diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
index ae77fbd81c..c984b38532 100644
--- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
+++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/savedsearches_detections.j2
@@ -38,7 +38,7 @@ action.escu.providing_technologies = []
 {% endif %}
 {% if detection.tags.analytