n        format_detect_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # check for 'elif' condition 3\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"Yes, create a CrowdStrike Indicator to ignore this file hash going forward (False Positive)\", \"==\", \"crowdstrike_new_file_detection:action_result.summary.responses.0\"],\n        ])\n\n    # call connected blocks if condition 3 matched\n    if matched:\n        format_ignore_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "crowdstrike new file detection",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "indicator decision",
+                        "description": "Parse the prompt response to determine how to handle the indicator.",
+                        "hasElse": false,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "f39ff0a8-97cc-494b-b692-346dd89eab7a",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 509,
+                        "line_start": 465,
+                        "name": "decision",
+                        "notes": "Parse the prompt response to determine how to handle the indicator.",
+                        "number": 5,
+                        "order": 20,
+                        "outPorts": [
+                            "out-1",
+                            "out-2",
+                            "out-3"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "No, do not create an Indicator in CrowdStrike at this time.",
+                                        "value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)",
+                                        "value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
+                                    }
+                                ],
+                                "display": "Else If",
+                                "logic": "and",
+                                "type": "elif"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "Yes, create a CrowdStrike Indicator to ignore this file hash going forward (False Positive)",
+                                        "value": "crowdstrike_new_file_detection:action_result.summary.responses.0"
+                                    }
+                                ],
+                                "display": "Else If",
+                                "logic": "and",
+                                "type": "elif"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 1140,
+                            "y": -80
+                        },
+                        "previous_function": "",
+                        "previous_name": "indicator_decision",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 330
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#637282",
+                                "transform": "rotate(45 30 70)"
+                            },
+                            ".inPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 3
+                            },
+                            ".outPorts>.port-0": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                },
+                                "ref-x": 83,
+                                "ref-y": 40
+                            },
+                            ".outPorts>.port-0>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".outPorts>.port-1": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                },
+                                "ref-x": 41,
+                                "ref-y": 82
+                            },
+                            ".outPorts>.port-1>.port-body": {
+                                "port": {
+                                    "id": "out-2",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def if_indicator_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('if_indicator_exists() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"Resource Not Found\", \"in\", \"get_indicator_2:action_result.message\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        list_processes_with_hash(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    indicator_policy_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "if indicator exists",
+                        "description": "Determine which response to take based on whether an Indicator exists in CrowdStrike for the SHA256 file hash.",
+                        "hasElse": true,
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "0484d948-e831-4efc-b3a4-5f7f6ffb9441",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 126,
+                        "line_start": 104,
+                        "name": "decision",
+                        "notes": "Determine which response to take based on whether an Indicator exists in CrowdStrike for the SHA256 file hash.",
+                        "number": 3,
+                        "order": 6,
+                        "outPorts": [
+                            "out-1",
+                            "out-2"
+                        ],
+                        "outputs": [
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "in",
+                                        "data_type": "",
+                                        "param": "Resource Not Found",
+                                        "value": "get_indicator_2:action_result.message"
+                                    }
+                                ],
+                                "display": "If",
+                                "logic": "and",
+                                "type": "if"
+                            },
+                            {
+                                "conditions": [
+                                    {
+                                        "comparison": "==",
+                                        "data_type": "",
+                                        "param": "",
+                                        "value": ""
+                                    }
+                                ],
+                                "display": "Else",
+                                "logic": "and",
+                                "type": "else"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 100,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "if_indicator_exists",
+                        "show_number": true,
+                        "size": {
+                            "height": 82,
+                            "width": 82
+                        },
+                        "state": "decision",
+                        "status": "",
+                        "type": "coa.Decision",
+                        "warn": "",
+                        "z": 332
+                    },
+                    {
+                        "action": "hunt file",
+                        "action_type": "investigate",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "count_only": "False",
+                            "hash": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "hunt file",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "count_only": "False",
+                                    "hash": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.count_only",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5"
+                                        ],
+                                        "data_path": "action_result.parameter.hash",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "eeb27d04c5fb25f7459407c0e5394621f12100e301b22d04a6b8f78e2adbf44t"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Crowdstrike Device ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.data.*.device_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "07c312fabcb8473454d0a16f118928fg"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.summary.device_count",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Device count: 1"
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "count_only": {
+                                        "data_type": "boolean",
+                                        "default": false,
+                                        "description": "Get endpoint count only",
+                                        "key": "count_only",
+                                        "required": false
+                                    },
+                                    "hash": {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "File hash to search",
+                                        "key": "hash",
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "hunt file"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Investigate"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_file_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_file_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'hash': filtered_artifacts_item_1[0],\n                'count_only': False,\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt file\", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_system_info_1, name=\"hunt_file_1\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "delay": 0,
+                        "description": "List all machines where the file hash has been seen.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "6d11a3cf-6f79-4280-a83c-ff518a10f734",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 43,
+                        "line_start": 19,
+                        "message": "Configuring now",
+                        "name": "hunt file",
+                        "notes": "List all machines where the file hash has been seen.",
+                        "number": 1,
+                        "order": 2,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 240,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "hunt_file_1",
+                        "required_params": {
+                            "hash": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Investigate",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 333
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "approver": "admin",
+                        "approver_display": "admin",
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 1
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def crowdstrike_new_file_detection(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('crowdstrike_new_file_detection() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"{0}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"format_prompt:formatted_data\",\n    ]\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"Should Phantom create an Indicator in CrowdStrike to track this file hash from now on?\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"No, do not create an Indicator in CrowdStrike at this time.\",\n                    \"Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)\",\n                    \"Yes, create a CrowdStrike Indicator to ignore this file hash from now on. (False Positive)\",\n                ]\n            },\n        },\n        {\n            \"prompt\": \"Should Phantom quarantine the endpoint?\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"crowdstrike_new_file_detection\", parameters=parameters, response_types=response_types, callback=crowdstrike_new_file_detection_callback)\n\n    return",
+                        "callback_code": "def crowdstrike_new_file_detection_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('crowdstrike_new_file_detection_callback() called')\n    \n    indicator_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    quarantine_decision_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
+                        "callback_start": 454,
+                        "callsback": true,
+                        "connected_to_start": true,
+                        "connection_name": "get system info, get process details",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "crowdstrike new file detection",
+                        "description": "Prompt the user to determine whether or not to create an Indicator for the file hash and whether or not to quarantine the endpoint.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "e6b6bdfa-6ec1-40a6-96fd-1f9b535b2087",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 462,
+                        "line_start": 413,
+                        "message": "{0}",
+                        "name": "prompt",
+                        "notes": "Prompt the user to determine whether or not to create an Indicator for the file hash and whether or not to quarantine the endpoint.",
+                        "number": 1,
+                        "order": 19,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "format_prompt:formatted_data"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 980,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "crowdstrike_new_file_detection",
+                        "respond_in": "30",
+                        "response_key": "Message",
+                        "response_options": [],
+                        "response_type": "list",
+                        "responses": [
+                            {
+                                "response_key": "Custom List",
+                                "response_options": [
+                                    "No, do not create an Indicator in CrowdStrike at this time.",
+                                    "Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)",
+                                    "Yes, create a CrowdStrike Indicator to ignore this file hash from now on. (False Positive)"
+                                ],
+                                "response_prompt": "Should Phantom create an Indicator in CrowdStrike to track this file hash from now on?",
+                                "response_type": "list",
+                                "responses_prompt": "Should Phantom create an Indicator in CrowdStrike to track this file hash from now on??"
+                            },
+                            {
+                                "response_key": "Yes/No",
+                                "response_options": [
+                                    "Yes",
+                                    "No"
+                                ],
+                                "response_prompt": "Should Phantom quarantine the endpoint?",
+                                "response_type": "list"
+                            }
+                        ],
+                        "show_number": true,
+                        "size": {
+                            "height": 80,
+                            "width": 80
+                        },
+                        "state": "prompt",
+                        "status": "",
+                        "type": "coa.Prompt",
+                        "warn": false,
+                        "z": 334
+                    },
+                    {
+                        "action": "get indicator",
+                        "action_type": "investigate",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "indicator_type": "sha256",
+                            "indicator_value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "get indicator",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "indicator_type": "sha256",
+                                    "indicator_value": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Indicator fetched successfully"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.summary",
+                                        "data_type": "string"
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.indicator_type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "domain"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "domain",
+                                            "md5",
+                                            "sha256",
+                                            "ip"
+                                        ],
+                                        "data_path": "action_result.parameter.indicator_value",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "xyz"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.source",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test source"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.description",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "test description"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.meta.query_time",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            0.002269266
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.meta.trace_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "6a4b970e-93a9-4151-bac4-e721ff3925a8"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.modified_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-08-17T15:19:31Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.modified_by",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "C16JJOUVVY125J3O50FF"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.share_level",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "red"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.created_by",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "C16JJOUVVY125J3O50FF"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.created_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-08-17T15:19:31Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.value",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "xyz"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.policy",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "none"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.type",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "domain"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.resources.*.expiration_timestamp",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "2018-09-16T00:00:00Z"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "indicator_type": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The type of the indicator",
+                                        "key": "indicator_type",
+                                        "order": 1,
+                                        "required": true,
+                                        "value_list": [
+                                            "sha256",
+                                            "md5",
+                                            "domain",
+                                            "ipv4",
+                                            "ipv6"
+                                        ]
+                                    },
+                                    "indicator_value": {
+                                        "contains": [
+                                            "domain",
+                                            "md5",
+                                            "sha256",
+                                            "ip"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "String representation of the indicator",
+                                        "key": "indicator_value",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "get indicator"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Investigate"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def get_indicator_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('get_indicator_2() called')\n\n    # collect data for 'get_indicator_2' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'get_indicator_2' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'indicator_type': \"sha256\",\n                'indicator_value': filtered_artifacts_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"get indicator\", parameters=parameters, assets=['crowdstrike_oauth'], callback=if_indicator_exists, name=\"get_indicator_2\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "delay": 0,
+                        "description": "Fetch the CrowdStrike indicator for the SHA256 file hash, if there is one. This action will fail if there is no matching indicator in CrowdStrike, but the playbook will check for the failure and continue.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "c5d59d69-49e7-4433-a650-d1b0b98e74be",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 101,
+                        "line_start": 79,
+                        "message": "Configuring now",
+                        "name": "get indicator",
+                        "notes": "Fetch the CrowdStrike indicator for the SHA256 file hash, if there is one. This action will fail if there is no matching indicator in CrowdStrike, but the playbook will check for the failure and continue.",
+                        "number": 2,
+                        "order": 5,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": -140,
+                            "y": 60
+                        },
+                        "previous_function": "",
+                        "previous_name": "get_indicator_2",
+                        "required_params": {
+                            "indicator_type": true,
+                            "indicator_value": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Investigate",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 335
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "approver": "admin",
+                        "approver_display": "admin",
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".number": {
+                                "text": 2
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def crowdstrike_known_file_quarantine(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('crowdstrike_known_file_quarantine() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"{0}\n\n---\n\nShould Phantom quarantine the device?\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"format_repeat_note:formatted_data\",\n    ]\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"crowdstrike_known_file_quarantine\", parameters=parameters, response_types=response_types, callback=quarantine_decision_2)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "crowdstrike known file quarantine",
+                        "description": "Ask the analyst if the endpoint should be quarantined.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "f41cc6f3-3db1-4909-b141-04c01050331f",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 719,
+                        "line_start": 685,
+                        "message": "{0}\n\n---\n\nShould Phantom quarantine the device?",
+                        "name": "prompt",
+                        "notes": "Ask the analyst if the endpoint should be quarantined.",
+                        "number": 2,
+                        "order": 29,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "format_repeat_note:formatted_data"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 800,
+                            "y": 620
+                        },
+                        "previous_function": "",
+                        "previous_name": "crowdstrike_known_file_quarantine",
+                        "respond_in": "30",
+                        "response_key": "Message",
+                        "response_options": [],
+                        "response_type": "list",
+                        "responses": [
+                            {
+                                "response_key": "Yes/No",
+                                "response_options": [
+                                    "Yes",
+                                    "No"
+                                ],
+                                "response_prompt": "",
+                                "response_type": "list"
+                            }
+                        ],
+                        "show_number": true,
+                        "size": {
+                            "height": 80,
+                            "width": 80
+                        },
+                        "state": "prompt",
+                        "status": "",
+                        "type": "coa.Prompt",
+                        "warn": false,
+                        "z": 336
+                    },
+                    {
+                        "action": "list processes",
+                        "action_type": "investigate",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                            "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                        },
+                        "angle": 0,
+                        "app": "CrowdStrike OAuth API",
+                        "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "list processes",
+                                "actions": [
+                                    "update indicator",
+                                    "delete indicator",
+                                    "upload indicator",
+                                    "list processes",
+                                    "on poll",
+                                    "list put files",
+                                    "list custom indicators",
+                                    "get indicator",
+                                    "upload put file",
+                                    "hunt domain",
+                                    "hunt file",
+                                    "get process detail",
+                                    "get system info",
+                                    "set status",
+                                    "get session file",
+                                    "list incidents",
+                                    "list incident behaviors",
+                                    "get incident details",
+                                    "list crowdscores",
+                                    "get role",
+                                    "list roles",
+                                    "get user roles",
+                                    "list users",
+                                    "update incident",
+                                    "get incident behaviors",
+                                    "list session files",
+                                    "get command details",
+                                    "run admin command",
+                                    "run command",
+                                    "list sessions",
+                                    "delete session",
+                                    "create session",
+                                    "remove hosts",
+                                    "assign hosts",
+                                    "unquarantine device",
+                                    "quarantine device",
+                                    "list groups",
+                                    "query device",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "CrowdStrike OAuth API",
+                                "app_version": "2.0.5",
+                                "appid": "ae971ba5-3117-444a-8ac5-6ce779f3a232",
+                                "asset_name": "crowdstrike_oauth",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "id": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId",
+                                    "ioc": "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256"
+                                },
+                                "has_app": true,
+                                "id": 19,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "crowdstrike_oauth",
+                                "output": [
+                                    {
+                                        "column_name": "Status",
+                                        "column_order": 2,
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Crowdstrike Device ID",
+                                        "column_order": 0,
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_path": "action_result.parameter.id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "07c312fabcb8473454d0a16f118928ab"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "IOC Queried",
+                                        "column_order": 1,
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain"
+                                        ],
+                                        "data_path": "action_result.parameter.ioc",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "eeb27d04c5fb25f7459407c0e5394621f12100e301b22d04a6b8f78e2adbf33d"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Falcon Process ID",
+                                        "column_order": 3,
+                                        "contains": [
+                                            "falcon process id"
+                                        ],
+                                        "data_path": "action_result.data.*.falcon_process_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "pid:07c312fabcb8473454d0a16f118928fg:16716090292999"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Process count: 1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.summary.process_count",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "id": {
+                                        "contains": [
+                                            "crowdstrike device id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Crowdstrike Device ID to search on",
+                                        "key": "id",
+                                        "primary": true,
+                                        "required": true
+                                    },
+                                    "ioc": {
+                                        "contains": [
+                                            "hash",
+                                            "sha256",
+                                            "sha1",
+                                            "md5",
+                                            "domain"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "File Hash or Domain to use for searching",
+                                        "key": "ioc",
+                                        "primary": true,
+                                        "required": true
+                                    }
+                                },
+                                "product_name": "CrowdStrike",
+                                "product_vendor": "CrowdStrike",
+                                "targets": "19",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "list processes with hash"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Investigate"
+                            },
+                            "g.approver image": {
+                                "opacity": 1
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            },
+                            "g.timer image": {
+                                "opacity": 1
+                            }
+                        },
+                        "block_code": "def list_processes_with_hash(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('list_processes_with_hash() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'list_processes_with_hash' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'list_processes_with_hash' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0] and filtered_artifacts_item_1[1]:\n            parameters.append({\n                'id': filtered_artifacts_item_1[0],\n                'ioc': filtered_artifacts_item_1[1],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[2]},\n            })\n\n    phantom.act(action=\"list processes\", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_process_details, name=\"list_processes_with_hash\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "get indicator",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "list processes with hash",
+                        "delay": 0,
+                        "description": "List all processes seen on this host associated with this file hash.",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "2d0844c0-d8d8-4435-9b26-38ea0b6f2c3b",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 384,
+                        "line_start": 360,
+                        "message": "Configuring now",
+                        "name": "list processes",
+                        "notes": "List all processes seen on this host associated with this file hash.",
+                        "number": 1,
+                        "order": 17,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 240,
+                            "y": -80
+                        },
+                        "previous_function": "",
+                        "previous_name": "list_processes_with_hash",
+                        "required_params": {
+                            "id": true,
+                            "ioc": true
+                        },
+                        "reviewer": "",
+                        "show_number": false,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Investigate",
+                        "type": "coa.Action",
+                        "warn": false,
+                        "z": 337
+                    }
+                ]
+            },
+            "notes": "This playbook uses the following Apps:\n - CrowdStrike OAuth (get indicator, hunt file, and more) [asset name = crowdstrike_oauth] - Investigate and respond on the endpoint with CrowdStrike Falcon\n\nDeployment Notes:\n - Change the target user of the prompt from admin to the appropriate user or role"
+        },
+        "python_version": "3",
+        "schema": 4,
+        "version": "4.10.0.40961"
+    },
+    "create_time": "2021-02-25T15:14:37.456337+00:00",
+    "draft_mode": false,
+    "labels": [
+        "crowdstrike"
+    ],
+    "tags": []
+}
diff --git a/playbooks/crowdstrike_malware_triage.png b/playbooks/crowdstrike_malware_triage.png
new file mode 100644
index 0000000000..e6a6c0e2be
Binary files /dev/null and b/playbooks/crowdstrike_malware_triage.png differ
diff --git a/playbooks/crowdstrike_malware_triage.py b/playbooks/crowdstrike_malware_triage.py
new file mode 100644
index 0000000000..f4d792de49
--- /dev/null
+++ b/playbooks/crowdstrike_malware_triage.py
@@ -0,0 +1,792 @@
+"""
+Enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst's choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of "detect" or "none", and the endpoint can be optionally quarantined from the network.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+def on_start(container):
+    phantom.debug('on_start() called')
+    
+    # call 'if_sha256_exists' block
+    if_sha256_exists(container=container)
+
+    return
+
+"""
+List all machines where the file hash has been seen.
+"""
+def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('hunt_file_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'hunt_file_1' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'hunt_file_1' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        if filtered_artifacts_item_1[0]:
+            parameters.append({
+                'hash': filtered_artifacts_item_1[0],
+                'count_only': False,
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_artifacts_item_1[1]},
+            })
+
+    phantom.act(action="hunt file", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_system_info_1, name="hunt_file_1")
+
+    return
+
+"""
+Ensure that the event has at least one artifact with a SHA256 file hash before attempting to process the event.
+"""
+def if_sha256_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('if_sha256_exists() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        conditions=[
+            ["artifact:*.cef.fileHashSha256", "!=", ""],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        filter_main_artifact(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 2
+    ignore_if_no_sha256(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+End the playbook if no SHA256 file hash is found in any of the artifacts.
+"""
+def ignore_if_no_sha256(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('ignore_if_no_sha256() called')
+
+    phantom.comment(container=container, comment="Ignoring alert because no SHA256 file hash was found")
+
+    return
+
+"""
+Fetch the CrowdStrike indicator for the SHA256 file hash, if there is one. This action will fail if there is no matching indicator in CrowdStrike, but the playbook will check for the failure and continue.
+"""
+def get_indicator_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('get_indicator_2() called')
+
+    # collect data for 'get_indicator_2' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'get_indicator_2' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        if filtered_artifacts_item_1[0]:
+            parameters.append({
+                'indicator_type': "sha256",
+                'indicator_value': filtered_artifacts_item_1[0],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_artifacts_item_1[1]},
+            })
+
+    phantom.act(action="get indicator", parameters=parameters, assets=['crowdstrike_oauth'], callback=if_indicator_exists, name="get_indicator_2")
+
+    return
+
+"""
+Determine which response to take based on whether an Indicator exists in CrowdStrike for the SHA256 file hash.
+"""
+def if_indicator_exists(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('if_indicator_exists() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["Resource Not Found", "in", "get_indicator_2:action_result.message"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        list_processes_with_hash(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 2
+    indicator_policy_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+Escalate the event because the Indicator policy is "detect", meaning the event is a true positive.
+"""
+def escalate_severity_to_high(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('escalate_severity_to_high() called')
+
+    phantom.set_severity(container=container, severity="High")
+
+    return
+
+"""
+Format a note to summarize all known information about the event.
+"""
+def format_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_repeat_note() called')
+    
+    template = """CrowdStrike detected a file on an endpoint which matched a previously detected file hash: 
+
+| Field | Value |
+|---|---|
+| Host | {0} |
+| Command Line | {1} |
+| SHA 256 | {2} |
+| File Path | {3}\\\\{4} |
+| CrowdStrike Detection Link | {5} |  
+
+---
+
+This event will have the severity escalated to high, and should be investigated further."""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_repeat_note")
+
+    add_repeat_note(container=container)
+
+    return
+
+"""
+Add a note to summarize the event information.
+"""
+def add_repeat_note(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('add_repeat_note() called')
+
+    formatted_data_1 = phantom.get_format_data(name='format_repeat_note')
+
+    note_title = "Known Malicious File"
+    note_content = formatted_data_1
+    note_format = "markdown"
+    phantom.add_note(container=container, note_type="general", title=note_title, content=note_content, note_format=note_format)
+    crowdstrike_known_file_quarantine(container=container)
+
+    return
+
+"""
+Only process the main detection artifact, not any sub event artifacts.
+"""
+def filter_main_artifact(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('filter_main_artifact() called')
+
+    # collect filtered artifact ids for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["artifact:*.label", "==", "event"],
+        ],
+        name="filter_main_artifact:condition_1")
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        get_indicator_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+"""
+Handle the Indicator differently if the policy is "detect", "none", or other.
+"""
+def indicator_policy_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('indicator_policy_decision() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["get_indicator_2:action_result.data.*.resources.*.policy", "==", "none"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        detection_policy_none(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # check for 'elif' condition 2
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["get_indicator_2:action_result.data.*.resources.*.policy", "==", "detect"],
+        ])
+
+    # call connected blocks if condition 2 matched
+    if matched:
+        escalate_severity_to_high(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        format_repeat_note(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 3
+    comment_unexpected_policy(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+End processing because this playbook only expects "none" or "detect" as the Indicator policy.
+"""
+def comment_unexpected_policy(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('comment_unexpected_policy() called')
+
+    phantom.comment(container=container, comment="The playbook received an unexpected indicator policy and needs to be extended to handle this situation.")
+
+    return
+
+"""
+Add a comment to explain why the event is being closed.
+"""
+def detection_policy_none(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('detection_policy_none() called')
+
+    phantom.comment(container=container, comment="The file hash indicator has a detection policy of none, so previous investigations have found that the file is not harmful. This playbook will take no further action and the event will be closed.")
+    close_event(container=container)
+
+    return
+
+"""
+Fetch additional information about each machine listed in the previous step.
+"""
+def get_system_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('get_system_info_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'get_system_info_1' call
+    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.device_id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'get_system_info_1' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'id': results_item_1[0],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="get system info", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name="get_system_info_1", parent_action=action)
+
+    return
+
+"""
+Summarize all the gathered information to help the analyst decide a response in the prompt.
+"""
+def format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_prompt() called')
+    
+    template = """CrowdStrike detected the following suspicious activity on an endpoint:
+
+| Field | Value |
+|---|---|
+| Host | {0} |
+| Command Line | {1} |
+| SHA 256 | {2} |
+| File Path | {3}\\\\{4}
+| CrowdStrike Detection Link | {5} |
+| Details of processes associated with the file hash | <see \"get process details\" action results> |
+| Count of machines that have the file on disk | {6} |
+| System information of machines that have the file on disk | <see \"get system info\" action results> |"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sourceHostName",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.cmdLine",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.filePath",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileName",
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink",
+        "hunt_file_1:action_result.summary.device_count",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_prompt")
+
+    crowdstrike_new_file_detection(container=container)
+
+    return
+
+def join_format_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+    phantom.debug('join_format_prompt() called')
+    
+    # if the joined function has already been called, do nothing
+    if phantom.get_run_data(key='join_format_prompt_called'):
+        return
+
+    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed
+    if phantom.completed(action_names=['get_process_details']):
+        
+        # save the state that the joined function has now been called
+        phantom.save_run_data(key='join_format_prompt_called', value='format_prompt')
+        
+        # call connected block "format_prompt"
+        format_prompt(container=container, handle=handle)
+    
+    return
+
+"""
+Close the event because the Indicator policy is "none", meaning the detection is a false positive.
+"""
+def close_event(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('close_event() called')
+
+    phantom.set_status(container=container, status="Closed")
+
+    return
+
+"""
+List all processes seen on this host associated with this file hash.
+"""
+def list_processes_with_hash(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('list_processes_with_hash() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'list_processes_with_hash' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'list_processes_with_hash' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        if filtered_artifacts_item_1[0] and filtered_artifacts_item_1[1]:
+            parameters.append({
+                'id': filtered_artifacts_item_1[0],
+                'ioc': filtered_artifacts_item_1[1],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_artifacts_item_1[2]},
+            })
+
+    phantom.act(action="list processes", parameters=parameters, assets=['crowdstrike_oauth'], callback=get_process_details, name="list_processes_with_hash")
+
+    return
+
+"""
+Fetch additional information about each process listed in the previous step.
+"""
+def get_process_details(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('get_process_details() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'get_process_details' call
+    results_data_1 = phantom.collect2(container=container, datapath=['list_processes_with_hash:action_result.data.*.falcon_process_id', 'list_processes_with_hash:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'get_process_details' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'falcon_process_id': results_item_1[0],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="get process detail", parameters=parameters, assets=['crowdstrike_oauth'], callback=join_format_prompt, name="get_process_details", parent_action=action)
+
+    return
+
+"""
+Prompt the user to determine whether or not to create an Indicator for the file hash and whether or not to quarantine the endpoint.
+"""
+def crowdstrike_new_file_detection(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('crowdstrike_new_file_detection() called')
+    
+    # set user and message variables for phantom.prompt call
+    user = "admin"
+    message = """{0}"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "format_prompt:formatted_data",
+    ]
+
+    #responses:
+    response_types = [
+        {
+            "prompt": "Should Phantom create an Indicator in CrowdStrike to track this file hash from now on?",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "No, do not create an Indicator in CrowdStrike at this time.",
+                    "Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)",
+                    "Yes, create a CrowdStrike Indicator to ignore this file hash from now on. (False Positive)",
+                ]
+            },
+        },
+        {
+            "prompt": "Should Phantom quarantine the endpoint?",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "Yes",
+                    "No",
+                ]
+            },
+        },
+    ]
+
+    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="crowdstrike_new_file_detection", parameters=parameters, response_types=response_types, callback=crowdstrike_new_file_detection_callback)
+
+    return
+
+def crowdstrike_new_file_detection_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+    phantom.debug('crowdstrike_new_file_detection_callback() called')
+    
+    indicator_decision(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+    quarantine_decision_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+Parse the prompt response to determine how to handle the indicator.
+"""
+def indicator_decision(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('indicator_decision() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["No, do not create an Indicator in CrowdStrike at this time.", "==", "crowdstrike_new_file_detection:action_result.summary.responses.0"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        comment_no_indicator(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # check for 'elif' condition 2
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["Yes, create a CrowdStrike Indicator to detect and block this file hash from now on. (True Positive)", "==", "crowdstrike_new_file_detection:action_result.summary.responses.0"],
+        ])
+
+    # call connected blocks if condition 2 matched
+    if matched:
+        format_detect_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # check for 'elif' condition 3
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["Yes, create a CrowdStrike Indicator to ignore this file hash going forward (False Positive)", "==", "crowdstrike_new_file_detection:action_result.summary.responses.0"],
+        ])
+
+    # call connected blocks if condition 3 matched
+    if matched:
+        format_ignore_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    return
+
+"""
+Check the quarantine device prompt response.
+"""
+def quarantine_decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('quarantine_decision_1() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["crowdstrike_new_file_detection:action_result.summary.responses.1", "==", "Yes"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 2
+    comment_no_quarantine_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+Create an Indicator in CrowdStrike with a policy of "none" to ignore detections based on this file hash in the future.
+"""
+def create_ignore_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('create_ignore_indicator() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'create_ignore_indicator' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+    formatted_data_1 = phantom.get_format_data(name='format_ignore_description')
+
+    parameters = []
+    
+    # build parameters list for 'create_ignore_indicator' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        if filtered_artifacts_item_1[0]:
+            parameters.append({
+                'ioc': filtered_artifacts_item_1[0],
+                'policy': "none",
+                'source': "Phantom Playbook crowdstrike_malware_triage",
+                'expiration': "",
+                'description': formatted_data_1,
+                'share_level': "red",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_artifacts_item_1[1]},
+            })
+
+    phantom.act(action="upload indicator", parameters=parameters, assets=['crowdstrike_oauth'], name="create_ignore_indicator")
+
+    return
+
+"""
+Format a description to provide when creating an Indicator with a policy of "none".
+"""
+def format_ignore_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_ignore_description() called')
+    
+    template = """This indicator was created by Phantom in the playbook crowdstrike_malware_triage to ignore CrowdStrike detections based on the file hash first seen in {0} and processed in Phantom as {1}"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink",
+        "container:url",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_ignore_description")
+
+    create_ignore_indicator(container=container)
+
+    return
+
+"""
+Explain in a comment that no Indicator will be created.
+"""
+def comment_no_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('comment_no_indicator() called')
+
+    phantom.comment(container=container, comment="The analyst decided not to create a custom indicator for the file hash.")
+
+    return
+
+"""
+Format a description to provide when creating an Indicator with a policy of "detect".
+"""
+def format_detect_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('format_detect_description() called')
+    
+    template = """This indicator was created by Phantom in the playbook crowdstrike_malware_triage to detect and block process executions based on the file hash first seen in {0} and processed in Phantom as {1}"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "filtered-data:filter_main_artifact:condition_1:artifact:*.cef.falconHostLink",
+        "container:url",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="format_detect_description")
+
+    create_detect_indicator(container=container)
+
+    return
+
+"""
+Create an Indicator to detect and block this file hash.
+"""
+def create_detect_indicator(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('create_detect_indicator() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'create_detect_indicator' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'create_detect_indicator' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        if filtered_artifacts_item_1[0]:
+            parameters.append({
+                'ioc': filtered_artifacts_item_1[0],
+                'policy': "detect",
+                'source': "",
+                'expiration': "",
+                'description': "",
+                'share_level': "red",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_artifacts_item_1[1]},
+            })
+
+    phantom.act(action="upload indicator", parameters=parameters, assets=['crowdstrike_oauth'], name="create_detect_indicator")
+
+    return
+
+"""
+Do not quarantine the endpoint because the analyst responded No in the prompt.
+"""
+def comment_no_quarantine_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('comment_no_quarantine_1() called')
+
+    phantom.comment(container=container, comment="The analyst decided not to quarantine the endpoint.")
+
+    return
+
+"""
+Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.
+"""
+def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('quarantine_device_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'quarantine_device_1' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'quarantine_device_1' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        parameters.append({
+            'hostname': "",
+            'device_id': filtered_artifacts_item_1[0],
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': filtered_artifacts_item_1[1]},
+        })
+
+    phantom.act(action="quarantine device", parameters=parameters, assets=['crowdstrike_oauth'], name="quarantine_device_1")
+
+    return
+
+"""
+Ask the analyst if the endpoint should be quarantined.
+"""
+def crowdstrike_known_file_quarantine(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('crowdstrike_known_file_quarantine() called')
+    
+    # set user and message variables for phantom.prompt call
+    user = "admin"
+    message = """{0}
+
+---
+
+Should Phantom quarantine the device?"""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "format_repeat_note:formatted_data",
+    ]
+
+    #responses:
+    response_types = [
+        {
+            "prompt": "",
+            "options": {
+                "type": "list",
+                "choices": [
+                    "Yes",
+                    "No",
+                ]
+            },
+        },
+    ]
+
+    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="crowdstrike_known_file_quarantine", parameters=parameters, response_types=response_types, callback=quarantine_decision_2)
+
+    return
+
+"""
+Check if the analyst responded Yes or No to the quarantine.
+"""
+def quarantine_decision_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('quarantine_decision_2() called')
+
+    # check for 'if' condition 1
+    matched = phantom.decision(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["crowdstrike_known_file_quarantine:action_result.summary.responses.0", "==", "Yes"],
+        ])
+
+    # call connected blocks if condition 1 matched
+    if matched:
+        quarantine_device_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+        return
+
+    # call connected blocks for 'else' condition 2
+    comment_no_quarantine_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+"""
+Block the endpoint from everything but the configured allowlist of network addresses while the investigation is ongoing.
+"""
+def quarantine_device_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('quarantine_device_2() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'quarantine_device_2' call
+    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_main_artifact:condition_1:artifact:*.cef.sensorId', 'filtered-data:filter_main_artifact:condition_1:artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'quarantine_device_2' call
+    for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+        parameters.append({
+            'hostname': "",
+            'device_id': filtered_artifacts_item_1[0],
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': filtered_artifacts_item_1[1]},
+        })
+
+    phantom.act(action="quarantine device", parameters=parameters, assets=['crowdstrike_oauth'], name="quarantine_device_2")
+
+    return
+
+"""
+Do not quarantine the endpoint because the analyst responded No in the prompt.
+"""
+def comment_no_quarantine_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('comment_no_quarantine_2() called')
+
+    phantom.comment(container=container, comment="The analyst decided not to quarantine the endpoint.")
+
+    return
+
+def on_finish(container, summary):
+    phantom.debug('on_finish() called')
+    # This function is called after all actions are completed.
+    # summary of all the action and/or all details of actions
+    # can be collected here.
+
+    # summary_json = phantom.get_summary()
+    # if 'result' in summary_json:
+        # for action_result in summary_json['result']:
+            # if 'action_run_id' in action_result:
+                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+                # phantom.debug(action_results)
+
+    return
\ No newline at end of file
diff --git a/playbooks/crowdstrike_malware_triage.yml b/playbooks/crowdstrike_malware_triage.yml
new file mode 100644
index 0000000000..d24da6eed5
--- /dev/null
+++ b/playbooks/crowdstrike_malware_triage.yml
@@ -0,0 +1,20 @@
+name: Crowdstrike Malware Triage
+id: fc0edc96-fa2b-48b0-9a6f-63da6783fd63
+version: 1
+date: '2021-02-25'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook is used to enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst's choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of "detect" or "none", and the endpoint can be optionally quarantined from the network.
+playbook: crowdstrike_malware_triage
+how_to_implement: This playbook uses the Crowdstrike OAuth app. Change the target user of the prompt from admin to the appropriate user or role.
+references: []
+app_list:
+- "Crowdstrike OAuth"
+tags:
+  platform_tags:
+  - Response
+  playbook_fields:
+  - filePath
+  - destinationAddress
+  product:
+  - Splunk SOAR
diff --git a/playbooks/custom_functions/artifact_create.json b/playbooks/custom_functions/artifact_create.json
new file mode 100644
index 0000000000..51fc5de82a
--- /dev/null
+++ b/playbooks/custom_functions/artifact_create.json
@@ -0,0 +1,95 @@
+{
+    "create_time": "2021-08-13T13:55:18.025884+00:00",
+    "custom_function_id": "d4bcb95cc227e78a6e6985e2400015a14ada3056",
+    "description": "Create a new artifact with the specified attributes.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "Container which the artifact will be added to.",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "The name of the new artifact, which is optional and defaults to \"artifact\".",
+            "input_type": "item",
+            "name": "name",
+            "placeholder": "artifact"
+        },
+        {
+            "contains_type": [],
+            "description": "The label of the new artifact, which is optional and defaults to \"events\"",
+            "input_type": "item",
+            "name": "label",
+            "placeholder": "events"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "The severity of the new artifact, which is optional and defaults to \"Medium\". Typically this is either \"High\", \"Medium\", or \"Low\".",
+            "input_type": "item",
+            "name": "severity",
+            "placeholder": "Medium"
+        },
+        {
+            "contains_type": [],
+            "description": "The name of the CEF field to populate in the artifact, such as \"destinationAddress\" or \"sourceDnsDomain\". Required only if cef_value is provided.",
+            "input_type": "item",
+            "name": "cef_field",
+            "placeholder": "destinationAddress"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The value of the CEF field to populate in the artifact, such as the IP address, domain name, or file hash. Required only if cef_field is provided.",
+            "input_type": "item",
+            "name": "cef_value",
+            "placeholder": "192.0.2.192"
+        },
+        {
+            "contains_type": [],
+            "description": "The CEF data type of the data in cef_value. For example, this could be \"ip\", \"hash\", or \"domain\". Optional.",
+            "input_type": "item",
+            "name": "cef_data_type",
+            "placeholder": "ip"
+        },
+        {
+            "contains_type": [],
+            "description": "A comma-separated list of tags to apply to the created artifact, which is optional.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1, tag2, tag3"
+        },
+        {
+            "contains_type": [],
+            "description": "Either \"true\" or \"false\", depending on whether or not the new artifact should trigger the execution of any playbooks that are set to active on the label of the container the artifact will be added to. Optional and defaults to \"false\".",
+            "input_type": "item",
+            "name": "run_automation",
+            "placeholder": "false"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to modify any extra attributes of the artifact. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.",
+            "input_type": "item",
+            "name": "input_json",
+            "placeholder": "{\"source_data_identifier\": \"1234\", \"data\": \"5678\"}"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "phantom artifact id"
+            ],
+            "data_path": "artifact_id",
+            "description": "The ID of the created artifact."
+        }
+    ],
+    "platform_version": "4.10.4.56260",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/artifact_create.py b/playbooks/custom_functions/artifact_create.py
new file mode 100644
index 0000000000..519e58ece4
--- /dev/null
+++ b/playbooks/custom_functions/artifact_create.py
@@ -0,0 +1,104 @@
+def artifact_create(container=None, name=None, label=None, severity=None, cef_field=None, cef_value=None, cef_data_type=None, tags=None, run_automation=None, input_json=None, **kwargs):
+    """
+    Create a new artifact with the specified attributes.
+    
+    Args:
+        container (CEF type: phantom container id): Container which the artifact will be added to.
+        name: The name of the new artifact, which is optional and defaults to "artifact".
+        label: The label of the new artifact, which is optional and defaults to "events"
+        severity: The severity of the new artifact, which is optional and defaults to "Medium". Typically this is either "High", "Medium", or "Low".
+        cef_field: The name of the CEF field to populate in the artifact, such as "destinationAddress" or "sourceDnsDomain". Required only if cef_value is provided.
+        cef_value (CEF type: *): The value of the CEF field to populate in the artifact, such as the IP address, domain name, or file hash. Required only if cef_field is provided.
+        cef_data_type: The CEF data type of the data in cef_value. For example, this could be "ip", "hash", or "domain". Optional.
+        tags: A comma-separated list of tags to apply to the created artifact, which is optional.
+        run_automation: Either "true" or "false", depending on whether or not the new artifact should trigger the execution of any playbooks that are set to active on the label of the container the artifact will be added to. Optional and defaults to "false".
+        input_json: Optional parameter to modify any extra attributes of the artifact. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        artifact_id (CEF type: phantom artifact id): The ID of the created artifact.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    new_artifact = {}
+    json_dict = None
+    
+    if isinstance(container, int):
+        container_id = container
+    elif isinstance(container, dict):
+        container_id = container['id']
+    else:
+        raise TypeError("container is neither an int nor a dictionary")
+
+    if name:
+        new_artifact['name'] = name
+    else:
+        new_artifact['name'] = 'artifact'
+    if label:
+        new_artifact['label'] = label
+    else:
+        new_artifact['label'] = 'events'
+    if severity:
+        new_artifact['severity'] = severity
+    else:
+        new_artifact['severity'] = 'Medium'
+
+    # validate that if cef_field or cef_value is provided, the other is also provided
+    if (cef_field and not cef_value) or (cef_value and not cef_field):
+        raise ValueError("only one of cef_field and cef_value was provided")
+
+    # cef_data should be formatted {cef_field: cef_value}
+    if cef_field:
+        new_artifact['cef_data'] = {cef_field: cef_value}
+        if cef_data_type and isinstance(cef_data_type, str):
+            new_artifact['field_mapping'] = {cef_field: [cef_data_type]}
+
+    # run_automation must be "true" or "false" and defaults to "false"
+    if run_automation:
+        if not isinstance(run_automation, str):
+            raise TypeError("run automation must be a string")
+        if run_automation.lower() == 'true':
+            new_artifact['run_automation'] = True
+        elif run_automation.lower() == 'false':
+            new_artifact['run_automation'] = False
+        else:
+            raise ValueError("run_automation must be either 'true' or 'false'")
+    else:
+        new_artifact['run_automation'] = False
+    
+    if input_json:
+        # ensure valid input_json
+        if isinstance(input_json, dict):
+            json_dict = input_json
+        elif isinstance(input_json, str):
+            json_dict = json.loads(input_json)
+        else:
+            raise ValueError("input_json must be either 'dict' or valid json 'string'")
+            
+    if json_dict:
+        # Merge dictionaries, using the value from json_dict if there are any conflicting keys
+        for json_key in json_dict:
+            # extract tags from json_dict since it is not a valid parameter for phantom.add_artifact()
+            if json_key == 'tags':
+                tags = json_dict[json_key]
+            else:
+                new_artifact[json_key] = json_dict[json_key]
+                
+    # now actually create the artifact
+    phantom.debug('creating a new artifact with the following attributes:\n{}'.format(new_artifact))
+    success, message, artifact_id = phantom.add_artifact(**new_artifact)
+
+    phantom.debug('add_artifact() returned the following:\nsuccess: {}\nmessage: {}\nartifact_id: {}'.format(success, message, artifact_id))
+    if not success:
+        raise RuntimeError("add_artifact() failed")
+
+    # add the tags in a separate REST call because there is no tags parameter in add_artifact()
+    if tags:
+        tags = tags.replace(" ", "").split(",")
+        url = phantom.build_phantom_rest_url('artifact', artifact_id)
+        response = phantom.requests.post(uri=url, json={'tags': tags}, verify=False).json()
+        phantom.debug('response from POST request to add tags:\n{}'.format(response))
+        
+    # Return the id of the created artifact
+    return {'artifact_id': artifact_id}
diff --git a/playbooks/custom_functions/artifact_update.json b/playbooks/custom_functions/artifact_update.json
new file mode 100644
index 0000000000..e8f7a68f78
--- /dev/null
+++ b/playbooks/custom_functions/artifact_update.json
@@ -0,0 +1,80 @@
+{
+    "create_time": "2021-07-24T01:17:48.431013+00:00",
+    "custom_function_id": "1d358be9992079dad6d3313d465e65318930cf70",
+    "description": "Update an artifact with the specified attributes. All parameters are optional, except that cef_field and cef_value must both be provided if one is provided.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom artifact id"
+            ],
+            "description": "ID of the artifact to update, which is required.",
+            "input_type": "item",
+            "name": "artifact_id",
+            "placeholder": "1234"
+        },
+        {
+            "contains_type": [],
+            "description": "Change the name of the artifact.",
+            "input_type": "item",
+            "name": "name",
+            "placeholder": "artifact"
+        },
+        {
+            "contains_type": [],
+            "description": "Change the label of the artifact.",
+            "input_type": "item",
+            "name": "label",
+            "placeholder": "events"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "Change the severity of the artifact. Typically this is either \"High\", \"Medium\", or \"Low\".",
+            "input_type": "item",
+            "name": "severity",
+            "placeholder": "Medium"
+        },
+        {
+            "contains_type": [],
+            "description": "The name of the CEF field to populate in the artifact, such as \"destinationAddress\" or \"sourceDnsDomain\". Required only if cef_value is provided.",
+            "input_type": "item",
+            "name": "cef_field",
+            "placeholder": "destinationAddress"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The value of the CEF field to populate in the artifact, such as the IP address, domain name, or file hash. Required only if cef_field is provided.",
+            "input_type": "item",
+            "name": "cef_value",
+            "placeholder": "192.0.2.192"
+        },
+        {
+            "contains_type": [],
+            "description": "The CEF data type of the data in cef_value. For example, this could be \"ip\", \"hash\", or \"domain\". Optional, but only operational if cef_field is provided.",
+            "input_type": "item",
+            "name": "cef_data_type",
+            "placeholder": "ip"
+        },
+        {
+            "contains_type": [],
+            "description": "A comma-separated list of tags to apply to the artifact, which is optional.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1, tag2, tag3"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to modify any extra attributes of the artifact. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.",
+            "input_type": "item",
+            "name": "input_json",
+            "placeholder": "{\"source_data_identifier\": \"1234\", \"data\": \"5678\"}"
+        }
+    ],
+    "outputs": [],
+    "platform_version": "4.10.4.56260",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/artifact_update.py b/playbooks/custom_functions/artifact_update.py
new file mode 100644
index 0000000000..e60dbb03bb
--- /dev/null
+++ b/playbooks/custom_functions/artifact_update.py
@@ -0,0 +1,65 @@
+def artifact_update(artifact_id=None, name=None, label=None, severity=None, cef_field=None, cef_value=None, cef_data_type=None, tags=None, input_json=None, **kwargs):
+    """
+    Update an artifact with the specified attributes. All parameters are optional, except that cef_field and cef_value must both be provided if one is provided.
+    
+    Args:
+        artifact_id (CEF type: phantom artifact id): ID of the artifact to update, which is required.
+        name: Change the name of the artifact.
+        label: Change the label of the artifact.
+        severity: Change the severity of the artifact. Typically this is either "High", "Medium", or "Low".
+        cef_field: The name of the CEF field to populate in the artifact, such as "destinationAddress" or "sourceDnsDomain". Required only if cef_value is provided.
+        cef_value (CEF type: *): The value of the CEF field to populate in the artifact, such as the IP address, domain name, or file hash. Required only if cef_field is provided.
+        cef_data_type: The CEF data type of the data in cef_value. For example, this could be "ip", "hash", or "domain". Optional, but only operational if cef_field is provided.
+        tags: A comma-separated list of tags to apply to the artifact, which is optional.
+        input_json: Optional parameter to modify any extra attributes of the artifact. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    updated_artifact = {}
+    
+    if not isinstance(artifact_id, int):
+        raise TypeError("artifact_id is required")
+
+    if name:
+        updated_artifact['name'] = name
+    if label:
+        updated_artifact['label'] = label
+    if severity:
+        updated_artifact['severity'] = severity
+
+    # validate that if cef_field or cef_value is provided, the other is also provided
+    if (cef_field and not cef_value) or (cef_value and not cef_field):
+        raise ValueError("only one of cef_field and cef_value was provided")
+
+    # cef_data should be formatted {cef_field: cef_value}
+    if cef_field:
+        updated_artifact['cef'] = {cef_field: cef_value}
+        if cef_data_type and isinstance(cef_data_type, str):
+            updated_artifact['cef_types'] = {cef_field: [cef_data_type]}
+    
+    # separate tags by comma
+    if tags:
+        tags = tags.replace(" ", "").split(",")
+        updated_artifact['tags'] = tags
+    
+    if input_json:
+        json_dict = json.loads(input_json)
+        # Merge dictionaries, using the value from json_dict if there are any conflicting keys
+        for json_key in json_dict:
+            updated_artifact[json_key] = json_dict[json_key]
+    
+    # now actually update the artifact
+    phantom.debug('updating artifact {} with the following attributes:\n{}'.format(artifact_id, updated_artifact))
+    url = phantom.build_phantom_rest_url('artifact', artifact_id)
+    response = phantom.requests.post(url, json=updated_artifact, verify=False).json()
+
+    phantom.debug('POST /rest/artifact returned the following response:\n{}'.format(response))
+    if 'success' not in response or response['success'] != True:
+        raise RuntimeError("POST /rest/artifact failed")
+
+    return
diff --git a/playbooks/custom_functions/asset_get_attributes.json b/playbooks/custom_functions/asset_get_attributes.json
new file mode 100644
index 0000000000..e438ef4871
--- /dev/null
+++ b/playbooks/custom_functions/asset_get_attributes.json
@@ -0,0 +1,77 @@
+{
+    "create_time": "2021-08-24T13:51:40.605448+00:00",
+    "custom_function_id": "5ca49f921dfa723aff4e340671d610634f89e262",
+    "description": "Allows the retrieval of an attribute from an asset configuration for access in a playbook. This can be valuable in instances such as a dynamic note that references the Asset hostname. Must provide asset name or id.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "Asset numeric ID or asset name.",
+            "input_type": "item",
+            "name": "asset",
+            "placeholder": "splunk_es"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "id",
+            "description": "Unique asset id"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "name",
+            "description": "Unique asset name"
+        },
+        {
+            "contains_type": [],
+            "data_path": "configuration",
+            "description": "Access individual configuration attributes by appending \".<keyname>\"\nExample: configuration.device"
+        },
+        {
+            "contains_type": [],
+            "data_path": "tags",
+            "description": "Asset tags"
+        },
+        {
+            "contains_type": [],
+            "data_path": "description",
+            "description": "Asset description"
+        },
+        {
+            "contains_type": [],
+            "data_path": "product_name",
+            "description": "Asset product_name"
+        },
+        {
+            "contains_type": [],
+            "data_path": "product_vendor",
+            "description": "Asset product_vendor"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "product_version",
+            "description": "Asset product_version"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "type",
+            "description": "Asset type"
+        },
+        {
+            "contains_type": [],
+            "data_path": "version",
+            "description": "Asset version"
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/asset_get_attributes.py b/playbooks/custom_functions/asset_get_attributes.py
new file mode 100644
index 0000000000..89a575257e
--- /dev/null
+++ b/playbooks/custom_functions/asset_get_attributes.py
@@ -0,0 +1,50 @@
+def asset_get_attributes(asset=None, **kwargs):
+    """
+    Allows the retrieval of an attribute from an asset configuration for access in a playbook. This can be valuable in instances such as a dynamic note that references the Asset hostname. Must provide asset name or id.
+    
+    Args:
+        asset: Asset numeric ID or asset name.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        id: Unique asset id
+        name: Unique asset name
+        configuration: Access individual configuration attributes by appending ".<keyname>"
+            Example: configuration.device
+        tags: Asset tags
+        description: Asset description
+        product_name: Asset product_name
+        product_vendor: Asset product_vendor
+        product_version: Asset product_version
+        type: Asset type
+        version: Asset version
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    url = phantom.build_phantom_rest_url('asset') 
+    
+    if isinstance(asset, int):
+        url += '/{}'.format(asset)
+        
+    # Attempt to translate asset_name to asset_id
+    elif isinstance(asset, str):
+        params = {'_filter_name': '"{}"'.format(asset)}
+        response = phantom.requests.get(uri=url, params=params, verify=False).json()
+        if response['count'] == 1:
+            url += '/{}'.format(response['data'][0]['id'])
+        else:
+            raise RuntimeError("No valid asset id found for provided asset name: {}".format(asset))
+    else:
+        raise TypeError("No valid asset id or name provided.")
+        
+    response = phantom.requests.get(uri=url, verify=False).json()
+    if response.get('id'):
+        outputs = response
+    else:
+        raise RuntimeError("No valid asset id found.")
+        
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/base64_decode.json b/playbooks/custom_functions/base64_decode.json
new file mode 100644
index 0000000000..f3d97da0cd
--- /dev/null
+++ b/playbooks/custom_functions/base64_decode.json
@@ -0,0 +1,51 @@
+{
+    "create_time": "2021-10-18T17:15:17.576903+00:00",
+    "custom_function_id": "a5663cbe44479126d9fdff5818c8500011abc53e",
+    "description": "Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Y2FsYy5leGU=",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": "base64 string to decode"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.",
+            "input_type": "item",
+            "name": "split_input",
+            "placeholder": "True or False"
+        },
+        {
+            "contains_type": [],
+            "description": "The character to use as a delimiter if split_input is True. Defaults to a comma. The special option \"space\" can be used to split on a single space character (\" \").",
+            "input_type": "item",
+            "name": "delimiter",
+            "placeholder": ","
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.input_string",
+            "description": "Base64 string before being decoded"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.output_string",
+            "description": "Resulting string after decoding from base64"
+        }
+    ],
+    "platform_version": "5.0.1.66250",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/base64_decode.py b/playbooks/custom_functions/base64_decode.py
new file mode 100644
index 0000000000..c43458612a
--- /dev/null
+++ b/playbooks/custom_functions/base64_decode.py
@@ -0,0 +1,66 @@
+def base64_decode(input_string=None, split_input=None, delimiter=None, **kwargs):
+    """
+    Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.
+    
+    Args:
+        input_string (CEF type: *): Y2FsYy5leGU=
+        split_input: Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.
+        delimiter: The character to use as a delimiter if split_input is True. Defaults to a comma. The special option "space" can be used to split on a single space character (" ").
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.input_string (CEF type: *): Base64 string before being decoded
+        *.output_string (CEF type: *): Resulting string after decoding from base64
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import base64
+
+    if not input_string or not isinstance(input_string, str):
+        raise ValueError('input_string must be a string')
+
+    def isBase64(sb):
+        try:
+            if isinstance(sb, str):
+                # If there's any unicode here, an exception will be thrown and the function will return false
+                sb_bytes = bytes(sb, 'ascii')
+            elif isinstance(sb, bytes):
+                sb_bytes = sb
+            else:
+                raise ValueError("Argument must be string or bytes")
+            return base64.b64encode(base64.b64decode(sb_bytes)) == sb_bytes
+        except Exception:
+            return False
+    
+    outputs = []
+    
+    # split_input defaults to false
+    if split_input == True or (isinstance(split_input, str) and split_input.lower() == 'true'):
+        split_input = True
+    else:
+        split_input = False
+        
+    # create the list of inputs, whether it be the single input or a delimiter-separated list
+    if not split_input:
+        input_list = [input_string]
+    else:
+        if not isinstance(delimiter, str):
+            delimiter = ','
+        if delimiter == 'space':
+            delimiter = ' '
+        input_list = input_string.split(delimiter)
+    
+    # now that input_list is set up, perform the base64 decode on each item that is valid base64
+    for index, value in enumerate(input_list):         
+        if isBase64(value):
+            try:
+                value_bytes = value.encode('ascii')
+                data = base64.b64decode(value_bytes, validate=True)
+                if data:
+                    outputs.append({'input_string': value, 'output_string': data.decode('ascii').replace('\x00','')})
+
+            except Exception as e:
+                phantom.error(f'Unable to decode string: {e}')
+
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/collect_by_cef_type.json b/playbooks/custom_functions/collect_by_cef_type.json
new file mode 100644
index 0000000000..8be2ec73ff
--- /dev/null
+++ b/playbooks/custom_functions/collect_by_cef_type.json
@@ -0,0 +1,56 @@
+{
+    "create_time": "2021-08-24T16:17:12.241297+00:00",
+    "custom_function_id": "98612a9a22a18dff43b6644ed00c2c523d348d79",
+    "description": "Collect all artifact values that match the desired CEF data types, such as \"ip\", \"url\", \"sha1\", or \"all\". Optionally also filter for artifacts that have the specified tags.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "Container ID or container object.",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "The CEF data type to collect values for. This could be a single string or a comma separated list such as \"hash,filehash,file_hash\". The special value \"all\" can also be used to collect all field values from all artifacts.",
+            "input_type": "item",
+            "name": "data_types",
+            "placeholder": "data_type1, data_type2, data_type3"
+        },
+        {
+            "contains_type": [],
+            "description": "If tags are provided, only return fields from artifacts that have all of the provided tags. This could be an individual tag or a comma separated list.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1,tag2,tag3"
+        },
+        {
+            "contains_type": [],
+            "description": "Defaults to 'new'. Define custom scope. Advanced Settings Scope is not passed to a custom function. Options are 'all' or 'new'.",
+            "input_type": "item",
+            "name": "scope",
+            "placeholder": "new"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.artifact_value",
+            "description": "The value of the field with the matching CEF data type."
+        },
+        {
+            "contains_type": [
+                "phantom artifact id"
+            ],
+            "data_path": "*.artifact_id",
+            "description": "ID of the artifact that contains the value."
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/collect_by_cef_type.py b/playbooks/custom_functions/collect_by_cef_type.py
new file mode 100644
index 0000000000..a38f0d41cc
--- /dev/null
+++ b/playbooks/custom_functions/collect_by_cef_type.py
@@ -0,0 +1,90 @@
+def collect_by_cef_type(container=None, data_types=None, tags=None, scope=None, **kwargs):
+    """
+    Collect all artifact values that match the desired CEF data types, such as "ip", "url", "sha1", or "all". Optionally also filter for artifacts that have the specified tags.
+    
+    Args:
+        container (CEF type: phantom container id): Container ID or container object.
+        data_types: The CEF data type to collect values for. This could be a single string or a comma separated list such as "hash,filehash,file_hash". The special value "all" can also be used to collect all field values from all artifacts.
+        tags: If tags are provided, only return fields from artifacts that have all of the provided tags. This could be an individual tag or a comma separated list.
+        scope: Defaults to 'new'. Define custom scope. Advanced Settings Scope is not passed to a custom function. Options are 'all' or 'new'.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.artifact_value (CEF type: *): The value of the field with the matching CEF data type.
+        *.artifact_id (CEF type: phantom artifact id): ID of the artifact that contains the value.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import traceback
+
+    # validate container and get ID
+    if isinstance(container, dict) and container['id']:
+        container_dict = container
+        container_id = container['id']
+    elif isinstance(container, int):
+        rest_container = phantom.requests.get(uri=phantom.build_phantom_rest_url('container', container), verify=False).json()
+        if 'id' not in rest_container:
+            raise ValueError('Failed to find container with id {container}')
+        container_dict = rest_container
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    # validate the data_types input
+    if not data_types or not isinstance(data_types, str):
+        raise ValueError("The input 'data_types' must exist and must be a string")
+    # if data_types has a comma, split it and treat it as a list
+    elif "," in data_types:
+        data_types = [item.strip() for item in data_types.split(",")]
+    # else it must be a single data type
+    else:
+        data_types = [data_types]
+    
+    # validate scope input
+    if isinstance(scope, str) and scope.lower() in ['new', 'all']:
+        scope = scope.lower()
+    elif not scope:
+        scope = None
+    else:
+        raise ValueError("The input 'scope' is not one of 'new' or 'all'")
+        
+    # split tags if it contains commas or use as-is
+    if not tags:
+        tags = []
+    # if tags has a comma, split it and treat it as a list
+    elif tags and "," in tags:
+        tags = [item.strip() for item in tags.split(",")]
+    # if there is no comma, treat it as a single tag
+    else:
+        tags = [tags]
+
+    # collect all values matching the cef type (which was previously called "contains")
+    collected_field_values = phantom.collect_from_contains(container=container_dict, action_results=None, contains=data_types, scope=scope)
+    phantom.debug(f'found the following field values: {collected_field_values}')
+
+    # collect all the artifacts in the container to get the artifact IDs
+    artifacts = phantom.requests.get(uri=phantom.build_phantom_rest_url('container', container_id, 'artifacts'), params={'page_size': 0}, verify=False).json()['data']
+
+    # build the output list from artifacts with the collected field values
+    outputs = []
+    for artifact in artifacts:
+        # if any tags are provided, make sure each provided tag is in the artifact's tags
+        if tags:
+            if not set(tags).issubset(set(artifact['tags'])):
+                continue
+        # "all" is a special value to collect every value from every artifact
+        if data_types == ['all']:
+            for cef_key in artifact['cef']:
+                new_output = {'artifact_value': artifact['cef'][cef_key], 'artifact_id': artifact['id']}
+                if new_output not in outputs:
+                    outputs.append(new_output)
+            continue
+        for cef_key in artifact['cef']:
+            if artifact['cef'][cef_key] in collected_field_values:
+                new_output = {'artifact_value': artifact['cef'][cef_key], 'artifact_id': artifact['id']}
+                if new_output not in outputs:
+                    outputs.append(new_output)
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/container_merge.json b/playbooks/custom_functions/container_merge.json
new file mode 100644
index 0000000000..9ea4df87bc
--- /dev/null
+++ b/playbooks/custom_functions/container_merge.json
@@ -0,0 +1,41 @@
+{
+    "create_time": "2021-10-18T12:31:32.500833+00:00",
+    "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72",
+    "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "The target container to copy the information over. Supports container dictionary or container id.",
+            "input_type": "item",
+            "name": "target_container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "A list of container IDs to copy into the target container.",
+            "input_type": "list",
+            "name": "container_list",
+            "placeholder": "[1, 5, 10]"
+        },
+        {
+            "contains_type": [],
+            "description": "Name or ID of the workbook to add if the container does not have a workbook yet. If no workbook is provided, the system default workbook will be added.",
+            "input_type": "item",
+            "name": "workbook",
+            "placeholder": "My Workbook"
+        },
+        {
+            "contains_type": [],
+            "description": "True or False to close the child containers in the container_list after merge. Defaults to False.",
+            "input_type": "item",
+            "name": "close_containers",
+            "placeholder": "True or False"
+        }
+    ],
+    "outputs": [],
+    "platform_version": "5.0.1.66250",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/container_merge.py b/playbooks/custom_functions/container_merge.py
new file mode 100644
index 0000000000..c301bbb310
--- /dev/null
+++ b/playbooks/custom_functions/container_merge.py
@@ -0,0 +1,192 @@
+def container_merge(target_container=None, container_list=None, workbook=None, close_containers=None, **kwargs):
+    """
+    An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.
+    
+    The notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. 
+    
+    Any notes left as a consequence of the merge process will be skipped in subsequent merges.
+    
+    Args:
+        target_container (CEF type: phantom container id): The target container to copy the information over. Supports container dictionary or container id.
+        container_list: A list of container IDs to copy into the target container.
+        workbook: Name or ID of the workbook to add if the container does not have a workbook yet. If no workbook is provided, the system default workbook will be added.
+        close_containers: True or False to close the child containers in the container_list after merge. Defaults to False.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    
+    # Check if valid target_container input was provided
+    if isinstance(target_container, int):
+        container = phantom.get_container(target_container)
+    elif isinstance(target_container, dict):
+        container = target_container
+    else:
+        raise TypeError(f"target_container '{target_container}' is neither a int or a dictionary")
+    
+    container_url = phantom.build_phantom_rest_url('container', container['id'])
+    
+    # Check if container_list input is a list of IDs
+    if isinstance(container_list, list) and (all(isinstance(x, int) for x in container_list) or all(x.isnumeric() for x in container_list)):
+        pass
+    else:
+        raise TypeError(f"container_list '{container_list}' is not a list of integers")
+
+    ## Prep parent container as case with workbook ##
+    workbook_name = phantom.requests.get(container_url, verify=False).json().get('workflow_name')
+    # If workbook already exists, proceed to promote to case
+    if workbook_name:
+        phantom.debug("workbook already exists. adding [Parent] to container name and promoting to case")
+        update_data = {'container_type': 'case'}
+        if not '[Parent]' in container['name']:
+            update_data['name'] = "[Parent] {}".format(container['name'])
+            phantom.update(container, update_data)
+        else:
+            phantom.update(container, update_data)
+    # If no workbook exists, add one
+    else:
+        phantom.debug("no workbook in container. adding one by name or using the default")
+        # If workbook ID was provided, add it
+        if isinstance(workbook, int):
+            workbook_id = workbook
+            phantom.add_workbook(container=container['id'], workbook_id=workbook_id)
+        # elif workbook name was provided, attempt to translate it to an id
+        elif isinstance(workbook, str):
+            workbook_url = phantom.build_phantom_rest_url('workbook_template') + '?_filter_name="{}"'.format(workbook)
+            response = phantom.requests.get(workbook_url, verify=False).json()
+            if response['count'] > 1:
+                raise RuntimeError('Unable to add workbook - more than one ID matches workbook name')
+            elif response['data'][0]['id']:
+                workbook_id = response['data'][0]['id']
+                phantom.add_workbook(container=container['id'], workbook_id=workbook_id)
+        else:
+            # Adding default workbook
+            phantom.promote(container=container['id'])
+        # Check again to see if a workbook now exists
+        workbook_name = phantom.requests.get(container_url, verify=False).json().get('workflow_name')
+        # If workbook is now present, promote to case
+        if workbook_name:
+            update_data = {'container_type': 'case'}
+            if not '[Parent]' in container['name']:
+                update_data['name'] = "[Parent] {}".format(container['name'])
+                phantom.update(container, update_data)
+            else:
+                phantom.update(container, update_data)
+        else:
+            raise RuntimeError(f"Error occurred during workbook add for workbook '{workbook_name}'")
+            
+    ## Check if current phase is set. If not, set the current phase to the first available phase to avoid artifact merge error ##
+    if not container.get('current_phase_id'):
+        phantom.debug("no current phase, so setting first available phase to current")
+        workbook_phase_url = phantom.build_phantom_rest_url('workbook_phase') + "?_filter_container={}".format(container['id'])
+        request_json = phantom.requests.get(workbook_phase_url, verify=False).json()
+        update_data = {'current_phase_id': request_json['data'][0]['id']}
+        phantom.update(container, update_data)
+    
+    child_container_list = []
+    child_container_name_list = []
+    # Iterate through child containers 
+    for child_container_id in container_list:
+        
+        ### Begin child container processing ###
+        phantom.debug("Processing Child Container ID: {}".format(child_container_id))
+        
+        child_container = phantom.get_container(child_container_id)
+        child_container_list.append(child_container_id)
+        child_container_name_list.append(child_container['name'])
+        child_container_url = phantom.build_phantom_rest_url('container', child_container_id) 
+        
+        ## Update container name with parent relationship
+        if not "[Parent:" in child_container['name']:
+            update_data = {'name': "[Parent: {0}] {1}".format(container['id'], child_container['name'])}
+            phantom.update(child_container, update_data)
+        
+        ## Gather and add notes ##
+        for note in phantom.get_notes(container=child_container_id):
+            # Avoid copying any notes related to the merge process.
+            if note['success'] and not note['data']['title'] in ('[Auto-Generated] Related Containers', 
+                                                                 '[Auto-Generated] Parent Container', 
+                                                                 '[Auto-Generated] Child Containers'):
+                phantom.add_note(container=container['id'],
+                                 note_type='general',
+                                 note_format=note['data']['note_format'],
+                                 title="[From Event {0}] {1}".format(note['data']['container'], note['data']['title']),
+                                 content=note['data']['content'])
+                 
+        ## Copy information and add to case
+        data = {'add_to_case': True,
+                'container_id': child_container_id,
+                'copy_artifacts': True,
+                'copy_automation': True,
+                'copy_files': True,
+                'copy_comments': True
+               }   
+        phantom.requests.post(container_url, json=data, verify=False)
+        
+        ## Leave a note with a link to the parent container
+        phantom.debug("Adding parent relationship note to child container '{}'".format(child_container_id))
+        data_row = "{0} | [{1}]({2}/mission/{0}) |".format(container['id'], container['name'], phantom.get_base_url())
+        phantom.add_note(container=child_container_id,
+                         note_type="general",
+                         note_format="markdown",
+                         title="[Auto-Generated] Parent Container",
+                         content="| Container_ID | Container_Name |\n| --- | --- |\n| {}".format(data_row))
+        
+        ## Mark child container as evidence in target_container
+        data = {
+            "container_id": container['id'],
+            "object_id": child_container_id,
+            "content_type": "container"
+        }
+        evidence_url = phantom.build_phantom_rest_url('evidence')
+        response = phantom.requests.post(evidence_url, json=data, verify=False).json()
+        
+        ## Close child container
+        if isinstance(close_containers, str) and close_containers.lower() == 'true':
+            phantom.set_status(container=child_container_id, status="closed")
+            
+        ### End child container processing ###
+        
+    ## Format and add note for link back to child_containers in parent_container
+    note_title = "[Auto-Generated] Child Containers"
+    note_format = "markdown"
+    format_list = []
+    # Build new note
+    for child_container_id,child_container_name in zip(child_container_list,child_container_name_list):
+        format_list.append("| {0} | [{1}]({2}/mission/{0}) |\n".format(child_container_id, child_container_name, phantom.get_base_url()))
+    # Fetch any previous merge note
+    params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'}
+    note_url = phantom.build_phantom_rest_url('note')
+    response_data = phantom.requests.get(note_url, verify=False).json()
+    # If an old note was found, proceed to overwrite it
+    if response_data['count'] > 0:
+        note_item = response_data['data'][0]
+        note_content = note_item['content']
+        # Append new information to existing note
+        for c_note in format_list:
+            note_content += c_note
+        data = {"note_type": "general",
+                "title": note_title,
+                "content": note_content,
+                "note_format": note_format}
+        # Overwrite note
+        response_data = phantom.requests.post(note_url + "/{}".format(note_item['id']), json=data, verify=False).json()
+    # If no old note was found, add new with header               
+    else:
+        template = "| Container ID | Container Name |\n| --- | --- |\n"
+        for c_note in format_list:
+            template += c_note
+        success, message, process_container_merge__note_id = phantom.add_note(container=container, 
+                                                                              note_type="general", 
+                                                                              title=note_title, 
+                                                                              content=template, 
+                                                                              note_format=note_format)
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/container_update.json b/playbooks/custom_functions/container_update.json
new file mode 100644
index 0000000000..5ac43b8864
--- /dev/null
+++ b/playbooks/custom_functions/container_update.json
@@ -0,0 +1,85 @@
+{
+    "create_time": "2021-07-19T18:11:14.706144+00:00",
+    "custom_function_id": "7272e46db8e97248abb1584c72c0734ff9e303dc",
+    "description": "Allows updating various attributes of a container in a single custom function. Any attributes of a container not listed can be updated via the input_json parameter. ",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "Supports a container id or container dictionary",
+            "input_type": "item",
+            "name": "container_input",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change container name",
+            "input_type": "item",
+            "name": "name",
+            "placeholder": "My Container Name"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container description",
+            "input_type": "item",
+            "name": "description",
+            "placeholder": "My Container Description"
+        },
+        {
+            "contains_type": [
+                "phantom container label"
+            ],
+            "description": "Optional parameter to change the container label",
+            "input_type": "item",
+            "name": "label",
+            "placeholder": "my_label"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container owner. Accepts a username or role name or keyword \"current\" to set the currently running playbook user as the owner.",
+            "input_type": "item",
+            "name": "owner",
+            "placeholder": "admin"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container sensitivity. ",
+            "input_type": "item",
+            "name": "sensitivity",
+            "placeholder": "amber"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container severity.",
+            "input_type": "item",
+            "name": "severity",
+            "placeholder": "medium"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container status.",
+            "input_type": "item",
+            "name": "status",
+            "placeholder": "open"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to change the container tags. Must be in the format of a comma separated list.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1, tag2"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to modify any extra attributes of a container. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.",
+            "input_type": "item",
+            "name": "input_json",
+            "placeholder": "{\"custom_fields\": {\"field_name\": \"field_value\"}}"
+        }
+    ],
+    "outputs": [],
+    "platform_version": "4.10.4.56260",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/container_update.py b/playbooks/custom_functions/container_update.py
new file mode 100644
index 0000000000..bed550a3b6
--- /dev/null
+++ b/playbooks/custom_functions/container_update.py
@@ -0,0 +1,85 @@
+def container_update(container_input=None, name=None, description=None, label=None, owner=None, sensitivity=None, severity=None, status=None, tags=None, input_json=None, **kwargs):
+    """
+    Allows updating various attributes of a container in a single custom function. Any attributes of a container not listed can be updated via the input_json parameter. 
+    
+    Args:
+        container_input (CEF type: phantom container id): Supports a container id or container dictionary
+        name: Optional parameter to change container name
+        description: Optional parameter to change the container description
+        label (CEF type: phantom container label): Optional parameter to change the container label
+        owner: Optional parameter to change the container owner. Accepts a username or role name or keyword "current" to set the currently running playbook user as the owner.
+        sensitivity: Optional parameter to change the container sensitivity. 
+        severity: Optional parameter to change the container severity.
+        status: Optional parameter to change the container status.
+        tags: Optional parameter to change the container tags. Must be in the format of a comma separated list.
+        input_json: Optional parameter to modify any extra attributes of a container. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    update_dict = {}
+    
+    if isinstance(container_input, int):
+        container = phantom.get_container(container_input)
+    elif isinstance(container_input, dict):
+        container = container_input
+    else:
+        raise TypeError("container_input is neither a int or a dictionary")
+    
+    if name:
+        update_dict['name'] = name
+    if description:
+        update_dict['description'] = description
+    if label:
+        update_dict['label'] = label
+    if owner:
+        # If keyword 'current' entered then translate effective_user id to a username
+        if owner.lower() == 'current':
+            update_dict['owner_id'] = phantom.get_effective_user()
+        else:
+            # Attempt to translate name to owner_id
+            url = phantom.build_phantom_rest_url('ph_user') + f'?_filter_username="{owner}"'
+            data = phantom.requests.get(url, verify=False).json().get('data')
+            if data and len(data) == 1:
+                update_dict['owner_id'] = data[0]['id']
+            elif data and len(data) > 1:
+                phantom.error(f'Multiple matches for owner "{owner}"')
+            else:
+                # Attempt to translate name to role_id
+                url = phantom.build_phantom_rest_url('role') + f'?_filter_name="{owner}"'
+                data = phantom.requests.get(url, verify=False).json().get('data')
+                if data and len(data) == 1:
+                    update_dict['role_id'] = data[0]['id']
+                elif data and len(data) > 1:
+                    phantom.error(f'Multiple matches for role "{owner}"')
+                else:
+                    phantom.error(f'"{owner}" is not a valid username or role')
+    if sensitivity:
+        update_dict['sensitivity'] = sensitivity
+    if severity:
+        update_dict['severity'] = severity
+    if status:
+        update_dict['status'] = status
+    if tags:
+        tags = tags.replace(" ", "").split(",")
+        update_dict['tags'] = tags
+    if input_json:
+        json_dict = json.loads(input_json)
+        # Merge dictionaries together. The second argument, "**json_dict" will take precedence and overwrite any duplicate parameters.
+        update_dict = {**update_dict, **json_dict}
+    
+    if update_dict:
+        phantom.debug('Updating container {0} with the following information: "{1}"'.format(container['id'], update_dict))
+        phantom.update(container, update_dict)
+    else:
+        phantom.debug("Valid container entered but no valid container changes provided.")
+        
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/custom_list_enumerate.json b/playbooks/custom_functions/custom_list_enumerate.json
new file mode 100644
index 0000000000..0c12ad0d42
--- /dev/null
+++ b/playbooks/custom_functions/custom_list_enumerate.json
@@ -0,0 +1,71 @@
+{
+    "create_time": "2021-03-24T13:38:50.951017+00:00",
+    "custom_function_id": "b7a89f44958aee7bbdb3054d43c06df9a2026370",
+    "description": "Fetch a custom list and iterate through the rows, producing a dictionary output for each row with the row number and the value for each column.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [],
+            "description": "the name or ID of a custom list",
+            "input_type": "item",
+            "name": "custom_list",
+            "placeholder": "my_custom_list"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "*.row_num",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_0",
+            "description": ""
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "*.column_1",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_2",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_3",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_4",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_5",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_6",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_7",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.column_8",
+            "description": ""
+        }
+    ],
+    "platform_version": "4.10.2.47587",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/custom_list_enumerate.py b/playbooks/custom_functions/custom_list_enumerate.py
new file mode 100644
index 0000000000..eb75286321
--- /dev/null
+++ b/playbooks/custom_functions/custom_list_enumerate.py
@@ -0,0 +1,49 @@
+def custom_list_enumerate(custom_list=None, **kwargs):
+    """
+    Fetch a custom list and iterate through the rows, producing a dictionary output for each row with the row number and the value for each column.
+    
+    Args:
+        custom_list: the name or ID of a custom list
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.row_num
+        *.column_0
+        *.column_1
+        *.column_2
+        *.column_3
+        *.column_4
+        *.column_5
+        *.column_6
+        *.column_7
+        *.column_8
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    if not custom_list:
+        raise ValueError('list_name_or_num parameter is required')
+    
+    outputs = []
+    
+    # Use REST to get the custom list
+    custom_list_request = phantom.requests.get(
+        phantom.build_phantom_rest_url('decided_list', custom_list),
+        verify=False
+    )
+    
+    # Raise error if unsuccessful
+    custom_list_request.raise_for_status()
+    
+    # Get the list content
+    custom_list = custom_list_request.json().get('content', [])
+    
+    # Iterate through all rows and save to a list of dicts
+    for row_num, row in enumerate(custom_list):
+        row_dict = {'column_{}'.format(col): val for col, val in enumerate(row)}
+        row_dict['row_num'] = row_num
+        outputs.append(row_dict)
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/custom_list_value_in_strings.json b/playbooks/custom_functions/custom_list_value_in_strings.json
new file mode 100644
index 0000000000..34d25c78e6
--- /dev/null
+++ b/playbooks/custom_functions/custom_list_value_in_strings.json
@@ -0,0 +1,56 @@
+{
+    "create_time": "2021-09-20T17:42:46.572482+00:00",
+    "custom_function_id": "2ec78e71ee35dce744423a989e7efcaa0b17f51f",
+    "description": "Iterates through all items of a custom list to see if any list value (i.e. \"sample.com\") exists in the input you are comparing it to (i.e \"findme.sample.com\"). Returns a list of matches, a list of misses, a count of matches, and a count of misses.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "Name of the custom list. Every string in this list will be compared to see if it is a substring of any of the comparison_strings",
+            "input_type": "item",
+            "name": "custom_list",
+            "placeholder": "custom_list_name"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "String to use for comparison.",
+            "input_type": "list",
+            "name": "comparison_strings",
+            "placeholder": "comparison_strings"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "matches.*.match",
+            "description": "List of all items from the list that are substrings of any of the comparison strings"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "match_count",
+            "description": "Number of matches"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "misses.*.miss",
+            "description": "List of all items from the list that are not substrings of any of the comparison strings"
+        },
+        {
+            "contains_type": [],
+            "data_path": "miss_count",
+            "description": "Number of misses"
+        }
+    ],
+    "platform_version": "4.10.7.63984",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/custom_list_value_in_strings.py b/playbooks/custom_functions/custom_list_value_in_strings.py
new file mode 100644
index 0000000000..5974828243
--- /dev/null
+++ b/playbooks/custom_functions/custom_list_value_in_strings.py
@@ -0,0 +1,49 @@
+def custom_list_value_in_strings(custom_list=None, comparison_strings=None, **kwargs):
+    """
+    Iterates through all items of a custom list to see if any list value (i.e. "sample.com") exists in the input you are comparing it to (i.e "findme.sample.com"). Returns a list of matches, a list of misses, a count of matches, and a count of misses.
+    
+    Args:
+        custom_list: Name of the custom list. Every string in this list will be compared to see if it is a substring of any of the comparison_strings
+        comparison_strings (CEF type: *): String to use for comparison.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        matches.*.match (CEF type: *): List of all items from the list that are substrings of any of the comparison strings
+        match_count: Number of matches
+        misses.*.miss (CEF type: *): List of all items from the list that are not substrings of any of the comparison strings
+        miss_count: Number of misses
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+
+    # Get the custom list
+    success, message, this_list = phantom.get_list(list_name=custom_list)
+
+    # Create the lists to store matches and misses
+    matches = []
+    misses = []
+
+    # Loop through each comparison string
+    for comparison_string in comparison_strings:
+
+        # Loop through the custom list to see if any list value is found in the comparison string
+        for row in this_list:
+            for cell in row:
+                if comparison_string.find(cell) != -1:
+                    matches.append({"match": cell})
+                else:
+                    misses.append({"miss": cell})
+
+    # Prepare the outputs
+    match_count = len(matches)
+    miss_count = len(misses)
+    outputs = {
+        'matches': matches,
+        'match_count': match_count,
+        'misses': misses,
+        'miss_count': miss_count,
+    }
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
\ No newline at end of file
diff --git a/playbooks/custom_functions/datetime_modify.json b/playbooks/custom_functions/datetime_modify.json
new file mode 100644
index 0000000000..b5f4ffec40
--- /dev/null
+++ b/playbooks/custom_functions/datetime_modify.json
@@ -0,0 +1,66 @@
+{
+    "create_time": "2021-08-20T19:37:15.192987+00:00",
+    "custom_function_id": "1df6dfb4792ebd6ffca642caf7056300a16ce635",
+    "description": "Change a timestamp by adding or subtracting minutes, hours, or days.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "The datetime to modify, which should be provided in a string format determined by input_format_string",
+            "input_type": "item",
+            "name": "input_datetime",
+            "placeholder": "2020-06-27T14:53:08.219016Z"
+        },
+        {
+            "contains_type": [],
+            "description": "The format string to use for the input according to the Python's datetime.strptime() formatting rules. If none is provided the default will be '%Y-%m-%dT%H:%M:%S.%fZ'. In addition to strptime() formats, the special format \"epoch\" can be used to accept unix epoch timestamps.",
+            "input_type": "item",
+            "name": "input_format_string",
+            "placeholder": "%Y-%m-%dT%H:%M:%S.%fZ"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "description": "Choose a unit to modify the date by, which must be either seconds, minutes, hours, or days. If none is provided the default will be 'minutes'",
+            "input_type": "item",
+            "name": "modification_unit",
+            "placeholder": "minutes"
+        },
+        {
+            "contains_type": [],
+            "description": "The number of seconds, minutes, hours, or days to add or subtract. Use a negative number such as -1.5 to subtract time. Defaults to zero.",
+            "input_type": "item",
+            "name": "amount_to_modify",
+            "placeholder": "0"
+        },
+        {
+            "contains_type": [],
+            "description": "The format string to use for the output according to the Python's datetime.strftime() formatting rules. If none is provided the default will be '%Y-%m-%dT%H:%M:%S.%fZ'.",
+            "input_type": "item",
+            "name": "output_format_string",
+            "placeholder": "%Y-%m-%dT%H:%M:%S.%fZ"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "datetime_string",
+            "description": "The output datetime as formatted by the given output_format_string using Python's datetime.strftime()"
+        },
+        {
+            "contains_type": [],
+            "data_path": "epoch_time",
+            "description": "An integer representing the output time as a number of seconds since January 1 1970 assuming a naive UTC timezone. This is easier to use for comparisons to other epoch timestamps."
+        },
+        {
+            "contains_type": [],
+            "data_path": "seconds_modified",
+            "description": "The number of seconds (positive or negative) by which the input was modified"
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/datetime_modify.py b/playbooks/custom_functions/datetime_modify.py
new file mode 100644
index 0000000000..259a16d012
--- /dev/null
+++ b/playbooks/custom_functions/datetime_modify.py
@@ -0,0 +1,92 @@
+def datetime_modify(input_datetime=None, input_format_string=None, modification_unit=None, amount_to_modify=None, output_format_string=None, **kwargs):
+    """
+    Change a timestamp by adding or subtracting minutes, hours, or days.
+    
+    Args:
+        input_datetime: The datetime to modify, which should be provided in a string format determined by input_format_string
+        input_format_string: The format string to use for the input according to the Python's datetime.strptime() formatting rules. If none is provided the default will be '%Y-%m-%dT%H:%M:%S.%fZ'. In addition to strptime() formats, the special format "epoch" can be used to accept unix epoch timestamps.
+        modification_unit: Choose a unit to modify the date by, which must be either seconds, minutes, hours, or days. If none is provided the default will be 'minutes'
+        amount_to_modify: The number of seconds, minutes, hours, or days to add or subtract. Use a negative number such as -1.5 to subtract time. Defaults to zero.
+        output_format_string: The format string to use for the output according to the Python's datetime.strftime() formatting rules. If none is provided the default will be '%Y-%m-%dT%H:%M:%S.%fZ'.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        datetime_string: The output datetime as formatted by the given output_format_string using Python's datetime.strftime()
+        epoch_time: An integer representing the output time as a number of seconds since January 1 1970 assuming a naive UTC timezone. This is easier to use for comparisons to other epoch timestamps.
+        seconds_modified: The number of seconds (positive or negative) by which the input was modified
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import datetime
+    
+    outputs = {}
+    
+    # set the input format string to the phantom default if none is provided
+    if not input_format_string:
+        input_format_string = "%Y-%m-%dT%H:%M:%S.%fZ"
+    
+    # set the date to the default, which is the current time if none is provided
+    if not input_datetime:
+        input_datetime = datetime.datetime.now().strftime(input_format_string)
+    
+    # use the phantom default as the output format string if none is provided
+    if not output_format_string:
+        output_format_string = "%Y-%m-%dT%H:%M:%S.%fZ"
+    
+    if input_format_string.lower() == 'epoch':
+        parsed_input = datetime.datetime.utcfromtimestamp(int(input_datetime))
+    else:
+        parsed_input = datetime.datetime.strptime(input_datetime, input_format_string)
+    phantom.debug("parsed the input datetime as: {}".format(parsed_input))
+    
+    # validate the modification_unit parameter, which must be a unit of time
+    if modification_unit == None:
+        modification_unit = 'minutes'
+    if modification_unit not in ['seconds', 'minutes', 'hours', 'days']:
+        raise ValueError('invalid modification_unit. must be either seconds, minutes, hours, or days.')
+    
+    # amount_to_modify defaults to zero
+    if not amount_to_modify:
+        amount_to_modify = 0
+        
+    # validate that amount_to_modify is an int or float (booleans will work as 0 or 1, but should not be used)
+    if not isinstance(amount_to_modify, int) and not isinstance(amount_to_modify, float):
+        raise ValueError('invalid amount_to_modify. must be an int or float')
+
+    # convert all time units to seconds
+    conversions = {
+        "seconds": 1,
+        "minutes": 60,
+        "hours": 60*60,
+        "days": 60*60*24
+    }
+    conversion_multiplier = conversions.get(modification_unit, None)
+    if not conversion_multiplier:
+        raise KeyError("failed to convert modification_unit to seconds")
+
+    seconds_to_modify = amount_to_modify * conversion_multiplier
+    if seconds_to_modify < 0:
+        phantom.debug("subtracting {} {} which is {} seconds".format(amount_to_modify * -1, modification_unit, seconds_to_modify * -1))
+    else:
+        phantom.debug("adding {} {} which is {} seconds".format(amount_to_modify, modification_unit, seconds_to_modify))
+    
+    outputs['seconds_modified'] = seconds_to_modify
+    seconds_to_modify = datetime.timedelta(seconds=seconds_to_modify)
+    
+    # do the actual modification
+    phantom.debug("adding {} plus {}".format(parsed_input, seconds_to_modify))
+    result_time = parsed_input + seconds_to_modify
+    phantom.debug("the unformatted result is: {}".format(result_time))
+    
+    # use the provided output_format_string to turn the output into a string
+    string_output = result_time.strftime(output_format_string)
+    phantom.debug("the formatted result is: {}".format(string_output))
+    outputs['datetime_string'] = string_output
+    
+    # also return an epoch time (seconds since Jan 1 1970) which assumes the input is a naive UTC datetime for time zone purposes
+    epoch_time = (result_time - datetime.datetime.utcfromtimestamp(0)).total_seconds()
+    outputs['epoch_time'] = epoch_time
+        
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
\ No newline at end of file
diff --git a/playbooks/custom_functions/debug.json b/playbooks/custom_functions/debug.json
new file mode 100644
index 0000000000..e514aefa3e
--- /dev/null
+++ b/playbooks/custom_functions/debug.json
@@ -0,0 +1,121 @@
+{
+    "create_time": "2021-04-28T19:54:35.225927+00:00",
+    "custom_function_id": "537aa035a6106bc6aeba14414631e2f17b7bc8bd",
+    "description": "Print debug messages with the type and value of 0-10 different inputs. This is useful for checking the values of input data or the outputs of other playbook blocks.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_1",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_2",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_3",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_4",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_5",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_6",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_7",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_8",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_9",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_10",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "*.input_name",
+            "description": "The variable name used for this input, such as input_1 or input_7"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.value",
+            "description": "The string representation of the value of this input"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "*.types",
+            "description": "The string representation of the type of this input, such as \"<type 'list'>\""
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/debug.py b/playbooks/custom_functions/debug.py
new file mode 100644
index 0000000000..abcb003301
--- /dev/null
+++ b/playbooks/custom_functions/debug.py
@@ -0,0 +1,40 @@
+def debug(input_1=None, input_2=None, input_3=None, input_4=None, input_5=None, input_6=None, input_7=None, input_8=None, input_9=None, input_10=None, **kwargs):
+    """
+    Print debug messages with the type and value of 0-10 different inputs. This is useful for checking the values of input data or the outputs of other playbook blocks.
+    
+    Args:
+        input_1 (CEF type: *)
+        input_2 (CEF type: *)
+        input_3 (CEF type: *)
+        input_4 (CEF type: *)
+        input_5 (CEF type: *)
+        input_6 (CEF type: *)
+        input_7 (CEF type: *)
+        input_8 (CEF type: *)
+        input_9 (CEF type: *)
+        input_10 (CEF type: *)
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.input_name: The variable name used for this input, such as input_1 or input_7
+        *.value (CEF type: *): The string representation of the value of this input
+        *.types: The string representation of the type of this input, such as "<type 'list'>"
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    output = []
+    for index, input_value in enumerate([input_1, input_2, input_3, input_4, input_5, input_6, input_7, input_8, input_9, input_10]):
+        this_output = {}
+        phantom.debug("input_{}:".format(index+1))
+        this_output['input_name'] = "input_{}".format(index+1)        
+        phantom.debug("    value: " + str(input_value))
+        this_output['value'] = str(input_value)
+        if isinstance(input_value, list):
+            list_item_types = str([type(list_item) for list_item in input_value])
+            phantom.debug("    types:  " + list_item_types)
+            this_output['types'] = list_item_types
+        output.append(this_output)
+	
+    assert json.dumps(output)  # Will raise an exception if the :outputs: object is not JSON-serializable    
+    return output
diff --git a/playbooks/custom_functions/find_related_containers.json b/playbooks/custom_functions/find_related_containers.json
new file mode 100644
index 0000000000..1ae234becf
--- /dev/null
+++ b/playbooks/custom_functions/find_related_containers.json
@@ -0,0 +1,118 @@
+{
+    "create_time": "2021-10-07T15:52:23.940165+00:00",
+    "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f",
+    "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "An indicator value to search on, such as a file hash or IP address. To search on all indicator values in the container, use \"*\".",
+            "input_type": "list",
+            "name": "value_list",
+            "placeholder": "*"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The minimum number of similar indicator records that a container must have to be considered \"related.\"  If no match count provided, this will default to 1.",
+            "input_type": "item",
+            "name": "minimum_match_count",
+            "placeholder": "1-100"
+        },
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "The container to run indicator analysis against. Supports container object or container_id. This container will also be excluded from the results for related_containers.",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional modifier to only consider related containers within a time window. Default is -30d.  Supports year (y), month (m), day (d), hour (h), or minute (m)  Custom function will always set the earliest container window based on the input container \"create_time\".",
+            "input_type": "item",
+            "name": "earliest_time",
+            "placeholder": "-30d"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional comma-separated list of statuses to filter on. Only containers that have statuses matching an item in this list will be included.",
+            "input_type": "item",
+            "name": "filter_status",
+            "placeholder": "open"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional comma-separated list of labels to filter on. Only containers that have labels matching an item in this list will be included.",
+            "input_type": "item",
+            "name": "filter_label",
+            "placeholder": "events"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional comma-separated list of severities to filter on. Only containers that have severities matching an item in this list will be included.",
+            "input_type": "item",
+            "name": "filter_severity",
+            "placeholder": "medium"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to filter containers that are in a case or not. Defaults to True (drop containers that are already in a case).",
+            "input_type": "item",
+            "name": "filter_in_case",
+            "placeholder": "True or False"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.container_id",
+            "description": "The unique id of the related container"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.container_indicator_match_count",
+            "description": "The number of indicators matched to the related container"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.container_status",
+            "description": "The status of the related container e.g. new, open, closed"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.container_type",
+            "description": "The type of the related container, e.g. default or case"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.container_name",
+            "description": "The name of the related container"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.in_case",
+            "description": "True or False if the related container is already included in a case"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.indicator_ids",
+            "description": "Indicator ID that matched"
+        },
+        {
+            "contains_type": [
+                "url"
+            ],
+            "data_path": "*.container_url",
+            "description": "Link to container"
+        }
+    ],
+    "platform_version": "5.0.1.66250",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/find_related_containers.py b/playbooks/custom_functions/find_related_containers.py
new file mode 100644
index 0000000000..749842d4dd
--- /dev/null
+++ b/playbooks/custom_functions/find_related_containers.py
@@ -0,0 +1,263 @@
+def find_related_containers(value_list=None, minimum_match_count=None, container=None, earliest_time=None, filter_status=None, filter_label=None, filter_severity=None, filter_in_case=None, **kwargs):
+    """
+    Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.
+    
+    Args:
+        value_list (CEF type: *): An indicator value to search on, such as a file hash or IP address. To search on all indicator values in the container, use "*".
+        minimum_match_count (CEF type: *): The minimum number of similar indicator records that a container must have to be considered "related."  If no match count provided, this will default to 1.
+        container (CEF type: phantom container id): The container to run indicator analysis against. Supports container object or container_id. This container will also be excluded from the results for related_containers.
+        earliest_time: Optional modifier to only consider related containers within a time window. Default is -30d.  Supports year (y), month (m), day (d), hour (h), or minute (m)  Custom function will always set the earliest container window based on the input container "create_time".
+        filter_status: Optional comma-separated list of statuses to filter on. Only containers that have statuses matching an item in this list will be included.
+        filter_label: Optional comma-separated list of labels to filter on. Only containers that have labels matching an item in this list will be included.
+        filter_severity: Optional comma-separated list of severities to filter on. Only containers that have severities matching an item in this list will be included.
+        filter_in_case: Optional parameter to filter containers that are in a case or not. Defaults to True (drop containers that are already in a case).
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.container_id (CEF type: *): The unique id of the related container
+        *.container_indicator_match_count: The number of indicators matched to the related container
+        *.container_status: The status of the related container e.g. new, open, closed
+        *.container_type: The type of the related container, e.g. default or case
+        *.container_name: The name of the related container
+        *.in_case: True or False if the related container is already included in a case
+        *.indicator_ids: Indicator ID that matched
+        *.container_url (CEF type: url): Link to container
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import re
+    from datetime import datetime, timedelta
+    from urllib import parse
+    
+    outputs = []
+    related_containers = []
+    indicator_id_dictionary = {}
+    container_dictionary = {}
+    offset_time = None
+    
+    base_url = phantom.get_base_url()
+    indicator_by_value_url = phantom.build_phantom_rest_url('indicator_by_value')
+    indicator_common_container_url = phantom.build_phantom_rest_url('indicator_common_container')
+    container_url = phantom.build_phantom_rest_url('container')
+
+    # Get indicator ids based on value_list
+    def format_offset_time(seconds):
+        datetime_obj = datetime.now() - timedelta(seconds=seconds)
+        formatted_time = datetime_obj.strftime('%Y-%m-%dT%H:%M:%S.%fZ')  
+        return formatted_time
+    
+    def fetch_indicator_ids(value_list):
+        indicator_id_list = []
+        for value in value_list:
+            params = {'indicator_value': f'{value}', 'timerange': 'all'}
+            indicator_id = phantom.requests.get(indicator_by_value_url, params=params, verify=False).json().get('id')
+            if indicator_id:
+                indicator_id_list.append(indicator_id)
+        return indicator_id_list
+    
+    # Ensure valid time modifier
+    if earliest_time:
+        # convert user-provided input to seconds
+        char_lookup = {'y': 31557600, 'mon': 2592000, 'w': 604800, 'd': 86400, 'h': 3600, 'm': 60}
+        pattern = re.compile(r'-(\d+)([mM][oO][nN]|[yYwWdDhHmM]{1})$')
+        if re.search(pattern, earliest_time):
+            integer, char = (re.findall(pattern, earliest_time)[0])
+            time_in_seconds = int(integer) * char_lookup[char.lower()]
+        else:
+            raise RuntimeError(f'earliest_time string "{earliest_time}" is incorrectly formatted. Format is -<int><time> where <int> is an integer and <time> is y, mon, w, d, h, or m. Example: "-1h"')
+    else:
+        # default 30 days in seconds
+        time_in_seconds = 2592000
+
+    # Ensure valid container input
+    if isinstance(container, dict) and container.get('id'):
+        current_container = container['id']
+    elif isinstance(container, int):
+        current_container = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    if minimum_match_count and not isinstance(minimum_match_count, int):
+        raise TypeError(f"Invalid type for 'minimum_match_count', {type(minimum_match_count)}, must be 'int'")
+    elif not minimum_match_count:
+        minimum_match_count = 1
+    
+    # Ensure valid filter inputs
+    status_list, label_list, severity_list = [], [], []
+    if isinstance(filter_status, str):
+        status_list = [item.strip().lower() for item in filter_status.split(',')]
+    if isinstance(filter_label, str):
+        label_list = [item.strip().lower() for item in filter_label.split(',')]
+    if isinstance(filter_severity, str):
+        severity_list = [item.strip().lower() for item in filter_severity.split(',')]
+    if isinstance(filter_in_case, str) and filter_in_case.lower() == 'false':
+        filter_in_case = False
+    else:
+        filter_in_case = True
+    
+    # If value list is equal to * then proceed to grab all indicator records for the current container
+    if isinstance(value_list, list) and value_list[0] == "*":
+        new_value_list = []
+        url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0'
+        response_data = phantom.requests.get(uri=url, verify=False).json().get('data')
+        if response_data:
+            for data in response_data:
+                for k,v in data['cef'].items():
+                    if isinstance(v, list):
+                        for item in v:
+                            new_value_list.append(item)
+                    else:
+                        new_value_list.append(v)
+        new_value_list = list(set(new_value_list))
+        indicator_id_list = fetch_indicator_ids(new_value_list)
+    elif isinstance(value_list, list):
+        # dedup value_list
+        value_list = list(set(value_list))
+        indicator_id_list = fetch_indicator_ids(value_list)
+    else:
+        raise TypeError(f"Invalid input for value_list: '{value_list}'")
+
+    # Quit early if no indicator_ids were found
+    if not indicator_id_list:
+        phantom.debug(f"No indicators IDs found for provided values: '{value_list}'")
+        assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+        return outputs
+    
+    # Get list of related containers
+    for indicator_id in list(set(indicator_id_list)):
+        params = {'indicator_ids': indicator_id}
+        response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json()
+        # Populate an indicator dictionary where the original ids are the dictionary keys and the                     
+        # associated continers are the values
+        if response_data:
+            # Quit early if no related containers were found
+            if len(response_data) == 1 and response_data[0].get('container_id') == current_container:
+                phantom.debug(f"No related containers found for provided values: '{value_list}'")
+                assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+                return outputs
+            
+            indicator_id_dictionary[str(indicator_id)] = []
+            for item in response_data:
+                # Append all related containers except for current container
+                if item['container_id'] != current_container:
+                    indicator_id_dictionary[str(indicator_id)].append(item['container_id'])
+
+    # Iterate through the newly created indicator id dictionary and create a dictionary where 
+    # the keys are related containers and the values are the associated indicator ids
+    for k,v in indicator_id_dictionary.items():
+        for item in v:
+            if str(item) not in container_dictionary.keys():
+                container_dictionary[str(item)] = [str(k)]
+            else:
+                container_dictionary[str(item)].append(str(k))
+        
+    # Iterate through the newly created container dictionary                
+    if container_dictionary:
+        
+        container_number = 0
+        # Dedupe the number of indicators
+        for k,v in container_dictionary.items():
+            container_dictionary[str(k)] = list(set(v))
+             # Count how many containers are actually going to be queried based on minimum_match_count
+            if len(container_dictionary[str(k)]) >= minimum_match_count:
+                container_number += 1
+                
+        # If the container number is greater than 600, then its faster to grab all containers
+        if container_number >= 600:
+
+            # Gather container data
+            params = {'page_size': 0}
+            if offset_time:
+                params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
+            containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json()
+            all_container_dictionary = {}
+            if containers_response['count'] > 0:
+                
+                # Build repository of available container data
+                for data in containers_response['data']:
+                    all_container_dictionary[str(data['id'])] = data
+
+                for k,v in container_dictionary.items():
+
+                    # Omit any containers that have less than the minimum match count
+                    if len(container_dictionary[str(k)]) >= minimum_match_count:
+                        valid_container = True
+                        # Grab container details if its a valid container based on previous filtering.
+                        if str(k) in all_container_dictionary.keys():
+                            container_data = all_container_dictionary[str(k)]
+                            
+                            # Omit any containers that don't meet the specified criteria
+                            if container_data['create_time'] < format_offset_time(time_in_seconds): 
+                                valid_container = False
+                            if status_list and container_data['status'].lower() not in status_list:
+                                valid_container = False
+                            if label_list and container_data['label'].lower() not in label_list:
+                                valid_container = False
+                            if severity_list and container_data['severity'].lower() not in severity_list:
+                                valid_container = False
+                            if response_data['in_case'] and filter_in_case:
+                                valid_container = False
+                                
+                            # Build outputs if checks are passed
+                            if valid_container:
+                                outputs.append({
+                                    'container_id': str(k),
+                                    'container_indicator_match_count': len(container_dictionary[str(k)]),
+                                    'container_status': container_data['status'],
+                                    'container_type': container_data['container_type'],
+                                    'container_name': container_data['name'],
+                                    'container_url': base_url.rstrip('/') + '/mission/{}'.format(str(k)),
+                                    'in_case': container_data['in_case'],
+                                    'indicator_id': container_dictionary[str(k)]
+                                })
+
+            else:
+                raise RuntimeError(f"'Unable to find any valid containers at url: '{url}'")
+                
+        elif container_number < 600 and container_number > 0:
+            # if the container number is smaller than 600, its faster to grab each container individiually
+            for k,v in container_dictionary.items():
+                # Dedupe the number of indicators
+                container_dictionary[str(k)] = list(set(v))
+
+                # If any of the containers contain more than the minimum match count request that container detail.
+                if len(container_dictionary[str(k)]) >= minimum_match_count:
+                    
+                    valid_container = True
+                    
+                    # Grab container details
+                    url = phantom.build_phantom_rest_url('container', k)
+                    response_data = phantom.requests.get(url, verify=False).json()
+                            
+                    # Omit any containers that don't meet the specified criteria
+                    if response_data['create_time'] < format_offset_time(time_in_seconds): 
+                        valid_container = False
+                    if status_list and response_data['status'].lower() not in status_list:
+                        valid_container = False
+                    if label_list and response_data['label'].lower() not in label_list:
+                        valid_container = False
+                    if severity_list and response_data['severity'].lower() not in severity_list:
+                        valid_container = False
+                    if response_data['in_case'] and filter_in_case:
+                        valid_container = False
+                    
+                    # Build outputs if checks are passed and valid_container is still true
+                    if valid_container: 
+                        outputs.append({
+                            'container_id': str(k),
+                            'container_indicator_match_count': len(container_dictionary[str(k)]),
+                            'container_status': response_data['status'],
+                            'container_severity': response_data['severity'],
+                            'container_type':  response_data['container_type'],
+                            'container_name':  response_data['name'],
+                            'container_url': base_url.rstrip('/') + '/mission/{}'.format(str(k)),
+                            'in_case': response_data['in_case'],
+                            'indicator_ids': container_dictionary[str(k)]
+                        })
+
+
+    else:
+        raise RuntimeError('Unable to create container_dictionary')               
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/indicator_collect.json b/playbooks/custom_functions/indicator_collect.json
new file mode 100644
index 0000000000..68e8af34ca
--- /dev/null
+++ b/playbooks/custom_functions/indicator_collect.json
@@ -0,0 +1,77 @@
+{
+    "create_time": "2021-11-30T14:20:41.840902+00:00",
+    "custom_function_id": "5febf154c78c6815119c08f9dfaba9a661a992d6",
+    "description": "Collect all indicators in a container and separate them by data type. Additional output data paths are created for each data type. Artifact scope is ignored. ",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "The current container",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "all_indicators.*.cef_key",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "all_indicators.*.cef_value",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "all_indicators.*.data_types",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "all_indicators.*.artifact_id",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "domain.*.cef_key",
+            "description": ""
+        },
+        {
+            "contains_type": [
+                "domain"
+            ],
+            "data_path": "domain.*.cef_value",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "domain.*.artifact_id",
+            "description": ""
+        },
+        {
+            "contains_type": [
+                "file name"
+            ],
+            "data_path": "file_name.*.cef_key",
+            "description": ""
+        },
+        {
+            "contains_type": [
+                "file name"
+            ],
+            "data_path": "file_name.*.cef_value",
+            "description": ""
+        },
+        {
+            "contains_type": [],
+            "data_path": "file_name.*.artifact_id",
+            "description": ""
+        }
+    ],
+    "platform_version": "5.1.0.70187",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/indicator_collect.py b/playbooks/custom_functions/indicator_collect.py
new file mode 100644
index 0000000000..16be6f993c
--- /dev/null
+++ b/playbooks/custom_functions/indicator_collect.py
@@ -0,0 +1,92 @@
+def indicator_collect(container=None, **kwargs):
+    """
+    Collect all indicators in a container and separate them by data type. Additional output data paths are created for each data type. Artifact scope is ignored. 
+    
+    Args:
+        container (CEF type: phantom container id): The current container
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        all_indicators.*.cef_key
+        all_indicators.*.cef_value
+        all_indicators.*.data_types
+        all_indicators.*.artifact_id
+        domain.*.cef_key
+        domain.*.cef_value (CEF type: domain)
+        domain.*.artifact_id
+        file_name.*.cef_key (CEF type: file name)
+        file_name.*.cef_value (CEF type: file name)
+        file_name.*.artifact_id
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {'all_indicators': []}
+    data_types = [
+        "domain",
+        "file name",
+        "file path",
+        "hash",
+        "host name",
+        "ip",
+        "mac address",
+        "md5",
+        "port",
+        "process name",
+        "sha1",
+        "sha256",
+        "sha512",
+        "url",
+        "user name",
+        "vault id"
+    ]
+    
+    for data_type in data_types:
+        data_type_escaped = data_type.replace(' ', '_')
+        outputs[data_type_escaped] = []
+
+    # validate container and get ID
+    if isinstance(container, dict) and container['id']:
+        container_dict = container
+        container_id = container['id']
+    elif isinstance(container, int):
+        rest_container = phantom.requests.get(uri=phantom.build_phantom_rest_url('container', container), verify=False).json()
+        if 'id' not in rest_container:
+            raise ValueError('Failed to find container with id {container}')
+        container_dict = rest_container
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    # fetch all artifacts in the container
+    artifacts = phantom.requests.get(uri=phantom.build_phantom_rest_url('container', container_id, 'artifacts'), params={'page_size': 0}, verify=False).json()['data']
+    
+    for artifact in artifacts:
+        artifact_id = artifact['id']
+        for cef_key in artifact['cef']:
+            cef_value = artifact['cef'][cef_key]
+            params = {'indicator_value': cef_value, "_special_contains": True, 'page_size': 1}
+            indicator_data = phantom.requests.get(uri=phantom.build_phantom_rest_url('indicator_by_value'), params=params, verify=False)
+            if indicator_data.status_code == 200:
+                indicator_json = indicator_data.json()
+            data_types = []
+            if indicator_json.get('id'):
+                data_types = indicator_json['_special_contains']
+                # drop none
+                data_types = [item for item in data_types if item]
+
+            # store the value in all_indicators and a list of values for each data type
+            outputs['all_indicators'].append({'cef_key': cef_key, 'cef_value': cef_value, 'artifact_id': artifact_id, 'data_types': data_types})
+            for data_type in data_types:
+                # outputs will have underscores instead of spaces
+                data_type_escaped = data_type.replace(' ', '_')
+                if data_type_escaped not in outputs:
+                    outputs[data_type_escaped] = []
+                outputs[data_type_escaped].append({'cef_key': cef_key, 'cef_value': cef_value, 'artifact_id': artifact_id})
+
+    # sort the all_indicators outputs to make them more consistent
+    outputs['all_indicators'].sort(key=lambda indicator: str(indicator['cef_value']))
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/indicator_get_by_tag.json b/playbooks/custom_functions/indicator_get_by_tag.json
new file mode 100644
index 0000000000..5d566de220
--- /dev/null
+++ b/playbooks/custom_functions/indicator_get_by_tag.json
@@ -0,0 +1,73 @@
+{
+    "create_time": "2021-08-27T14:42:51.824426+00:00",
+    "custom_function_id": "7e304fa9f4afcb82df42669646baa18fb0afb890",
+    "description": "Get indicator(s) by tags.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [],
+            "description": "Comma separated list of tags. Tags will be OR'd together: e.g. tag1 OR tag2 OR tag3. Tags do not support whitespace and whitespace will be automatically removed.",
+            "input_type": "item",
+            "name": "tags_or",
+            "placeholder": "tag1,tag2,...tagK"
+        },
+        {
+            "contains_type": [],
+            "description": "Comma separated list of tags. Tags will be AND'd together: e.g. tag1 AND tag2 AND tag3. Tags do not support whitespace and whitespace will be automatically removed.",
+            "input_type": "item",
+            "name": "tags_and",
+            "placeholder": "tag1,tag2,...tagK"
+        },
+        {
+            "contains_type": [],
+            "description": "Defaults to last_30_days\noptions:\ntoday\nyesterday\nthis_week\nthis_month\nlast_7_days\nlast_30_days\nlast_week\nlast_month",
+            "input_type": "item",
+            "name": "indicator_timerange",
+            "placeholder": "last_30_days"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional parameter to ensure the fetched indicator exists in the supplied container.",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "Comma separated list of tags to filter out. If the indicator's tags contain any of the values in this list, they will be omitted from the output.",
+            "input_type": "item",
+            "name": "tags_exclude",
+            "placeholder": "tag1, tag2"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.indicator_id",
+            "description": "A matching indicator id record"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.indicator_value",
+            "description": "A matching indicator value"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.indicator_tags",
+            "description": "List of tags associated with the indicator record"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.indicator_cef_type",
+            "description": "List of cef types associated with the indicator record"
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/indicator_get_by_tag.py b/playbooks/custom_functions/indicator_get_by_tag.py
new file mode 100644
index 0000000000..63c026056e
--- /dev/null
+++ b/playbooks/custom_functions/indicator_get_by_tag.py
@@ -0,0 +1,139 @@
+def indicator_get_by_tag(tags_or=None, tags_and=None, indicator_timerange=None, container=None, tags_exclude=None, **kwargs):
+    """
+    Get indicator(s) by tags.
+    
+    Args:
+        tags_or: Comma separated list of tags. Tags will be OR'd together: e.g. tag1 OR tag2 OR tag3. Tags do not support whitespace and whitespace will be automatically removed.
+        tags_and: Comma separated list of tags. Tags will be AND'd together: e.g. tag1 AND tag2 AND tag3. Tags do not support whitespace and whitespace will be automatically removed.
+        indicator_timerange: Defaults to last_30_days
+            options:
+            today
+            yesterday
+            this_week
+            this_month
+            last_7_days
+            last_30_days
+            last_week
+            last_month
+        container: Optional parameter to ensure the fetched indicator exists in the supplied container.
+        tags_exclude: Comma separated list of tags to filter out. If the indicator's tags contain any of the values in this list, they will be omitted from the output.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.indicator_id (CEF type: *): A matching indicator id record
+        *.indicator_value (CEF type: *): A matching indicator value
+        *.indicator_tags (CEF type: *): List of tags associated with the indicator record
+        *.indicator_cef_type: List of cef types associated with the indicator record
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    from datetime import datetime, timedelta
+    
+    outputs = []
+    indicator_record = {}
+    container_id = None
+    allowed_timeranges = ['today', 'yesterday', 'this_week', 'this_month', 'this_year', 'last_7_days',
+                          'last_30_days', 'last_week', 'last_month', 'last_year']
+    
+    # Helper function to translate timeranges to relative datetime.
+    # Uses filter_earliest / filter_later for anything 30 days and under as it is quicker. 
+    # Uses summary timeranges for items greater than 30 days.
+    def translate_relative_input(relative_time):
+        now = datetime.utcnow()
+        relative_time = relative_time.lower()
+        time_format = "%Y-%m-%dT%H:%M:%S.%fZ"
+        if relative_time == 'today':
+            earliest = now.replace(hour=0, minute=0, second=0, microsecond=0)
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format))}
+        elif relative_time == 'yesterday':
+            earliest = now.replace(hour=0, minute=0, second=0, microsecond=0) - timedelta(days=1)
+            latest = earliest.replace(hour=23, minute=59, second=59, microsecond=0)
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format)),
+                     "_filter_latest_time__lt": '"{}"'.format(latest.strftime(time_format))}
+        elif relative_time == 'this_week':
+            earliest = now.replace(hour=0, minute=0, second=0, microsecond=0) - timedelta(days=now.weekday())
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format))}
+        elif relative_time == 'this_month':
+            earliest = now.replace(day=1, hour=0, minute=0, second=0, microsecond=0)
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format))}
+        elif relative_time == 'last_7_days':
+            earliest = now - timedelta(days=7)
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format))}
+        elif relative_time == 'last_30_days':
+            params = {}
+        elif relative_time == 'last_week':
+            latest = now.replace(hour=23, minute=59, second=59, microsecond=0) - timedelta(days=now.weekday() + 1)
+            earliest = latest.replace(hour=0, minute=0, second=0) - timedelta(days=8)
+            params = {"_filter_earliest_time__gt": '"{}"'.format(earliest.strftime(time_format)),
+                     "_filter_latest_time__lt": '"{}"'.format(latest.strftime(time_format))}
+        else:
+            params = {'timerange': relative_time}
+            
+        return params
+    
+    if indicator_timerange and isinstance(indicator_timerange, str) and indicator_timerange.lower() in allowed_timeranges:
+        time_params = translate_relative_input(indicator_timerange)
+    elif not indicator_timerange:
+        time_params = {}
+    else:
+        raise ValueError(f"invalid indicator_timerange: '{indicator_timerange}'")
+
+        
+    if isinstance(container, int):
+        container_id = container
+    elif isinstance(container, dict):
+        container_id = container['id']
+    elif container:
+        raise TypeError("container_input is neither a int or a dictionary")  
+        
+    url = phantom.build_phantom_rest_url('indicator')
+    if tags_or:
+        tags_or = tags_or.replace(' ','')
+        for tag in tags_or.split(','):
+            params = {'_filter_tags__contains': f'"{tag}"', "_special_contains": True, 'page_size': 0, **time_params}
+            response = phantom.requests.get(url, params=params, verify=False).json()
+            if response['count'] > 0:
+                for data in response['data']:
+                    indicator_record[data['id']] = {'indicator_value': data['value'], 'indicator_tags': data['tags'], 'indicator_cef_type': data['_special_contains']}
+    if tags_and:
+        tags = tags_and.replace(' ','').split(',')
+        params = {'_filter_tags__contains': f'{json.dumps(tags)}', "_special_contains": True, 'page_size': 0, **time_params}
+        response = phantom.requests.get(url, params=params, verify=False).json()
+        if response['count'] > 0:
+            for data in response['data']:
+                indicator_record[data['id']] = {'indicator_value': data['value'], 'indicator_tags': data['tags'], 'indicator_cef_type': data['_special_contains']}
+                
+    if tags_exclude:
+        tags_exclude = [item.strip() for item in tags_exclude.split(',')]
+        
+    if indicator_record:
+        for i_id, i_data in indicator_record.items():
+            skip_indicator = False
+            
+            # Skip indicators that contain an excluded tag
+            if tags_exclude:
+                for item in tags_exclude:
+                    if item in i_data['indicator_tags']:
+                        skip_indicator = True
+                    
+            if container_id and not skip_indicator:
+                url = phantom.build_phantom_rest_url('indicator_common_container')
+                params = {'indicator_ids': i_id}
+                response = phantom.requests.get(url, params=params, verify=False).json()
+                if response:
+                    for container_item in response:
+                        # Only add to outputs if the supplied container_id shows in the common_container results
+                        if container_item['container_id'] == container_id:
+                            outputs.append({'indicator_id': i_id, **indicator_record[i_id]})
+                else:
+                    phantom.debug("No indicators found for provided tags and container")
+                    
+            elif not skip_indicator:
+                
+                outputs.append({'indicator_id': i_id, **indicator_record[i_id]})
+    else:
+        phantom.debug("No indicators found for provided tags")
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/indicator_tag.json b/playbooks/custom_functions/indicator_tag.json
new file mode 100644
index 0000000000..ec6282e69c
--- /dev/null
+++ b/playbooks/custom_functions/indicator_tag.json
@@ -0,0 +1,47 @@
+{
+    "create_time": "2021-10-29T21:39:29.397862+00:00",
+    "custom_function_id": "e7c38086f9c212dc5db9f6198f5e03be8158c2b2",
+    "description": "Tag an existing indicator record. Tags can be overwritten or appended.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Specifies the indicator which the tag will be added to. Supports a string indicator value or an indicator id.",
+            "input_type": "item",
+            "name": "indicator",
+            "placeholder": "my_indicator"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Comma separated list of tags. Tags should only contain characters Aa-Zz, 0-9, '-', and '_'.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1,tag2,...,tagk"
+        },
+        {
+            "contains_type": [],
+            "description": "Optional input. Either \"true\" or \"false\" with default as \"false\". If set to \"true\", existing tags on the indicator record will be replaced by the provided input. If set to \"false\", the new tags will be appended to the existing indicator tags.",
+            "input_type": "item",
+            "name": "overwrite",
+            "placeholder": "false"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "indicator_id",
+            "description": "The indicator id that was tagged."
+        },
+        {
+            "contains_type": [],
+            "data_path": "indicator_tags",
+            "description": "The new tags for the indicator"
+        }
+    ],
+    "platform_version": "5.0.1.66250",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/indicator_tag.py b/playbooks/custom_functions/indicator_tag.py
new file mode 100644
index 0000000000..c2f85f8584
--- /dev/null
+++ b/playbooks/custom_functions/indicator_tag.py
@@ -0,0 +1,84 @@
+def indicator_tag(indicator=None, tags=None, overwrite=None, **kwargs):
+    """
+    Tag an existing indicator record. Tags can be overwritten or appended.
+    
+    Args:
+        indicator (CEF type: *): Specifies the indicator which the tag will be added to. Supports a string indicator value or an indicator id.
+        tags (CEF type: *): Comma separated list of tags. Tags should only contain characters Aa-Zz, 0-9, '-', and '_'.
+        overwrite: Optional input. Either "true" or "false" with default as "false". If set to "true", existing tags on the indicator record will be replaced by the provided input. If set to "false", the new tags will be appended to the existing indicator tags.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        indicator_id: The indicator id that was tagged.
+        indicator_tags: The new tags for the indicator
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import string
+    
+    outputs = {}
+    
+    # remove whitespace from tags and convert to a list
+    tags = tags.replace(' ','').split(',')
+    allowed_characters = string.ascii_lowercase + string.ascii_uppercase + string.digits + '_' + '-'
+    for tag in tags:
+        if any(c not in allowed_characters for c in tag):
+            raise ValueError("Tags should only contain characters Aa-Zz, 0-9, '-', and '_'")
+
+    # overwrite must be "true" or "false" and defaults to "false"
+    if overwrite:
+        if not isinstance(overwrite, str):
+            raise TypeError("overwrite must be a string")
+        if overwrite.lower() == 'true':
+            overwrite = True
+        elif overwrite.lower() == 'false':
+            overwrite = False
+        else:
+            raise ValueError("overwrite must be either 'true' or 'false'")
+    else:
+        overwrite = False
+    
+    url = phantom.build_phantom_rest_url('indicator')
+    
+    # if indicator is an int, treat it as an indicator id
+    if isinstance(indicator, int):
+        indicator_id = indicator
+        url += f'/{indicator_id}'
+        response = phantom.requests.get(url, verify=False).json()
+        if response.get('id'):
+            existing_tags = response['tags']
+        else:
+            raise RuntimeError(f"No indicator record found for indicator with id: {indicator}")
+
+    # attempt to translate indicator string value to a indicator id
+    elif isinstance(indicator, str):
+        params = {'_filter_value__iexact': f'"{indicator}"'}
+        response = phantom.requests.get(url, params=params, verify=False).json()
+        if response['count'] == 1:
+            indicator_id = response['data'][0]['id']
+            url += f'/{indicator_id}'
+            existing_tags = response['data'][0]['tags']
+        elif response['count'] > 1:
+            raise RuntimeError("Located more than 1 indicator record")
+        else:
+            raise RuntimeError(f"Unable to locate any indicator record for value: {indicator}")
+    else:
+        raise ValueError("Indicator must be a string or integer")
+
+    # if overwrite is set to false, then start with existing tags and append new tags to them
+    if not overwrite: 
+        tags = existing_tags + tags
+        
+    # deduplicate before POSTing
+    tags = list(set(tags))
+            
+    data = {"tags": tags}
+    response = phantom.requests.post(url, json=data, verify=False).json()
+    if response.get('success'):
+        outputs = {'indicator_id': indicator_id, 'indicator_tags': tags}
+    else:
+        raise RuntimeError(f"Failed to update tags for indicator with id: {indicator_id}")
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/json_safe_format.json b/playbooks/custom_functions/json_safe_format.json
new file mode 100644
index 0000000000..6ee5bfcf3f
--- /dev/null
+++ b/playbooks/custom_functions/json_safe_format.json
@@ -0,0 +1,24 @@
+{
+    "create_time": "2021-03-24T13:43:27.570789+00:00",
+    "custom_function_id": "033ea99767cb63402a75971532c551c1be247075",
+    "description": "Load JSON string in a non-strict mode to allow unescaped control characters to be correctly escaped before passing them on to actions that require it.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [],
+            "description": "String in JSON format with possible unescaped control characters.",
+            "input_type": "item",
+            "name": "json_input",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "json_output",
+            "description": "JSON-serializable string with correctly escaped control characters."
+        }
+    ],
+    "platform_version": "4.10.2.47587",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/json_safe_format.py b/playbooks/custom_functions/json_safe_format.py
new file mode 100644
index 0000000000..544c548d4a
--- /dev/null
+++ b/playbooks/custom_functions/json_safe_format.py
@@ -0,0 +1,23 @@
+def json_safe_format(json_input=None, **kwargs):
+    """
+    Load JSON string in a non-strict mode to allow unescaped control characters to be correctly escaped before passing them on to actions that require it.
+    
+    Args:
+        json_input: String in JSON format with possible unescaped control characters.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        json_output: JSON-serializable string with correctly escaped control characters.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    
+    safe_json = json.dumps(json.loads(json_input, strict=False))
+        
+    outputs['json_output'] = safe_json
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/list_deduplicate.json b/playbooks/custom_functions/list_deduplicate.json
new file mode 100644
index 0000000000..70a78b4024
--- /dev/null
+++ b/playbooks/custom_functions/list_deduplicate.json
@@ -0,0 +1,28 @@
+{
+    "create_time": "2021-04-28T19:54:24.181595+00:00",
+    "custom_function_id": "5afb07e68d980dda3bf45c8852bfa744e0e5d4b2",
+    "description": "Remove non-unique items from a list.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "A list of items to deduplicate",
+            "input_type": "list",
+            "name": "input_list",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "A deduplicated list with all the unique items in input_list"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/list_deduplicate.py b/playbooks/custom_functions/list_deduplicate.py
new file mode 100644
index 0000000000..e6f3d22c55
--- /dev/null
+++ b/playbooks/custom_functions/list_deduplicate.py
@@ -0,0 +1,30 @@
+def list_deduplicate(input_list=None, **kwargs):
+    """
+    Remove non-unique items from a list.
+    
+    Args:
+        input_list (CEF type: *): A list of items to deduplicate
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): A deduplicated list with all the unique items in input_list
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    # this only works on lists, so print a warning and return None if the input is not a list    
+    if not isinstance(input_list, list):
+        phantom.debug("unable to deduplicate because the input is not a list")
+        return
+    
+    # deduplicate the list by converting it to a set. this will fail if items are not hashable
+    unique_set = set(input_list)
+    
+    # iterate through the unique items in the set and append each one as its own dictionary
+    outputs = []
+    for item in unique_set:
+        outputs.append({"item": item})
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/list_drop_none.json b/playbooks/custom_functions/list_drop_none.json
new file mode 100644
index 0000000000..89bcdd1792
--- /dev/null
+++ b/playbooks/custom_functions/list_drop_none.json
@@ -0,0 +1,28 @@
+{
+    "create_time": "2021-04-28T19:54:08.906345+00:00",
+    "custom_function_id": "24133bfc9a05a6834e2b30348e9364d62f00413d",
+    "description": "Filter out all values from a list where the value evaluates to False in Python (such as None, \"\", or [])",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "a list of items to filter",
+            "input_type": "list",
+            "name": "input_list",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "a return item for each value that did not evaluate to False"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/list_drop_none.py b/playbooks/custom_functions/list_drop_none.py
new file mode 100644
index 0000000000..135c98dad4
--- /dev/null
+++ b/playbooks/custom_functions/list_drop_none.py
@@ -0,0 +1,28 @@
+def list_drop_none(input_list=None, **kwargs):
+    """
+    Filter out all values from a list where the value evaluates to False in Python (such as None, "", or [])
+    
+    Args:
+        input_list (CEF type: *): a list of items to filter
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): a return item for each value that did not evaluate to False
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    # this only works on lists, so print a warning and return None if the input is not a list
+    if not isinstance(input_list, list):
+        phantom.debug("unable to process because the input is not a list")
+        return
+    
+    # iterate through the items in the list and append each non-falsy one as its own dictionary
+    outputs = []
+    for item in input_list:
+        if item:
+            outputs.append({"item": item})
+        
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/list_merge.json b/playbooks/custom_functions/list_merge.json
new file mode 100644
index 0000000000..85f66c7d95
--- /dev/null
+++ b/playbooks/custom_functions/list_merge.json
@@ -0,0 +1,109 @@
+{
+    "create_time": "2021-04-28T19:53:33.624071+00:00",
+    "custom_function_id": "b524eca7afdfcb2a4714529f28e5f0142b12d459",
+    "description": "Merge 2-10 different data paths into a single output data path. For example, if IP addresses are stored in the fields sourceAddress, destinationAddress, and deviceAddress, then those three fields could be merged together to form a single list of IP addresses.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_1",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_2",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_3",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_4",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_5",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_6",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_7",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_8",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_9",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_10",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "A combined list of all the values from all the input lists"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/list_merge.py b/playbooks/custom_functions/list_merge.py
new file mode 100644
index 0000000000..16e6cb6eee
--- /dev/null
+++ b/playbooks/custom_functions/list_merge.py
@@ -0,0 +1,55 @@
+def list_merge(input_1=None, input_2=None, input_3=None, input_4=None, input_5=None, input_6=None, input_7=None, input_8=None, input_9=None, input_10=None, **kwargs):
+    """
+    Merge 2-10 different data paths into a single output data path. For example, if IP addresses are stored in the fields sourceAddress, destinationAddress, and deviceAddress, then those three fields could be merged together to form a single list of IP addresses.
+    
+    Args:
+        input_1 (CEF type: *)
+        input_2 (CEF type: *)
+        input_3 (CEF type: *)
+        input_4 (CEF type: *)
+        input_5 (CEF type: *)
+        input_6 (CEF type: *)
+        input_7 (CEF type: *)
+        input_8 (CEF type: *)
+        input_9 (CEF type: *)
+        input_10 (CEF type: *)
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): A combined list of all the values from all the input lists
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+    
+    # loop through all the inputs and use the index to track which input is being processed
+    for index, input_value in enumerate([input_1, input_2, input_3, input_4, input_5, input_6, input_7, input_8, input_9, input_10]):
+
+        # skip the input if no datapath is provided or the datapath does not resolve to anything
+        if not input_value:
+            phantom.debug("skipping input_{} because it is falsy".format(index+1))
+            continue
+
+        # if the input is not a list just append the single item
+        if not isinstance(input_value, list):
+            outputs.append({"item": input_value})
+            phantom.debug("merged 1 items from input_{}".format(index+1))
+            continue
+        
+        # keep track of how many items were merged from each input
+        item_count = 0
+        
+        # iterate through the list and append each item in its own dictionary
+        for item in input_value:
+            if item:
+                phantom.debug("input_value is {} and item is {}".format(input_value, item))
+                outputs.append({"item": item})
+                item_count += 1
+        phantom.debug("merged {} items from input_{}".format(item_count, index+1))
+    
+    phantom.debug("merged results: {}".format(outputs))
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/mark_evidence.json b/playbooks/custom_functions/mark_evidence.json
new file mode 100644
index 0000000000..cd8b942d46
--- /dev/null
+++ b/playbooks/custom_functions/mark_evidence.json
@@ -0,0 +1,46 @@
+{
+    "create_time": "2021-04-27T14:52:21.197821+00:00",
+    "custom_function_id": "4fd5ececa630e09aa1451c8eab283ee4ceae1211",
+    "description": "Mark an object as Evidence in a container",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "Container ID or Container Object",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The object to mark as evidence. This could be a vault_id, artifact_id, note_id, container_id, or action_run_id. If the previous playbook block is an action then \"keyword_argument:results\" can be used for the action_run_id with the content_type \"action_run_id\". Vault_id can be an ID or a vault hash.",
+            "input_type": "item",
+            "name": "input_object",
+            "placeholder": "artifact id, note id, vault_id, etc."
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The content type of the object to add as evidence which must be one of the following:\n            \n            vault_id\n            artifact_id\n            container_id\n            note_id\n            action_run_id",
+            "input_type": "item",
+            "name": "content_type",
+            "placeholder": "See help text for supported types"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.id",
+            "description": "ID of the evidence item"
+        }
+    ],
+    "platform_version": "4.10.2.47587",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/mark_evidence.py b/playbooks/custom_functions/mark_evidence.py
new file mode 100644
index 0000000000..dccf8ba030
--- /dev/null
+++ b/playbooks/custom_functions/mark_evidence.py
@@ -0,0 +1,127 @@
+def mark_evidence(container=None, input_object=None, content_type=None, **kwargs):
+    """
+    Mark an object as Evidence in a container
+    
+    Args:
+        container (CEF type: phantom container id): Container ID or Container Object
+        input_object (CEF type: *): The object to mark as evidence. This could be a vault_id, artifact_id, note_id, container_id, or action_run_id. If the previous playbook block is an action then "keyword_argument:results" can be used for the action_run_id with the content_type "action_run_id". Vault_id can be an ID or a vault hash.
+        content_type (CEF type: *): The content type of the object to add as evidence which must be one of the following:
+                        
+                        vault_id
+                        artifact_id
+                        container_id
+                        note_id
+                        action_run_id
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.id (CEF type: *): ID of the evidence item
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+    container_id = None
+    data = []
+    valid_types = ['vault_id','artifact_id','container_id', 'note_id','action_run_id']
+    
+    # Ensure valid content_type: 
+    if content_type.lower() not in valid_types:
+        raise TypeError(f"The content_type '{content_type}' is not a valid content_type")
+    
+    # Ensure valid container input
+    if isinstance(container, dict) and container.get('id'):
+        container_id = container['id']
+    elif isinstance(container, int) or (isinstance(container, str) and container.isdigit()):
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    # If content added is type 'action_run_id',
+    # then iterate through an input object that is a results object,
+    # and append the action_run_id's to data
+    if isinstance(input_object, list) and content_type.lower() == 'action_run_id':
+        for action_result in input_object:
+            if action_result.get('action_run_id'):
+                data.append({
+                    "container_id": container_id,
+                    "object_id": action_result['action_run_id'],
+                    "content_type": 'actionrun',
+                })
+        # If data is still an empty list after for loop, 
+        # it indicates that the input_object was not a valid results object
+        if not data:
+            raise TypeError("The input for 'input_object' is not a valid integer or supported object.")
+    
+    # If 'input_object' is already an action_run_id, no need to translate it.
+    elif (isinstance(input_object, int) or (isinstance(input_object, str) and input_object.isdigit())) and content_type.lower() == 'action_run_id':
+        data = [{
+            "container_id": container_id,
+            "object_id": input_object,
+            "content_type": 'actionrun',
+            }]
+            
+    # If vault_id was entered, check to see if user already entered a vault integer
+    # else if user entered a hash vault_id, attempt to translate to a vault integer            
+    elif input_object and content_type.lower() == 'vault_id':
+        if isinstance(input_object, int) or (isinstance(input_object, str) and input_object.isdigit()):
+            content_type = "containerattachment"
+        else:
+            success, message, info = phantom.vault_info(vault_id=input_object)
+            if success == False:
+                raise RuntimeError(f"Invalid vault_id: {message}")
+            else:
+                input_object = info[0]['id']    
+                content_type = "containerattachment"
+        data = [{
+            "container_id": container_id,
+            "object_id": input_object,
+            "content_type": content_type,
+            }]
+        
+    # If 'container_id' was entered, the content_type needs to be set to 'container'.
+    # Phantom does not allow a literal input of 'container' so thus 'container_id is used.
+    elif (isinstance(input_object, int) or (isinstance(input_object, str) and input_object.isdigit())) and content_type.lower() == 'container_id':
+        data = [{
+            "container_id": container_id,
+            "object_id": input_object,
+            "content_type": 'container',
+            }]
+    
+    # If 'artifact_id' was entered, the content_type needs to be set to 'artifact'
+    elif (isinstance(input_object, int) or (isinstance(input_object, str) and input_object.isdigit())) and content_type.lower() == 'artifact_id':
+        data = [{
+            "container_id": container_id,
+            "object_id": input_object,
+            "content_type": 'artifact',
+            }]  
+    # If 'note_id' was entered, the content_type needs to be set to 'note'
+    elif (isinstance(input_object, int) or (isinstance(input_object, str) and input_object.isdigit())) and content_type.lower() == 'note_id':
+        data = [{
+            "container_id": container_id,
+            "object_id": input_object,
+            "content_type": 'note',
+            }]  
+    else:
+        raise TypeError(f"The input_object is not a valid integer or supported object. Type '{type(input_object)}'")
+    
+    # Build url for evidence endpoint
+    url = phantom.build_phantom_rest_url('evidence')
+    
+    # Post data to evidence endpoint
+    for item in data:
+        response = phantom.requests.post(uri=url, json=item, verify=False).json()
+
+        # If successful add evidence id to outputs
+        # elif evidence already exists print to debug
+        # else error out 
+        if response.get('success'):
+            outputs.append({'id': response['id']})
+        elif response.get('failed') and response.get('message') == 'Already added to Evidence.':
+            phantom.debug(f"{content_type} \'{container_id}\' {response['message']}")
+        else:
+            raise RuntimeError(f"Unable to add evidence: {response}")
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/noop.json b/playbooks/custom_functions/noop.json
new file mode 100644
index 0000000000..8e74ed5f09
--- /dev/null
+++ b/playbooks/custom_functions/noop.json
@@ -0,0 +1,10 @@
+{
+    "create_time": "2021-04-28T19:53:21.159704+00:00",
+    "custom_function_id": "561cadef222a920bb91c236c6e9eb7604f537369",
+    "description": "Do nothing and return nothing. Use this if you want to do something in a custom function setup section or leave a placeholder block in a playbook. This does not sleep or wait and will return as soon as possible.",
+    "draft_mode": false,
+    "inputs": [],
+    "outputs": [],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/noop.py b/playbooks/custom_functions/noop.py
new file mode 100644
index 0000000000..7febd16d2e
--- /dev/null
+++ b/playbooks/custom_functions/noop.py
@@ -0,0 +1,16 @@
+def noop(**kwargs):
+    """
+    Do nothing and return nothing. Use this if you want to do something in a custom function setup section or leave a placeholder block in a playbook. This does not sleep or wait and will return as soon as possible.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+        
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/passthrough.json b/playbooks/custom_functions/passthrough.json
new file mode 100644
index 0000000000..0941377b91
--- /dev/null
+++ b/playbooks/custom_functions/passthrough.json
@@ -0,0 +1,114 @@
+{
+    "create_time": "2021-04-16T19:17:01.589064+00:00",
+    "custom_function_id": "e1210d7e75e7046880321061008a70eda2159831",
+    "description": "Return the inputs as outputs. This is useful for publishing pieces of data for other blocks in the playbook to use.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_1",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_2",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_3",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_4",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_5",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_6",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_7",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_8",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_9",
+            "placeholder": ""
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "",
+            "input_type": "list",
+            "name": "input_10",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "The output item for each input"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.input_name",
+            "description": "The corresponding input name for each output"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/passthrough.py b/playbooks/custom_functions/passthrough.py
new file mode 100644
index 0000000000..7d95652a69
--- /dev/null
+++ b/playbooks/custom_functions/passthrough.py
@@ -0,0 +1,45 @@
+def passthrough(input_1=None, input_2=None, input_3=None, input_4=None, input_5=None, input_6=None, input_7=None, input_8=None, input_9=None, input_10=None, **kwargs):
+    """
+    Return the inputs as outputs. This is useful for publishing pieces of data for other blocks in the playbook to use.
+    
+    Args:
+        input_1 (CEF type: *)
+        input_2 (CEF type: *)
+        input_3 (CEF type: *)
+        input_4 (CEF type: *)
+        input_5 (CEF type: *)
+        input_6 (CEF type: *)
+        input_7 (CEF type: *)
+        input_8 (CEF type: *)
+        input_9 (CEF type: *)
+        input_10 (CEF type: *)
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): The output item for each input
+        *.input_name: The corresponding input name for each output
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+    for index, input_value in enumerate([input_1, input_2, input_3, input_4, input_5, input_6, input_7, input_8, input_9, input_10]):
+        if input_value:
+            if isinstance(input_value, list):
+                for input_item in input_value:
+                    this_output = {}
+                    this_output['item'] = input_item
+                    this_output['input_name'] = "input_{}".format(index+1) 
+                    outputs.append(this_output)
+                
+            else:
+                this_output = {}
+                this_output['item'] = input_value
+                this_output['input_name'] = "input_{}".format(index+1) 
+                outputs.append(this_output)
+
+    phantom.debug('outputs of passthrough:\n{}'.format(outputs))
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/playbooks_list.json b/playbooks/custom_functions/playbooks_list.json
new file mode 100644
index 0000000000..32f1d9c9d6
--- /dev/null
+++ b/playbooks/custom_functions/playbooks_list.json
@@ -0,0 +1,94 @@
+{
+    "create_time": "2021-09-17T17:19:24.149079+00:00",
+    "custom_function_id": "4581ae2a513db9be2faa490bfe585aa1defdc089",
+    "description": "List all playbooks matching the provided name, category, and tags. If no filters are provided, list all playbooks.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [],
+            "description": "Only return playbooks with the provided name.",
+            "input_type": "item",
+            "name": "name",
+            "placeholder": "Playbook Name"
+        },
+        {
+            "contains_type": [],
+            "description": "Only returns playbooks that match the provided category.",
+            "input_type": "item",
+            "name": "category",
+            "placeholder": "Playbook Category"
+        },
+        {
+            "contains_type": [],
+            "description": "Only return playbooks that contain ALL the provided tags. Multiple tags must be a comma-separated list.",
+            "input_type": "item",
+            "name": "tags",
+            "placeholder": "tag1,tag2,tag3"
+        },
+        {
+            "contains_type": [],
+            "description": "Only return playbooks that exist in this repo.",
+            "input_type": "item",
+            "name": "repo",
+            "placeholder": "local"
+        },
+        {
+            "contains_type": [],
+            "description": "Only return playbooks that match the provided type. Accepts 'automation', 'input' or 'data.'",
+            "input_type": "item",
+            "name": "playbook_type",
+            "placeholder": "automation"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "*.id",
+            "description": "Playbook ID:\ne.g. 1234"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.full_name",
+            "description": "Playbook full name with repo, e.g.:\nlocal/playbook_name"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.name",
+            "description": "Playbook Name:\ne.g. My Playbook"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.category",
+            "description": "Playbook category:\ne.g. Uncategorized"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.tags",
+            "description": "List of tags:\ne.g. [ tag1, tag2, tag3 ]"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.active",
+            "description": "Playbook automation status:\ne.g. True or False"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.disabled",
+            "description": "Playbook enabled / disabled status:\ne.g. True or False"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.playbook_type",
+            "description": "Playbook type: 'automation' or 'data'"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.input_spec",
+            "description": "If the playbook type is 'data,' this will be a list of dictionaries for the accepted inputs."
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/playbooks_list.py b/playbooks/custom_functions/playbooks_list.py
new file mode 100644
index 0000000000..f26e5ebb47
--- /dev/null
+++ b/playbooks/custom_functions/playbooks_list.py
@@ -0,0 +1,104 @@
+def playbooks_list(name=None, category=None, tags=None, repo=None, playbook_type=None, **kwargs):
+    """
+    List all playbooks matching the provided name, category, and tags. If no filters are provided, list all playbooks.
+    
+    Args:
+        name: Only return playbooks with the provided name.
+        category: Only returns playbooks that match the provided category.
+        tags: Only return playbooks that contain ALL the provided tags. Multiple tags must be a comma-separated list.
+        repo: Only return playbooks that exist in this repo.
+        playbook_type: Only return playbooks that match the provided type. Accepts 'automation', 'input' or 'data.'
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.id: Playbook ID:
+            e.g. 1234
+        *.full_name: Playbook full name with repo, e.g.:
+            local/playbook_name
+        *.name: Playbook Name:
+            e.g. My Playbook
+        *.category: Playbook category:
+            e.g. Uncategorized
+        *.tags: List of tags:
+            e.g. [ tag1, tag2, tag3 ]
+        *.active: Playbook automation status:
+            e.g. True or False
+        *.disabled: Playbook enabled / disabled status:
+            e.g. True or False
+        *.playbook_type: Playbook type: 'automation' or 'data'
+        *.input_spec: If the playbook type is 'data,' this will be a list of dictionaries for the accepted inputs.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+    
+    url = phantom.build_phantom_rest_url('playbook')
+    params = {'pretty' : True, 'page_size': 0}
+    
+    # Add Name
+    if name:
+        params['_filter_name'] = f'"{name}"'
+    # Add Category
+    if category:
+        params['_filter_category'] = f'"{category}"'
+        
+    # Create list of tags and add tags minus whitespace 
+    if tags:
+        tags = [item.replace(' ','') for item in tags.split(',')]
+        params['_filter_tags__contains'] = f'{json.dumps(tags)}'
+    
+    # Add Repo
+    if isinstance(repo, int):
+        params['_filter_scm'] = f'{repo}'
+    # Translate string to id
+    elif isinstance(repo, str):
+        scm_params = {'_filter_name': f'"{repo}"'}
+        response = phantom.requests.get(uri=phantom.build_phantom_rest_url('scm'), params=scm_params, verify=False).json()
+        if response['count'] == 1:
+            params['_filter_scm'] = '{}'.format(response['data'][0]['id'])
+        else:
+            raise RuntimeError(f"Invalid repo specified: '{repo}'")       
+    
+    # Add type
+    if isinstance(playbook_type, str) and playbook_type.lower() in ['automation', 'input', 'data']:
+        # Alias 'input' to 'data'
+        if playbook_type.lower() == 'input':
+            playbook_type = 'data'
+        playbook_type = playbook_type.lower()
+    elif playbook_type:
+        raise TypeError(f"Invalid playbook type specified - '{playbook_type}' - must be one of: 'automation', 'input', 'data'")
+                     
+    # Fetch playbook data
+    response = phantom.requests.get(uri=url, params=params, verify=False).json()
+    # If playbooks were found generate output
+    if response['count'] > 0:
+        for data in response['data']:
+            
+            valid_playbook = False
+            # SOAR < 5.0 does not have playbook_type so providing a playbook type will raise an error
+            if not data.get('playbook_type') and playbook_type:
+                raise TypeError("playbook_type filter not valid on SOAR prior to 5.0")
+            # If no playbook type exists user does not want to filter on playbook types
+            elif not playbook_type:
+                valid_playbook = True
+            # If user provided a playbook type then only output playbooks that match that provided type
+            elif data.get('playbook_type') == playbook_type:
+                valid_playbook = True
+                
+            if valid_playbook:
+                outputs.append({'id': data['id'],
+                                'full_name': f"{data['_pretty_scm']}/{data['name']}",
+                                'name': data['name'],
+                                'category': data['category'],
+                                'tags': data['tags'],
+                                'active': data['active'],
+                                'disabled': data['disabled'],
+                                'playbook_type': data.get('playbook_type'),
+                                'input_spec': data.get('input_spec')
+                               })
+    else:
+        phantom.debug("No playbook found for supplied filter")
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/regex_extract_email.json b/playbooks/custom_functions/regex_extract_email.json
new file mode 100644
index 0000000000..bf03451ced
--- /dev/null
+++ b/playbooks/custom_functions/regex_extract_email.json
@@ -0,0 +1,35 @@
+{
+    "create_time": "2021-04-13T21:08:20.394899+00:00",
+    "custom_function_id": "41fbb093035db6dff20778327e42682cd7a33f0c",
+    "description": "Provide a string with one or more email addresses in it to be extracted.\nCan be helpful with strings from the To or CC fields of an email: \"<other_email@domain.com>, 'Name' <e-mail@domain.com>\"",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "String containing email addresses",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "email"
+            ],
+            "data_path": "*.email_address",
+            "description": "Parsed email addresses"
+        },
+        {
+            "contains_type": [
+                "domain"
+            ],
+            "data_path": "*.domain",
+            "description": "Domain names of the parsed email addresses (everything after the \"@\")"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/regex_extract_email.py b/playbooks/custom_functions/regex_extract_email.py
new file mode 100644
index 0000000000..0be5020e16
--- /dev/null
+++ b/playbooks/custom_functions/regex_extract_email.py
@@ -0,0 +1,35 @@
+def regex_extract_email(input_string=None, **kwargs):
+    """
+    Provide a string with one or more email addresses in it to be extracted.
+    Can be helpful with strings from the To or CC fields of an email: "<other_email@domain.com>, 'Name' <e-mail@domain.com>"
+    
+    Args:
+        input_string (CEF type: *): String containing email addresses
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.email_address (CEF type: email): Parsed email addresses
+        *.domain (CEF type: domain): Domain names of the parsed email addresses (everything after the "@")
+    """
+    ############################ Custom Code Goes Below This Line #################################
+
+    if not input_string:
+        raise ValueError('Missing input_string to process.')
+
+    import re
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+
+    email_regex = r'[a-z0-9.!#$%&\'*+/=?^_`{|}~-]+@[a-z0-9.-]+\.[a-z]{2,}'
+
+    for email in re.findall(email_regex, input_string, re.IGNORECASE):
+        phantom.debug('found email address: {}'.format(email))
+        outputs.append({
+            'email_address': email,
+            'domain': email.split('@')[-1]}
+        )
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/regex_extract_ipv4.json b/playbooks/custom_functions/regex_extract_ipv4.json
new file mode 100644
index 0000000000..2f687307e8
--- /dev/null
+++ b/playbooks/custom_functions/regex_extract_ipv4.json
@@ -0,0 +1,28 @@
+{
+    "create_time": "2021-03-23T19:52:27.702665+00:00",
+    "custom_function_id": "031e0d2e7d63647b12b99750a49038e9df5a0f3c",
+    "description": "Takes a single input and extracts all IPv4 addresses from it using regex.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "An input string that may contain an arbitrary number of ipv4 addresses",
+            "input_type": "list",
+            "name": "input_string",
+            "placeholder": "192.0.2.1"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "ip"
+            ],
+            "data_path": "*.ipv4",
+            "description": "Extracted ipv4 address"
+        }
+    ],
+    "platform_version": "4.10.0.40961",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/regex_extract_ipv4.py b/playbooks/custom_functions/regex_extract_ipv4.py
new file mode 100644
index 0000000000..3536090f7f
--- /dev/null
+++ b/playbooks/custom_functions/regex_extract_ipv4.py
@@ -0,0 +1,31 @@
+def regex_extract_ipv4(input_string=None, **kwargs):
+    """
+    Takes a single input and extracts all IPv4 addresses from it using regex.
+    
+    Args:
+        input_string (CEF type: *): An input string that may contain an arbitrary number of ipv4 addresses
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.ipv4 (CEF type: ip): Extracted ipv4 address
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import re
+    
+    outputs = []
+    ip_list = []
+    for ip in input_string:
+        if ip:
+            ip_rex = re.findall('(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)',ip)
+            for ip in set(ip_rex):
+                ip_list.append(ip)
+                
+    for ip in set(ip_list):
+        outputs.append({"ipv4": ip})
+            
+    phantom.debug("Extracted ips: {}".format(outputs))
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/regex_filter_list.json b/playbooks/custom_functions/regex_filter_list.json
new file mode 100644
index 0000000000..de63fd1584
--- /dev/null
+++ b/playbooks/custom_functions/regex_filter_list.json
@@ -0,0 +1,42 @@
+{
+    "create_time": "2021-04-19T20:11:08.343196+00:00",
+    "custom_function_id": "e77ff64b3274a644f799579652c234f9a7f2de28",
+    "description": "Filter values in a list using a regex and either keep or drop values that match, depending on the action parameter.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The list of items to filter using a regex",
+            "input_type": "list",
+            "name": "input_list",
+            "placeholder": "list to filter"
+        },
+        {
+            "contains_type": [],
+            "description": "The regular expression to use to filter the list",
+            "input_type": "item",
+            "name": "regex",
+            "placeholder": "\\w+\\.exe"
+        },
+        {
+            "contains_type": [],
+            "description": "Either 'keep' or 'drop' to specify what to do with the items that match the regular expression. The default is 'keep'.",
+            "input_type": "list",
+            "name": "action",
+            "placeholder": "'keep' or 'drop'"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "List of output items"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/regex_filter_list.py b/playbooks/custom_functions/regex_filter_list.py
new file mode 100644
index 0000000000..ed45823668
--- /dev/null
+++ b/playbooks/custom_functions/regex_filter_list.py
@@ -0,0 +1,39 @@
+def regex_filter_list(input_list=None, regex=None, action=None, **kwargs):
+    """
+    Filter values in a list using a regex and either keep or drop values that match, depending on the action parameter.
+    
+    Args:
+        input_list (CEF type: *): The list of items to filter using a regex
+        regex: The regular expression to use to filter the list
+        action: Either 'keep' or 'drop' to specify what to do with the items that match the regular expression. The default is 'keep'.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): List of output items
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import re
+
+    # this only works on lists, so print a warning and return None if the input is not a list
+    if not isinstance(input_list, list):
+        raise ValueError('input_list is not a list')
+
+    action = action.lower()
+    if action not in ('keep', 'drop'):
+        raise ValueError("action is not 'keep' or 'drop'")
+
+    # iterate through the items in the list and append each non-falsy one as its own dictionary
+    outputs = []
+    for item in input_list:
+        if item:
+            if re.match(str(regex), str(item)):
+                if action == 'keep':
+                    outputs.append({"item": item})
+            else:
+                if action == 'drop':
+                    outputs.append({"item": item})
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/regex_split.json b/playbooks/custom_functions/regex_split.json
new file mode 100644
index 0000000000..01d65ac6f5
--- /dev/null
+++ b/playbooks/custom_functions/regex_split.json
@@ -0,0 +1,42 @@
+{
+    "create_time": "2021-04-14T20:55:22.433977+00:00",
+    "custom_function_id": "b09e6a45f7ced6a7fd17b98264b078ec1996e27d",
+    "description": "Use a regular expression to split an input_string into multiple items.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The input string to split.",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": "string to split"
+        },
+        {
+            "contains_type": [],
+            "description": "The regular expression to use to split the string. Reserved regular expression characters should be escaped with a backslash, so '\\.' will match '.' and '\\\\\\\\' will match '\\'.",
+            "input_type": "item",
+            "name": "regex",
+            "placeholder": "[\\s.,;]+"
+        },
+        {
+            "contains_type": [],
+            "description": "Either True or False to indicate whether or not to remove whitespace before and after each item. Defaults to True",
+            "input_type": "item",
+            "name": "strip_whitespace",
+            "placeholder": "True"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "A list of items created by splitting the input string."
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/regex_split.py b/playbooks/custom_functions/regex_split.py
new file mode 100644
index 0000000000..c2a68924fa
--- /dev/null
+++ b/playbooks/custom_functions/regex_split.py
@@ -0,0 +1,39 @@
+def regex_split(input_string=None, regex=None, strip_whitespace=None, **kwargs):
+    """
+    Use a regular expression to split an input_string into multiple items.
+    
+    Args:
+        input_string (CEF type: *): The input string to split.
+        regex: The regular expression to use to split the string. Reserved regular expression characters should be escaped with a backslash, so '\.' will match '.' and '\\\\' will match '\'.
+        strip_whitespace: Either True or False to indicate whether or not to remove whitespace before and after each item. Defaults to True
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): A list of items created by splitting the input string.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    import re
+    
+    outputs = []
+    
+    # strip_whitespace defaults to True, but if any value besides "True" is provided, it will be set to False
+    if strip_whitespace == None or strip_whitespace.lower() == 'true':
+        strip_whitespace = True
+    else:
+        strip_whitespace = False
+    
+    regex = regex.replace('\\\\','\\')
+    results = re.split(regex, input_string)
+    
+    if strip_whitespace:
+        results = [result.strip() for result in results]
+
+    phantom.debug("the input string {} was split into {}".format(input_string, results))
+
+    for result in results:
+        outputs.append({'item': result})
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/string_split.json b/playbooks/custom_functions/string_split.json
new file mode 100644
index 0000000000..a3d47285a5
--- /dev/null
+++ b/playbooks/custom_functions/string_split.json
@@ -0,0 +1,42 @@
+{
+    "create_time": "2021-04-28T19:53:57.385922+00:00",
+    "custom_function_id": "3df37bde81cd69c94bd5d77ea8d8f8cee0214fd5",
+    "description": "Return a list of the components of input_string when split using the specified delimiter. If strip_whitespace is not specified or is \"True\", strip all whitespace from the beginning and end of each resulting component.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The string to split",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": "item_1, item_2, item_3"
+        },
+        {
+            "contains_type": [],
+            "description": "The delimiter to split by, which defaults to a comma",
+            "input_type": "item",
+            "name": "delimiter",
+            "placeholder": ","
+        },
+        {
+            "contains_type": [],
+            "description": "Either True or False to indicate whether or not to remove whitespace before and after each item. Defaults to True",
+            "input_type": "item",
+            "name": "strip_whitespace",
+            "placeholder": "True"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "*.item",
+            "description": "One result for each output item"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/string_split.py b/playbooks/custom_functions/string_split.py
new file mode 100644
index 0000000000..0e1194ecbd
--- /dev/null
+++ b/playbooks/custom_functions/string_split.py
@@ -0,0 +1,36 @@
+def string_split(input_string=None, delimiter=None, strip_whitespace=None, **kwargs):
+    """
+    Return a list of the components of input_string when split using the specified delimiter. If strip_whitespace is not specified or is "True", strip all whitespace from the beginning and end of each resulting component.
+    
+    Args:
+        input_string (CEF type: *): The string to split
+        delimiter: The delimiter to split by, which defaults to a comma
+        strip_whitespace: Either True or False to indicate whether or not to remove whitespace before and after each item. Defaults to True
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.item (CEF type: *): One result for each output item
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    if not delimiter:
+        delimiter = ","
+    
+    # strip_whitespace defaults to True, but if any value besides "True" is provided, it will be set to False
+    if strip_whitespace == "True" or strip_whitespace == True or strip_whitespace == None:
+        strip_whitespace = True
+    else:
+        strip_whitespace = False
+    
+    output_list = input_string.split(delimiter)
+    
+    outputs = []
+    for item in output_list:
+        if strip_whitespace:
+            item = item.strip()
+        outputs.append({"item": item})
+
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/string_to_lowercase.json b/playbooks/custom_functions/string_to_lowercase.json
new file mode 100644
index 0000000000..62472d6fd8
--- /dev/null
+++ b/playbooks/custom_functions/string_to_lowercase.json
@@ -0,0 +1,28 @@
+{
+    "create_time": "2021-04-28T19:53:45.712824+00:00",
+    "custom_function_id": "5b89b2189e3615c380ffdc039992ce8b209f5aa6",
+    "description": "Convert the provided string to all lowercase characters",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The string to convert to lowercase",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": "string to convert"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "lowercase_string",
+            "description": "The lowercase string after conversion"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/string_to_lowercase.py b/playbooks/custom_functions/string_to_lowercase.py
new file mode 100644
index 0000000000..5df02cd4b4
--- /dev/null
+++ b/playbooks/custom_functions/string_to_lowercase.py
@@ -0,0 +1,24 @@
+def string_to_lowercase(input_string=None, **kwargs):
+    """
+    Convert the provided string to all lowercase characters
+    
+    Args:
+        input_string (CEF type: *): The string to convert to lowercase
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        lowercase_string (CEF type: *): The lowercase string after conversion
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    try:
+        lowercase_string = input_string.lower()
+    except AttributeError:
+        raise ValueError('input_string must be a string or unicode')
+    
+    outputs = {"lowercase_string": lowercase_string}
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/string_to_uppercase.json b/playbooks/custom_functions/string_to_uppercase.json
new file mode 100644
index 0000000000..45f50f5a53
--- /dev/null
+++ b/playbooks/custom_functions/string_to_uppercase.json
@@ -0,0 +1,28 @@
+{
+    "create_time": "2021-04-28T18:59:13.280589+00:00",
+    "custom_function_id": "62a7fbbc463ca097bdb7c7f2cf84d5f7e071cbd8",
+    "description": "Convert the provided string to all uppercase characters.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "The string to convert to uppercase",
+            "input_type": "item",
+            "name": "input_string",
+            "placeholder": ""
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "data_path": "uppercase_string",
+            "description": "The string after converting to upper case"
+        }
+    ],
+    "platform_version": "4.10.3.51237",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/string_to_uppercase.py b/playbooks/custom_functions/string_to_uppercase.py
new file mode 100644
index 0000000000..b220f3cb76
--- /dev/null
+++ b/playbooks/custom_functions/string_to_uppercase.py
@@ -0,0 +1,24 @@
+def string_to_uppercase(input_string=None, **kwargs):
+    """
+    Convert the provided string to all uppercase characters.
+    
+    Args:
+        input_string (CEF type: *): The string to convert to uppercase
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        uppercase_string (CEF type: *): The string after converting to upper case
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    try:
+        uppercase_string = input_string.upper()
+    except AttributeError:
+        raise ValueError('input_string must be a string or unicode')
+    
+    outputs = {"uppercase_string": uppercase_string}
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/url_parse.json b/playbooks/custom_functions/url_parse.json
new file mode 100644
index 0000000000..a4315ee68d
--- /dev/null
+++ b/playbooks/custom_functions/url_parse.json
@@ -0,0 +1,60 @@
+{
+    "create_time": "2021-02-02T15:10:10.119581+00:00",
+    "custom_function_id": "afbe8e52b8fbd17c6282cfd1165242298655c038",
+    "description": "Separate a URL into its components using urlparse() from the urllib module of Python 3.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "url"
+            ],
+            "description": "The URL to parse",
+            "input_type": "item",
+            "name": "input_url",
+            "placeholder": "artifact:*.cef.requestUrl"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "scheme",
+            "description": "The scheme of the URL, such as HTTP, HTTPS, or FTP."
+        },
+        {
+            "contains_type": [
+                "domain"
+            ],
+            "data_path": "netloc",
+            "description": "The network location of the URL, which is typically the hostname."
+        },
+        {
+            "contains_type": [],
+            "data_path": "path",
+            "description": "The path to the resource after the first slash in the URL, such as \"en_us/software/splunk-security-orchestration-and-automation.html\"."
+        },
+        {
+            "contains_type": [],
+            "data_path": "params",
+            "description": "The parameters in the URL after the semicolon."
+        },
+        {
+            "contains_type": [],
+            "data_path": "query",
+            "description": "The query string of the URL after the question mark. Multiple parameters are not separated from each other."
+        },
+        {
+            "contains_type": [],
+            "data_path": "fragment",
+            "description": "The subcomponent of the resource which is identified after the hash sign."
+        },
+        {
+            "contains_type": [
+                "url"
+            ],
+            "data_path": "output_url",
+            "description": "Passthrough of the original url"
+        }
+    ],
+    "platform_version": "4.10.0.40961",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/url_parse.py b/playbooks/custom_functions/url_parse.py
new file mode 100644
index 0000000000..c53250005f
--- /dev/null
+++ b/playbooks/custom_functions/url_parse.py
@@ -0,0 +1,29 @@
+def url_parse(input_url=None, **kwargs):
+    """
+    Separate a URL into its components using urlparse() from the urllib module of Python 3.
+    
+    Args:
+        input_url (CEF type: url): The URL to parse
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        scheme: The scheme of the URL, such as HTTP, HTTPS, or FTP.
+        netloc (CEF type: domain): The network location of the URL, which is typically the hostname.
+        path: The path to the resource after the first slash in the URL, such as "en_us/software/splunk-security-orchestration-and-automation.html".
+        params: The parameters in the URL after the semicolon.
+        query: The query string of the URL after the question mark. Multiple parameters are not separated from each other.
+        fragment: The subcomponent of the resource which is identified after the hash sign.
+        output_url (CEF type: url): Passthrough of the original url
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    from urllib.parse import urlparse
+    
+    outputs = {}
+    if input_url:
+        parsed = urlparse(input_url)
+        outputs = {'scheme': parsed.scheme, 'netloc': parsed.netloc, 'path': parsed.path, 'params': parsed.params, 'query': parsed.query, 'fragment': parsed.fragment, 'output_url': input_url}
+                
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/workbook_add.json b/playbooks/custom_functions/workbook_add.json
new file mode 100644
index 0000000000..37022c7b06
--- /dev/null
+++ b/playbooks/custom_functions/workbook_add.json
@@ -0,0 +1,54 @@
+{
+    "create_time": "2021-08-24T14:42:23.906804+00:00",
+    "custom_function_id": "138036ba78ec7b362b5bcd909048b07f0dc0e6f4",
+    "description": "Add a workbook to a container. Provide a container id and a workbook name or id",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "A phantom container id",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "A workbook name or id",
+            "input_type": "item",
+            "name": "workbook",
+            "placeholder": "my_workbook"
+        },
+        {
+            "contains_type": [],
+            "description": "Defaults to True. Check to see if workbook already exists in container before adding.",
+            "input_type": "item",
+            "name": "check_for_existing_workbook",
+            "placeholder": "True or False"
+        },
+        {
+            "contains_type": [],
+            "description": "Defaults to True. Sets the added workbook to the current phase.",
+            "input_type": "item",
+            "name": "start_workbook",
+            "placeholder": "True or False"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "workbook_id",
+            "description": "ID of the workbook that was added"
+        },
+        {
+            "contains_type": [],
+            "data_path": "current_phase_id",
+            "description": "ID of the current phase if start_workbook set to True."
+        }
+    ],
+    "platform_version": "4.10.6.61906",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/workbook_add.py b/playbooks/custom_functions/workbook_add.py
new file mode 100644
index 0000000000..3c3f022083
--- /dev/null
+++ b/playbooks/custom_functions/workbook_add.py
@@ -0,0 +1,95 @@
+def workbook_add(container=None, workbook=None, check_for_existing_workbook=None, start_workbook=None, **kwargs):
+    """
+    Add a workbook to a container. Provide a container id and a workbook name or id
+    
+    Args:
+        container (CEF type: phantom container id): A phantom container id
+        workbook (CEF type: *): A workbook name or id
+        check_for_existing_workbook: Defaults to True. Check to see if workbook already exists in container before adding.
+        start_workbook: Defaults to True. Sets the added workbook to the current phase.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        workbook_id: ID of the workbook that was added
+        current_phase_id: ID of the current phase if start_workbook set to True.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    existing_templates = []
+    container_id = None
+    
+    # Ensure valid container input
+    if isinstance(container, dict) and container.get('id'):
+        container_id = container['id']
+    elif isinstance(container, int):
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    # Determine if check_for_existing_workbook should be overwritten by function input
+    if isinstance(check_for_existing_workbook, str) and check_for_existing_workbook.lower() == 'false':
+        check_for_existing_workbook = False
+    else:
+        check_for_existing_workbook = True
+        
+    # Determine if start_workbook should be overwritten by function input
+    if isinstance(start_workbook, str) and start_workbook.lower() == 'false':
+        start_workbook = False
+    else:
+        start_workbook = True
+        
+    if check_for_existing_workbook:
+        #phantom.debug('Checking for existing workbook')
+        url = phantom.build_phantom_rest_url('container', container_id, 'phases')
+        container_data = phantom.requests.get(url, verify=False).json()
+        if container_data['count'] > 0:
+            phase_names = set([phase_id['name'] for phase_id in container_data['data']])
+            existing_templates = []
+            for name in phase_names:
+                url = phantom.build_phantom_rest_url('workbook_phase_template') + '?_filter_name="{}"'.format(name)
+                phase_template_response = phantom.requests.get(url, verify=False).json()
+                if phase_template_response['count'] > 0:
+                    for phase in phase_template_response['data']:
+                        existing_templates.append(phase['template'])
+            existing_templates = set(existing_templates)
+            
+    if isinstance(workbook,int):
+        workbook_id = workbook
+        if workbook_id in existing_templates:
+                phantom.debug("Workbook already added to container. Skipping")
+        else:
+            phantom.add_workbook(container=container_id, workbook_id=workbook_id)
+            
+        
+    elif isinstance(workbook, str):
+        url = phantom.build_phantom_rest_url('workbook_template') + '?_filter_name="{}"'.format(workbook)
+        response = phantom.requests.get(url, verify=False).json()
+        if response['count'] > 1:
+            raise RuntimeError('Unable to add workbook - more than one ID matches workbook name')
+        elif response['data'][0]['id']:
+            workbook_id = response['data'][0]['id']
+            
+            if workbook_id in existing_templates:
+                phantom.debug("Workbook already added to container. Skipping")
+            else:
+                phantom.add_workbook(container=container_id, workbook_id=workbook_id)
+    
+    outputs['workbook_id'] = workbook_id
+    
+    if start_workbook:
+        url = phantom.build_phantom_rest_url('workbook_phase_template') + '?_filter_template="{}"'.format(workbook_id)
+        first_phase = phantom.requests.get(url, verify=False).json()['data'][0]['name']
+        url = phantom.build_phantom_rest_url('container', container_id, 'phases') + '?_filter_name="{}"'.format(first_phase)
+        existing_phases = phantom.requests.get(url, verify=False).json()
+        if existing_phases['count'] > 1:
+            raise RuntimeError('Cannot set current phase - duplicate phase names exist in container')
+        else:
+            phantom.set_phase(container=container_id, phase=existing_phases['data'][0]['id'], trace=False)
+            outputs['current_phase_id'] = existing_phases['data'][0]['id']
+            
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
+
diff --git a/playbooks/custom_functions/workbook_list.json b/playbooks/custom_functions/workbook_list.json
new file mode 100644
index 0000000000..9c012ad05b
--- /dev/null
+++ b/playbooks/custom_functions/workbook_list.json
@@ -0,0 +1,58 @@
+{
+    "create_time": "2021-02-01T20:09:54.597377+00:00",
+    "custom_function_id": "f6015f324c26982d963e40b33a344f558b0c168e",
+    "description": "Return a list of all the workbooks on this Phantom instance. This might be useful to display possible options for workbooks to add to this event.",
+    "draft_mode": false,
+    "inputs": [],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "*.id",
+            "description": "Unique workbook ID"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.name",
+            "description": "Workbook name"
+        },
+        {
+            "contains_type": [
+                ""
+            ],
+            "data_path": "*.description",
+            "description": "Workbook description"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.status",
+            "description": "Status of the workbook, e.g. published"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.is_default",
+            "description": "True or False if it is the default workbook"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.is_note_required",
+            "description": "True or False if a note is required to finish each task in the workbook"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.creator",
+            "description": "Unique ID of the user that created the workbook"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.create_time",
+            "description": "Timestamp when the workbook was created"
+        },
+        {
+            "contains_type": [],
+            "data_path": "*.modified_time",
+            "description": "Timestamp when the workbook was last modified"
+        }
+    ],
+    "platform_version": "4.10.0.40961",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/workbook_list.py b/playbooks/custom_functions/workbook_list.py
new file mode 100644
index 0000000000..a481ce3720
--- /dev/null
+++ b/playbooks/custom_functions/workbook_list.py
@@ -0,0 +1,41 @@
+def workbook_list(**kwargs):
+    """
+    Return a list of all the workbooks on this Phantom instance. This might be useful to display possible options for workbooks to add to this event.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        *.id: Unique workbook ID
+        *.name: Workbook name
+        *.description: Workbook description
+        *.status: Status of the workbook, e.g. published
+        *.is_default: True or False if it is the default workbook
+        *.is_note_required: True or False if a note is required to finish each task in the workbook
+        *.creator: Unique ID of the user that created the workbook
+        *.create_time: Timestamp when the workbook was created
+        *.modified_time: Timestamp when the workbook was last modified
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = []
+    url = phantom.build_phantom_rest_url('workbook_template') + '?page_size=0'
+    phantom.debug(f"Querying for workbooks using URL: '{url}'")
+    
+    response = phantom.requests.get(uri=url, verify=False).json()
+    if response and response['count'] > 0:
+        for data in response['data']:
+            outputs.append({"id": data['id'],
+                            "name": data['name'],
+                            "description": data['description'],
+                            "status": data['status'],
+                            "is_default": data['is_default'],
+                            "is_note_required": data['is_note_required'],
+                            "creator": data['creator'],
+                            "create_time": data['create_time'],
+                            "modified_time": data['modified_time']})
+    else:
+        raise RuntimeError(f"Error getting workbook data: {response}") 
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/workbook_task_update.json b/playbooks/custom_functions/workbook_task_update.json
new file mode 100644
index 0000000000..af03e21730
--- /dev/null
+++ b/playbooks/custom_functions/workbook_task_update.json
@@ -0,0 +1,71 @@
+{
+    "create_time": "2021-10-08T21:01:32.942530+00:00",
+    "custom_function_id": "71ecfbca11ceb4ee5cf40d6307e00cf9505bac12",
+    "description": "Update a workbook task by task name",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Name of a workbook task (Required)",
+            "input_type": "item",
+            "name": "task_name",
+            "placeholder": "my_task"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Note title goes here (Optional)",
+            "input_type": "item",
+            "name": "note_title",
+            "placeholder": "My Title"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Body of note goes here (Optional)",
+            "input_type": "item",
+            "name": "note_content",
+            "placeholder": "My notes"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "One of: incomplete, in_progress, complete (Optional)",
+            "input_type": "item",
+            "name": "status",
+            "placeholder": "in_progress"
+        },
+        {
+            "contains_type": [
+                "*"
+            ],
+            "description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)",
+            "input_type": "item",
+            "name": "owner",
+            "placeholder": "username"
+        },
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "ID of Phantom Container (Required)",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "note_id",
+            "description": "Returns note_id if a note was added"
+        }
+    ],
+    "platform_version": "5.0.1.66250",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/workbook_task_update.py b/playbooks/custom_functions/workbook_task_update.py
new file mode 100644
index 0000000000..354a712b19
--- /dev/null
+++ b/playbooks/custom_functions/workbook_task_update.py
@@ -0,0 +1,133 @@
+def workbook_task_update(task_name=None, note_title=None, note_content=None, status=None, owner=None, container=None, **kwargs):
+    """
+    Update a workbook task by task name
+    
+    Args:
+        task_name (CEF type: *): Name of a workbook task (Required)
+        note_title (CEF type: *): Note title goes here (Optional)
+        note_content (CEF type: *): Body of note goes here (Optional)
+        status (CEF type: *): One of: incomplete, in_progress, complete (Optional)
+        owner (CEF type: *): Assigns task to provided owner. Accepts keyword 'current" to assign task to currently running playbook user. (Optional)
+        container (CEF type: phantom container id): ID of Phantom Container (Required)
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        note_id: Returns note_id if a note was added
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+    
+    outputs = {}
+    
+    # Ensure valid container input
+    if isinstance(container, dict) and container.get('id'):
+        container_id = container['id']
+    elif isinstance(container, int):
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+        
+    if task_name:
+        task_list = phantom.get_tasks(container_id)
+        task_count = 0
+        for task in task_list:
+            if task_name == task['data']['name']:
+                task_count += 1
+                if task_count > 1:
+                    raise RuntimeError(f'Unable to update workbook task - multiple tasks match criteria: {task_count}')
+                task_id = task['data']['id']
+                task_is_note_required = task['data']['is_note_required']
+                task_count += 1
+                task_status = task['data']['status']
+                task_notes = task['data']['notes']
+                task_owner = task['data']['owner']
+                
+    if task_count == 0:
+        raise RuntimeError(f"No task name matches input task_name: '{task_name}'")
+
+    if task_is_note_required and (not note_content or not note_title) and status == 'complete' and task_status != 1:
+        raise RuntimeError('Unable to update workbook task - The task requires a closing note and a closing title')     
+    else:
+        # Add Note
+        if note_content:
+            success, message, note_id = phantom.add_note(container=container_id, note_type='task',
+                                                         task_id=task_id, title=note_title, 
+                                                         content=note_content, note_format='markdown')
+            outputs['note_id'] = str(note_id)
+
+        # Set owner
+        if owner:
+            owner_dict = {}
+            # If keyword 'current' entered then translate effective_user id to a username
+            if owner.lower() == 'current':
+                owner_dict['owner_id'] = phantom.get_effective_user()
+            else:
+                # Attempt to translate name to owner_id
+                url = phantom.build_phantom_rest_url('ph_user') + f'?_filter_username="{owner}"'
+                data = phantom.requests.get(url, verify=False).json().get('data')
+                if data and len(data) == 1:
+                    owner_dict['owner_id'] = data[0]['id']
+                elif data and len(data) > 1:
+                    raise RuntimeError(f'Multiple matches for owner "{owner}"')
+                else:
+                    # Attempt to translate name to role_id
+                    url = phantom.build_phantom_rest_url('role') + f'?_filter_name="{owner}"'
+                    data = phantom.requests.get(url, verify=False).json().get('data')
+                    if data and len(data) == 1:
+                        owner_dict['role_id'] = data[0]['id']
+                    elif data and len(data) > 1:
+                        raise RuntimeError(f'Multiple matches for owner "{owner}"')
+                    else:
+                        raise RuntimeError(f'"{owner}" is not a valid username or role')
+                           
+            url = phantom.build_phantom_rest_url('workbook_task') + '/{}'.format(task_id)
+            response = phantom.requests.post(url, data=json.dumps(owner_dict), verify=False).json()             
+            if not response.get('success'):
+                raise RuntimeError(f'Error setting "{owner}" - {response}')
+                           
+        # Set Status
+        if isinstance(status, str):
+            status = status.lower()
+            url = phantom.build_phantom_rest_url('workbook_task') + '/{}'.format(task_id)
+            if status == 'complete' and task_status == 0:
+                # Move to in progress
+                data = {'status': 2}
+                response = phantom.requests.post(url, data=json.dumps(data), verify=False).json()
+                if not response.get('success'):
+                    raise RuntimeError(f'Error setting status "{status}" - {response}')
+                    # Then move to close
+                data = {'status': 1}
+                if task_is_note_required and note_content:
+                    data['note'] = note_content
+                    data['title'] = note_title
+                    data['note_format'] = 'markdown'
+                response = phantom.requests.post(url, data=json.dumps(data), verify=False).json()
+                if not response.get('success'):
+                    raise RuntimeError(f'Error setting status "{status}" - {response}')
+            elif (status == 'in progress' or status == 'in_progress') and task_status != 2:
+                data = {'status': 2}
+                # Move to in progress
+                response = phantom.requests.post(url, data=json.dumps(data), verify=False).json()
+                if not response.get('success'):
+                    raise RuntimeError(f'Error setting status "{status}" - {response}')
+            elif status == 'incomplete' and task_status != 0:
+                data = {'status': 0}
+                # Move to incomplete
+                response = phantom.requests.post(url, data=json.dumps(data), verify=False).json()
+                if not response.get('success'):
+                    raise RuntimeError(f'Error setting status "{status}" - {response}')
+            elif status == 'complete' and task_status != 1:
+                data = {'status': 1}
+                # Move to complete
+                if task_is_note_required and note_content:
+                    data['note'] = note_content
+                    data['title'] = note_title
+                    data['note_format'] = 'markdown'
+                response = phantom.requests.post(url, data=json.dumps(data), verify=False).json()
+                if not response.get('success'):
+                    raise RuntimeError(f'Error setting status "{status}" - {response}')
+                        
+        
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/custom_functions/zip_extract.json b/playbooks/custom_functions/zip_extract.json
new file mode 100644
index 0000000000..e829cfc81b
--- /dev/null
+++ b/playbooks/custom_functions/zip_extract.json
@@ -0,0 +1,60 @@
+{
+    "create_time": "2021-09-21T15:42:41.329482+00:00",
+    "custom_function_id": "88e76e61451c3d3d0b1d2537a8bf7f9b3bf5bc80",
+    "description": "Extract all files recursively from a .zip archive. Add the extracted files to the vault and return the vault IDs of the extracted files. Provide a password if needed to decrypt.",
+    "draft_mode": false,
+    "inputs": [
+        {
+            "contains_type": [
+                "phantom container id"
+            ],
+            "description": "The container that extracted files will be added to. Should be a container ID or a container dictionary.",
+            "input_type": "item",
+            "name": "container",
+            "placeholder": "container:id"
+        },
+        {
+            "contains_type": [],
+            "description": "The vault ID of the zip archive to be unzipped.",
+            "input_type": "item",
+            "name": "vault_id",
+            "placeholder": "artifact:*.cef.vaultId"
+        },
+        {
+            "contains_type": [],
+            "description": "The password to use for decryption of the zip archive if necessary.",
+            "input_type": "item",
+            "name": "password",
+            "placeholder": "infected"
+        }
+    ],
+    "outputs": [
+        {
+            "contains_type": [],
+            "data_path": "zip_file_info.name",
+            "description": "File name of the zip file in the vault"
+        },
+        {
+            "contains_type": [],
+            "data_path": "zip_file_info.user",
+            "description": "User who added the zip file to the vault"
+        },
+        {
+            "contains_type": [],
+            "data_path": "output_files.*.file_name",
+            "description": "The names of the files extracted from the zip archive."
+        },
+        {
+            "contains_type": [],
+            "data_path": "output_files.*.file_path",
+            "description": "The file paths of the files extracted from the zip archive."
+        },
+        {
+            "contains_type": [],
+            "data_path": "output_files.*.vault_id",
+            "description": "The vault IDs of the files extracted from the zip archive."
+        }
+    ],
+    "platform_version": "4.10.7.63984",
+    "python_version": "3"
+}
\ No newline at end of file
diff --git a/playbooks/custom_functions/zip_extract.py b/playbooks/custom_functions/zip_extract.py
new file mode 100644
index 0000000000..a559c98e7b
--- /dev/null
+++ b/playbooks/custom_functions/zip_extract.py
@@ -0,0 +1,68 @@
+def zip_extract(container=None, vault_id=None, password=None, **kwargs):
+    """
+    Extract all files recursively from a .zip archive. Add the extracted files to the vault and return the vault IDs of the extracted files. Provide a password if needed to decrypt.
+    
+    Args:
+        container (CEF type: phantom container id): The container that extracted files will be added to. Should be a container ID or a container dictionary.
+        vault_id: The vault ID of the zip archive to be unzipped.
+        password: The password to use for decryption of the zip archive if necessary.
+    
+    Returns a JSON-serializable object that implements the configured data paths:
+        zip_file_info.name: File name of the zip file in the vault
+        zip_file_info.user: User who added the zip file to the vault
+        output_files.*.file_name: The names of the files extracted from the zip archive.
+        output_files.*.file_path: The file paths of the files extracted from the zip archive.
+        output_files.*.vault_id: The vault IDs of the files extracted from the zip archive.
+    """
+    ############################ Custom Code Goes Below This Line #################################
+    import json
+    import phantom.rules as phantom
+
+    import os
+    from pathlib import Path
+    import zipfile
+    
+    outputs = {'output_files': []}
+
+    # Ensure valid container input
+    if isinstance(container, dict) and container.get('id'):
+        container_id = container['id']
+    elif isinstance(container, int):
+        container_id = container
+    else:
+        raise TypeError("The input 'container' is neither a container dictionary nor an int, so it cannot be used")
+    
+    # check the vault_id input
+    success, message, info = phantom.vault_info(
+        vault_id=vault_id,
+        container_id=container_id
+    )
+    if not success:
+        raise ValueError("Could not find file in vault")
+    outputs['zip_file_info'] = info[0]
+
+    if password and not isinstance(password, str):
+        raise TypeError("password must be a string")
+
+    # create a directory to store the extracted files before adding to the vault
+    extract_path = Path("/opt/phantom/vault/tmp/") / vault_id
+    extract_path.mkdir(parents=True, exist_ok=True)
+
+    # extract the files with ZipFile
+    with zipfile.ZipFile(info[0]["path"]) as f_zip:
+        if password:
+            f_zip.extractall(str(extract_path), pwd=password.encode())
+        else:
+            f_zip.extractall(str(extract_path))
+
+    # add each extracted file to the vault and the output
+    for p in extract_path.rglob("*"):
+        if p.is_file():
+            success, message, vault_id = phantom.vault_add(container=container_id, file_location=str(p), file_name=p.name)
+            if not success:
+                raise RuntimeError('failed to add file to vault with path {}'.format(str(p)))
+            outputs['output_files'].append({'file_path': str(p), 'file_name': p.name, 'vault_id': vault_id})
+    
+    # Return a JSON-serializable object
+    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
+    return outputs
diff --git a/playbooks/delete_detected_files.json b/playbooks/delete_detected_files.json
new file mode 100644
index 0000000000..eb62a40e7b
--- /dev/null
+++ b/playbooks/delete_detected_files.json
@@ -0,0 +1,1753 @@
+{
+    "blockly": false,
+    "blockly_xml": "<xml></xml>",
+    "category": "Use Cases",
+    "misc": {
+        "apps_list": [
+            "Windows Remote Management"
+        ]
+    },
+    "coa": {
+        "data": {
+            "clean": true,
+            "code_block": "",
+            "description": "This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host).\n\nBefore deleting the file, we run a \"more' command on the file in question to extract its contents.\n\nWe then run a delete on the file in question.",
+            "joint": {
+                "cells": [
+                    {
+                        "0": "S",
+                        "1": "T",
+                        "2": "A",
+                        "3": "R",
+                        "4": "T",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "ref-x": 33,
+                                "ref-y": 8,
+                                "text": "START"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "ref-x": 13,
+                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'Format_More_Command' block\n    Format_More_Command(container=container)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "24590087-c155-454c-96eb-dc4101bb8d6a",
+                        "inPorts": [],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 20,
+                        "line_start": 12,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 1,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 140,
+                            "y": 100
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "START",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 1
+                    },
+                    {
+                        "0": "E",
+                        "1": "N",
+                        "2": "D",
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".title": {
+                                "text": "END"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            }
+                        },
+                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
+                        "callback_code": "# read-only block view not available",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "Delete File",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "",
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "6f772cae-68c2-4ed8-bbc8-08760b957c48",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "# read-only block view not available",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 121,
+                        "line_start": 108,
+                        "name": "",
+                        "notes": "",
+                        "number": 0,
+                        "order": 6,
+                        "outPorts": [],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 780,
+                            "y": 240
+                        },
+                        "previous_function": "",
+                        "previous_name": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 54,
+                            "width": 80
+                        },
+                        "status": "",
+                        "title": "END",
+                        "type": "coa.StartEnd",
+                        "warn": false,
+                        "z": 2
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "66a4a7da-80d6-4281-b710-85069b36df80",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "24590087-c155-454c-96eb-dc4101bb8d6a",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "794cd262-ac73-4818-b672-6a903fd3a12c",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 25
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "Format More Command"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def Format_More_Command(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('Format_More_Command() called')\n    \n    template = \"\"\"more \\\"{0}\\\"\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.filePath\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"Format_More_Command\")\n\n    Gather_File_Contents(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "Format More Command",
+                        "description": "",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "794cd262-ac73-4818-b672-6a903fd3a12c",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 52,
+                        "line_start": 36,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "This format block creates the \"more' command string that we will use in the next action.",
+                        "number": 2,
+                        "order": 3,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "artifact:*.cef.filePath"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 280,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "Format_More_Command",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "more \"{0}\"",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 47
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "fa7b08ba-ee23-402f-8368-ec2efc0f5810",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "794cd262-ac73-4818-b672-6a903fd3a12c",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "afb1ebec-e216-4641-a044-dddc0b4744df",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 52
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "563ca714-e754-4aae-82a5-67253232ff71",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "afb1ebec-e216-4641-a044-dddc0b4744df",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "4730da9d-d17c-4b72-8f68-7d88d7e9e86c",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 55
+                    },
+                    {
+                        "action": "run command",
+                        "action_type": "generic",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "arguments": "",
+                            "async": "",
+                            "command": "Format_More_Command:formatted_data",
+                            "command_id": "",
+                            "ip_hostname": "artifact:*.cef.destinationAddress",
+                            "parser": "",
+                            "shell_id": ""
+                        },
+                        "angle": 0,
+                        "app": "Windows Remote Management",
+                        "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "run command",
+                                "actions": [
+                                    "delete file",
+                                    "copy file",
+                                    "upload file",
+                                    "get file",
+                                    "delete policy",
+                                    "block file path",
+                                    "list policies",
+                                    "restart system",
+                                    "shutdown system",
+                                    "activate partition",
+                                    "deactivate partition",
+                                    "list sessions",
+                                    "logoff user",
+                                    "add firewall rule",
+                                    "block ip",
+                                    "delete firewall rule",
+                                    "list firewall rules",
+                                    "list connections",
+                                    "terminate process",
+                                    "list processes",
+                                    "run script",
+                                    "run command",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "Windows Remote Management",
+                                "app_version": "2.0.0",
+                                "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+                                "asset_name": "winrm",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "arguments": "",
+                                    "async": "",
+                                    "command": "Format_More_Command:formatted_data",
+                                    "command_id": "",
+                                    "ip_hostname": "artifact:*.cef.destinationAddress",
+                                    "parser": "",
+                                    "shell_id": ""
+                                },
+                                "has_app": true,
+                                "id": 17,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "winrm",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.arguments",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "/all"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.async",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.command",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "ipconfig"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_path": "action_result.parameter.command_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "ip",
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.parameter.ip_hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "8.8.8.8"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "vault id"
+                                        ],
+                                        "data_path": "action_result.parameter.parser",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "8afa5c86de9ea94ecfe5b4c0837d2543d0b20b56"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_path": "action_result.parameter.shell_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.status_code",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            0
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.std_err",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Error message"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.std_out",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Successful output"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_path": "action_result.summary.command_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_path": "action_result.summary.shell_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Message",
+                                        "column_order": 0,
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Successfully ran command"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "arguments": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The arguments for the command",
+                                        "key": "arguments",
+                                        "order": 2,
+                                        "required": false
+                                    },
+                                    "async": {
+                                        "data_type": "boolean",
+                                        "default": false,
+                                        "description": "Start the command, but don't wait for output",
+                                        "key": "async",
+                                        "order": 4,
+                                        "required": false
+                                    },
+                                    "command": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The command to be run",
+                                        "key": "command",
+                                        "order": 1,
+                                        "required": false
+                                    },
+                                    "command_id": {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Command ID of async command (Provide with shell_id)",
+                                        "key": "command_id",
+                                        "order": 5,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "ip_hostname": {
+                                        "contains": [
+                                            "ip",
+                                            "host name"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "IP/Hostname",
+                                        "key": "ip_hostname",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "parser": {
+                                        "contains": [
+                                            "vault id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The vault ID of a custom parser to use for output",
+                                        "key": "parser",
+                                        "order": 3,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "shell_id": {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Shell ID of async command (Provide with command_id)",
+                                        "key": "shell_id",
+                                        "order": 6,
+                                        "primary": true,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "Windows Remote Management",
+                                "product_vendor": "Microsoft",
+                                "targets": "17",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "Gather File Contents"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Generic"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def Gather_File_Contents(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('Gather_File_Contents() called')\n\n    # collect data for 'Gather_File_Contents' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n    formatted_data_1 = phantom.get_format_data(name='Format_More_Command')\n\n    parameters = []\n    \n    # build parameters list for 'Gather_File_Contents' call\n    for container_item in container_data:\n        parameters.append({\n            'ip_hostname': container_item[0],\n            'command': formatted_data_1,\n            'arguments': \"\",\n            'parser': \"\",\n            'async': \"\",\n            'command_id': \"\",\n            'shell_id': \"\",\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(action=\"run command\", parameters=parameters, assets=['winrm'], callback=Format_Del_Command, name=\"Gather_File_Contents\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "",
+                        "connection_type": "",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "Gather File Contents",
+                        "delay": 0,
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "afb1ebec-e216-4641-a044-dddc0b4744df",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 79,
+                        "line_start": 52,
+                        "message": "Configuring now",
+                        "name": "run command",
+                        "notes": "This action runs the \"more\" command on the affected host to extract its contents prior to deletion.",
+                        "number": 3,
+                        "order": 4,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 520,
+                            "y": 80
+                        },
+                        "previous_function": "",
+                        "previous_name": "Gather_File_Contents",
+                        "required_params": {},
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Generic",
+                        "type": "coa.Action",
+                        "warn": "",
+                        "z": 60
+                    },
+                    {
+                        "active": false,
+                        "angle": 0,
+                        "attrs": {
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".format": {
+                                "text": "Format Del Command"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out-1": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out-1>.port-body": {
+                                "port": {
+                                    "id": "out-1",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "format"
+                            },
+                            "g.code image": {
+                                "opacity": 1
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.error image": {
+                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def Format_Del_Command(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('Format_Del_Command() called')\n    \n    template = \"\"\"del \\\"{0}\\\"\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.filePath\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"Format_Del_Command\")\n\n    Delete_File(container=container)\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": false,
+                        "connected_to_start": true,
+                        "connection_name": "Gather File Contents",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "Format Del Command",
+                        "description": "",
+                        "format": "format",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "4730da9d-d17c-4b72-8f68-7d88d7e9e86c",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 36,
+                        "line_start": 20,
+                        "message": "Configuring now",
+                        "name": "format",
+                        "notes": "This format block creates the \"delete\" command that is used in the next action.",
+                        "number": 1,
+                        "order": 2,
+                        "outPorts": [
+                            "out-1"
+                        ],
+                        "parameters": [
+                            {
+                                "position": 0,
+                                "type": "",
+                                "value": "artifact:*.cef.filePath"
+                            }
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 280,
+                            "y": 220
+                        },
+                        "previous_function": "",
+                        "previous_name": "Format_Del_Command",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "format",
+                        "status": "",
+                        "template": "del \"{0}\"",
+                        "title": "format",
+                        "type": "coa.Format",
+                        "warn": false,
+                        "z": 62
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "d5e76117-0d88-4a98-a50e-2325be10049b",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "4730da9d-d17c-4b72-8f68-7d88d7e9e86c",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "b0c7bb11-8a3e-445c-b7c6-7f969a50bee7",
+                            "selector": ".port-body[type=\"input\"]"
+                        },
+                        "type": "link",
+                        "z": 63
+                    },
+                    {
+                        "attrs": {
+                            ".connection": {
+                                "stroke": "#818D99",
+                                "stroke-width": 2
+                            },
+                            ".marker-target": {
+                                "d": "M 10 0 L 0 5 L 10 10 z",
+                                "fill": "#818D99",
+                                "stroke": "#818D99"
+                            }
+                        },
+                        "connector": {
+                            "args": {
+                                "radius": 5
+                            },
+                            "name": "rounded"
+                        },
+                        "endDirections": [
+                            "left"
+                        ],
+                        "id": "d91bf3ef-f6ad-4841-be3a-229e9ca4f2d3",
+                        "router": {
+                            "name": "metro"
+                        },
+                        "source": {
+                            "id": "b0c7bb11-8a3e-445c-b7c6-7f969a50bee7",
+                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "startDirections": [
+                            "right"
+                        ],
+                        "target": {
+                            "id": "6f772cae-68c2-4ed8-bbc8-08760b957c48",
+                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+                        },
+                        "type": "link",
+                        "z": 65
+                    },
+                    {
+                        "action": "run command",
+                        "action_type": "generic",
+                        "active": false,
+                        "active_keys": {},
+                        "active_values": {
+                            "arguments": "",
+                            "async": "",
+                            "command": "Format_Del_Command:formatted_data",
+                            "command_id": "",
+                            "ip_hostname": "artifact:*.cef.destinationAddress",
+                            "parser": "",
+                            "shell_id": ""
+                        },
+                        "angle": 0,
+                        "app": "Windows Remote Management",
+                        "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+                        "approver": "",
+                        "assets": [
+                            {
+                                "action": "run command",
+                                "actions": [
+                                    "delete file",
+                                    "copy file",
+                                    "upload file",
+                                    "get file",
+                                    "delete policy",
+                                    "block file path",
+                                    "list policies",
+                                    "restart system",
+                                    "shutdown system",
+                                    "activate partition",
+                                    "deactivate partition",
+                                    "list sessions",
+                                    "logoff user",
+                                    "add firewall rule",
+                                    "block ip",
+                                    "delete firewall rule",
+                                    "list firewall rules",
+                                    "list connections",
+                                    "terminate process",
+                                    "list processes",
+                                    "run script",
+                                    "run command",
+                                    "test connectivity"
+                                ],
+                                "active": true,
+                                "app_name": "Windows Remote Management",
+                                "app_version": "2.0.0",
+                                "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+                                "asset_name": "winrm",
+                                "config_type": "asset",
+                                "count": 0,
+                                "fields": {
+                                    "arguments": "",
+                                    "async": "",
+                                    "command": "Format_Del_Command:formatted_data",
+                                    "command_id": "",
+                                    "ip_hostname": "artifact:*.cef.destinationAddress",
+                                    "parser": "",
+                                    "shell_id": ""
+                                },
+                                "has_app": true,
+                                "id": 17,
+                                "loaded": false,
+                                "missing": false,
+                                "name": "winrm",
+                                "output": [
+                                    {
+                                        "data_path": "action_result.status",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "success",
+                                            "failed"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.arguments",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "/all"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.async",
+                                        "data_type": "boolean",
+                                        "example_values": [
+                                            true,
+                                            false
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.parameter.command",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "ipconfig"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_path": "action_result.parameter.command_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "ip",
+                                            "host name"
+                                        ],
+                                        "data_path": "action_result.parameter.ip_hostname",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "8.8.8.8"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "vault id"
+                                        ],
+                                        "data_path": "action_result.parameter.parser",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "8afa5c86de9ea94ecfe5b4c0837d2543d0b20b56"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_path": "action_result.parameter.shell_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.status_code",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            0
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.std_err",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Error message"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "action_result.data.*.std_out",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Successful output"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_path": "action_result.summary.command_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_path": "action_result.summary.shell_id",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "1AAA1111-1A11-11A1-1111-1A1AAA1A11A1"
+                                        ]
+                                    },
+                                    {
+                                        "column_name": "Message",
+                                        "column_order": 0,
+                                        "data_path": "action_result.message",
+                                        "data_type": "string",
+                                        "example_values": [
+                                            "Successfully ran command"
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    },
+                                    {
+                                        "data_path": "summary.total_objects_successful",
+                                        "data_type": "numeric",
+                                        "example_values": [
+                                            1
+                                        ]
+                                    }
+                                ],
+                                "parameters": {
+                                    "arguments": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The arguments for the command",
+                                        "key": "arguments",
+                                        "order": 2,
+                                        "required": false
+                                    },
+                                    "async": {
+                                        "data_type": "boolean",
+                                        "default": false,
+                                        "description": "Start the command, but don't wait for output",
+                                        "key": "async",
+                                        "order": 4,
+                                        "required": false
+                                    },
+                                    "command": {
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The command to be run",
+                                        "key": "command",
+                                        "order": 1,
+                                        "required": false
+                                    },
+                                    "command_id": {
+                                        "contains": [
+                                            "winrm command id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Command ID of async command (Provide with shell_id)",
+                                        "key": "command_id",
+                                        "order": 5,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "ip_hostname": {
+                                        "contains": [
+                                            "ip",
+                                            "host name"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "IP/Hostname",
+                                        "key": "ip_hostname",
+                                        "order": 0,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "parser": {
+                                        "contains": [
+                                            "vault id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "The vault ID of a custom parser to use for output",
+                                        "key": "parser",
+                                        "order": 3,
+                                        "primary": true,
+                                        "required": false
+                                    },
+                                    "shell_id": {
+                                        "contains": [
+                                            "winrm shell id"
+                                        ],
+                                        "data_type": "string",
+                                        "default": null,
+                                        "description": "Shell ID of async command (Provide with command_id)",
+                                        "key": "shell_id",
+                                        "order": 6,
+                                        "primary": true,
+                                        "required": false
+                                    }
+                                },
+                                "product_name": "Windows Remote Management",
+                                "product_vendor": "Microsoft",
+                                "targets": "17",
+                                "type": "endpoint"
+                            }
+                        ],
+                        "attrs": {
+                            ".action": {
+                                "text": "Delete File"
+                            },
+                            ".background": {
+                                "fill": "#000000",
+                                "stroke": "#5C6773"
+                            },
+                            ".color-band": {
+                                "fill": "#3C444D"
+                            },
+                            ".inPorts>.port-in": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".inPorts>.port-in>.port-body": {
+                                "port": {
+                                    "id": "in",
+                                    "type": "in"
+                                }
+                            },
+                            ".message": {
+                                "opacity": 0,
+                                "ref-x": 5,
+                                "ref-y": 105,
+                                "text": "Configuring now"
+                            },
+                            ".outPorts>.port-out": {
+                                "ref": ".background",
+                                "ref-x": 0.5
+                            },
+                            ".outPorts>.port-out>.port-body": {
+                                "port": {
+                                    "id": "out",
+                                    "type": "out"
+                                }
+                            },
+                            ".title": {
+                                "text": "Generic"
+                            },
+                            "g.delete": {
+                                "display": "none"
+                            },
+                            "g.error": {
+                                "opacity": 0
+                            },
+                            "g.icon image": {
+                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+                            },
+                            "g.notes": {
+                                "display": "block"
+                            },
+                            "g.notes image": {
+                                "opacity": 1,
+                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+                            }
+                        },
+                        "block_code": "def Delete_File(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('Delete_File() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'Delete_File' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n    formatted_data_1 = phantom.get_format_data(name='Format_Del_Command')\n\n    parameters = []\n    \n    # build parameters list for 'Delete_File' call\n    for container_item in container_data:\n        parameters.append({\n            'ip_hostname': container_item[0],\n            'command': formatted_data_1,\n            'arguments': \"\",\n            'parser': \"\",\n            'async': \"\",\n            'command_id': \"\",\n            'shell_id': \"\",\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(action=\"run command\", parameters=parameters, assets=['winrm'], name=\"Delete_File\")\n\n    return",
+                        "callback_code": "",
+                        "callback_start": 1,
+                        "callsback": true,
+                        "color": "",
+                        "connected_to_start": true,
+                        "connection_name": "Gather File Contents",
+                        "connection_type": "action",
+                        "custom_callback": "",
+                        "custom_code": "",
+                        "custom_join": "",
+                        "custom_name": "Delete File",
+                        "delay": 0,
+                        "description": "",
+                        "has_custom": false,
+                        "has_custom_block": false,
+                        "has_custom_callback": false,
+                        "has_custom_join": false,
+                        "id": "b0c7bb11-8a3e-445c-b7c6-7f969a50bee7",
+                        "inPorts": [
+                            "in"
+                        ],
+                        "join_code": "",
+                        "join_optional": [],
+                        "join_start": 1,
+                        "line_end": 108,
+                        "line_start": 79,
+                        "message": "Configuring now",
+                        "name": "run command",
+                        "notes": "This action runs the \"delete\" command on the affected host and file.",
+                        "number": 4,
+                        "order": 5,
+                        "outPorts": [
+                            "out"
+                        ],
+                        "ports": {
+                            "groups": {
+                                "in": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "left"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "left"
+                                    }
+                                },
+                                "out": {
+                                    "attrs": {
+                                        ".port-body": {
+                                            "fill": "#fff",
+                                            "magnet": true,
+                                            "r": 10,
+                                            "stroke": "#000"
+                                        },
+                                        ".port-label": {
+                                            "fill": "#000"
+                                        }
+                                    },
+                                    "label": {
+                                        "position": {
+                                            "args": {
+                                                "y": 10
+                                            },
+                                            "name": "right"
+                                        }
+                                    },
+                                    "position": {
+                                        "name": "right"
+                                    }
+                                }
+                            }
+                        },
+                        "position": {
+                            "x": 520,
+                            "y": 220
+                        },
+                        "previous_function": "",
+                        "previous_name": "Delete_File",
+                        "required_params": {},
+                        "reviewer": "",
+                        "show_number": true,
+                        "size": {
+                            "height": 100,
+                            "width": 180
+                        },
+                        "state": "app_action_assets",
+                        "status": "",
+                        "title": "Generic",
+                        "type": "coa.Action",
+                        "warn": "",
+                        "z": 66
+                    }
+                ]
+            },
+            "notes": "Windows Remote Management must be enabled on the remote computer."
+        },
+        "python_version": "3",
+        "schema": 4,
+        "version": "4.10.2.47587"
+    },
+    "create_time": "2021-03-29T17:15:25.016193+00:00",
+    "draft_mode": false,
+    "labels": [
+        "*"
+    ],
+    "tags": []
+}
diff --git a/playbooks/delete_detected_files.png b/playbooks/delete_detected_files.png
new file mode 100644
index 0000000000..eeb44fb375
Binary files /dev/null and b/playbooks/delete_detected_files.png differ
diff --git a/playbooks/delete_detected_files.py b/playbooks/delete_detected_files.py
new file mode 100644
index 0000000000..a5957721e7
--- /dev/null
+++ b/playbooks/delete_detected_files.py
@@ -0,0 +1,121 @@
+"""
+This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host).
+
+Before deleting the file, we run a "more' command on the file in question to extract its contents.
+
+We then run a delete on the file in question.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+def on_start(container):
+    phantom.debug('on_start() called')
+    
+    # call 'Format_More_Command' block
+    Format_More_Command(container=container)
+
+    return
+
+def Format_Del_Command(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('Format_Del_Command() called')
+    
+    template = """del \"{0}\""""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "artifact:*.cef.filePath",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="Format_Del_Command")
+
+    Delete_File(container=container)
+
+    return
+
+def Format_More_Command(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('Format_More_Command() called')
+    
+    template = """more \"{0}\""""
+
+    # parameter list for template variable replacement
+    parameters = [
+        "artifact:*.cef.filePath",
+    ]
+
+    phantom.format(container=container, template=template, parameters=parameters, name="Format_More_Command")
+
+    Gather_File_Contents(container=container)
+
+    return
+
+def Gather_File_Contents(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('Gather_File_Contents() called')
+
+    # collect data for 'Gather_File_Contents' call
+    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+    formatted_data_1 = phantom.get_format_data(name='Format_More_Command')
+
+    parameters = []
+    
+    # build parameters list for 'Gather_File_Contents' call
+    for container_item in container_data:
+        parameters.append({
+            'ip_hostname': container_item[0],
+            'command': formatted_data_1,
+            'arguments': "",
+            'parser': "",
+            'async': "",
+            'command_id': "",
+            'shell_id': "",
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': container_item[1]},
+        })
+
+    phantom.act(action="run command", parameters=parameters, assets=['winrm'], callback=Format_Del_Command, name="Gather_File_Contents")
+
+    return
+
+def Delete_File(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('Delete_File() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'Delete_File' call
+    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+    formatted_data_1 = phantom.get_format_data(name='Format_Del_Command')
+
+    parameters = []
+    
+    # build parameters list for 'Delete_File' call
+    for container_item in container_data:
+        parameters.append({
+            'ip_hostname': container_item[0],
+            'command': formatted_data_1,
+            'arguments': "",
+            'parser': "",
+            'async': "",
+            'command_id': "",
+            'shell_id': "",
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': container_item[1]},
+        })
+
+    phantom.act(action="run command", parameters=parameters, assets=['winrm'], name="Delete_File")
+
+    return
+
+def on_finish(container, summary):
+    phantom.debug('on_finish() called')
+    # This function is called after all actions are completed.
+    # summary of all the action and/or all details of actions
+    # can be collected here.
+
+    # summary_json = phantom.get_summary()
+    # if 'result' in summary_json:
+        # for action_result in summary_json['result']:
+            # if 'action_run_id' in action_result:
+                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+                # phantom.debug(action_results)
+
+    return
\ No newline at end of file
diff --git a/playbooks/delete_detected_files.yml b/playbooks/delete_detected_files.yml
new file mode 100644
index 0000000000..db95e2d059
--- /dev/null
+++ b/playbooks/delete_detected_files.yml
@@ -0,0 +1,24 @@
+name: Delete Detected Files
+id: fc0edc96-ff2b-48b0-9a6f-63da6783fd63
+version: 1
+date: '2021-03-29'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host). Before deleting the file, we run a "more" command on the file in question to extract its contents. We then run a delete on the file in question.
+playbook: delete_detected_files
+how_to_implement: This playbook reads and then deletes files stored with artifact:*.cef.filePath from hosts stored in artifact:*.cef.destinationAddress. Windows Remote Management must be enabled on the remote computer.
+references: []
+app_list:
+- "Windows Remote Management"
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  detections:
+  - Executable File Written in Administrative SMB Share
+  platform_tags:
+  - Response
+  playbook_fields:
+  - filePath
+  - destinationAddress
+  product:
+  - Splunk SOAR
diff --git a/requirements.txt b/requirements.txt
index 0c33c9467b..81f151cd5b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,12 +8,12 @@ CacheControl==0.12.10
 certifi==2021.10.8
 cfgv==3.3.1
 chardet==4.0.0
-charset-normalizer==2.0.7
+charset-normalizer==2.0.9
 colorama==0.4.4
 coloredlogs==15.0.1
 configparser==5.2.0
 contextlib2==21.6.0
-distlib==0.3.3
+distlib==0.3.4
 distro==1.6.0
 filelock==3.4.0
 fire==0.4.0
@@ -38,7 +38,7 @@ pendulum==2.1.2
 pep517==0.12.0
 Pillow==8.4.0
 platformdirs==2.4.0
-pre-commit==2.14.1
+pre-commit==2.16.0
 progress==1.6
 prompt-toolkit==1.0.14
 pycvesearch==1.0.1
@@ -57,7 +57,7 @@ requests==2.26.0
 retrying==1.3.3
 scandir==1.10.0
 semantic-version==2.8.5
-simplejson==3.17.5
+simplejson==3.17.6
 six==1.16.0
 sly==0.4
 smmap==5.0.0
diff --git a/stories/lateral_movement.yml b/stories/active_directory_lateral_movement.yml
similarity index 76%
rename from stories/lateral_movement.yml
rename to stories/active_directory_lateral_movement.yml
index b245f947c7..c54c881974 100644
--- a/stories/lateral_movement.yml
+++ b/stories/active_directory_lateral_movement.yml
@@ -1,19 +1,20 @@
-name: Lateral Movement
+name: Active Directory Lateral Movement
 id: 399d65dc-1f08-499b-a259-aad9051f38ad
-version: 2
-date: '2021-11-23'
+version: 3
+date: '2021-12-09'
 author: David Dorsey, Mauricio Velazco Splunk
 description: Detect and investigate tactics, techniques, and procedures around how
-  attackers move laterally within the enterprise. Because lateral movement can expose
-  the adversary to detection, it should be an important focus for security analysts.
+  attackers move laterally within an Active Directory environment. Since lateral movement 
+  is often a necessary step in a breach, it is important for cyber defenders to deploy 
+  detection coverage.
 narrative: "Once attackers gain a foothold within an enterprise, they will seek to\
   \ expand their accesses and leverage techniques that facilitate lateral movement.\
   \ Attackers will often spend quite a bit of time and effort moving laterally. Because\
   \ lateral movement renders an attacker the most vulnerable to detection, it's an\
   \ excellent focus for detection and investigation.\\\nIndications of lateral movement\
-  \ can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
-  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash,\
-  \ or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
+  \ in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
+  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager,\
+  \ the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
   \ lateral movement techniques and look for suspicious activity in and around high-value\
   \ strategic network assets, such as Active Directory, which are often considered\
   \ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\
@@ -32,9 +33,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek
   \ for all processes to ensure that the attackers did not install unauthorized software."
 references:
 - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
-- https://www.youtube.com/watch?v=hVTkkkM9XDg
+- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco
 tags:
-  analytic_story: Lateral Movement
+  analytic_story: Active Directory Lateral Movement
   category:
   - Adversary Tactics
   product:
diff --git a/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml
new file mode 100644
index 0000000000..96d82a8249
--- /dev/null
+++ b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Possible Lateral Movement PowerShell Spawn Unit Test
+tests:
+- name: Possible Lateral Movement PowerShell Spawn
+  file: endpoint/possible_lateral_movement_powershell_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/short_lived_scheduled_task.test.yml b/tests/endpoint/short_lived_scheduled_task.test.yml
new file mode 100644
index 0000000000..5cc0192b87
--- /dev/null
+++ b/tests/endpoint/short_lived_scheduled_task.test.yml
@@ -0,0 +1,12 @@
+name: Short Lived Scheduled Task Unit Test
+tests:
+- name: Short Lived Scheduled Task
+  file: endpoint/short_lived_scheduled_task.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
new file mode 100644
index 0000000000..0127db21ec
--- /dev/null
+++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
@@ -0,0 +1,10 @@
+name: BCDEdit Failure Recovery Modification - SSA Unit Test
+tests:
+  - name: BCDEdit Failure Recovery Modification
+    file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of BCDEdit Failure Recovery Modification
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
new file mode 100644
index 0000000000..407a7d7975
--- /dev/null
+++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
@@ -0,0 +1,9 @@
+name: Detect RClone Command-Line Usage Unit Test
+tests:
+- name: Detect RClone Command-Line Usage
+  file: endpoint/ssa___detect_rclone_command_line_usage.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
new file mode 100644
index 0000000000..cb4664986f
--- /dev/null
+++ b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
@@ -0,0 +1,9 @@
+name: DNS Exfiltration Using Nslookup App Unit Test
+tests:
+- name: DNS Exfiltration Using Nslookup App
+  file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml b/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml
new file mode 100644
index 0000000000..b78607f1a9
--- /dev/null
+++ b/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml
@@ -0,0 +1,10 @@
+name: Excessive Number of Office Files Copied Unit Test
+tests:
+  - name: Excessive Number of Office Files Copied
+    file: endpoint/ssa___excessive_number_of_office_files_copied.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for Excessive Number of Office Files Copied
+    attack_data:
+      - file_name: sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
+        source: xmlwineventlog
diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
new file mode 100644
index 0000000000..11edb21baf
--- /dev/null
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -0,0 +1,10 @@
+name: FSUtil Zeroing File - SSA Unit Test
+tests:
+  - name: FSUtil Zeroing File
+    file: endpoint/ssa___fsutil_zeroing_file.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of FSUtil Zeroing File
+    attack_data:
+    - file_name: windows-sysmon.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___high_file_deletion_frequency.test.yml b/tests/endpoint/ssa___high_file_deletion_frequency.test.yml
new file mode 100644
index 0000000000..d4b1a78b25
--- /dev/null
+++ b/tests/endpoint/ssa___high_file_deletion_frequency.test.yml
@@ -0,0 +1,10 @@
+name: High File Deletion Frequency Unit Test
+tests:
+  - name: High File Deletion Frequency
+    file: endpoint/ssa___high_file_deletion_frequency.yml
+    pass_condition: '@count_gt(0)'
+    description: Test for High File Deletion Frequency
+    attack_data:
+      - file_name: sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
+        source: xmlwineventlog
diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
new file mode 100644
index 0000000000..84a6b071df
--- /dev/null
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -0,0 +1,10 @@
+name: WBAdmin Delete System Backups - SSA Unit Test
+tests:
+  - name: WBAdmin Delete System Backups
+    file: endpoint/ssa___wbadmin_delete_system_backups.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of WBAdmin Delete System Backups
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
new file mode 100644
index 0000000000..b92fd512b0
--- /dev/null
+++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
@@ -0,0 +1,9 @@
+name: Windows Curl Upload to Remote Destination Unit Test
+tests:
+- name: Windows Curl Upload to Remote Destination
+  file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
+    source: WinEventLog:security
\ No newline at end of file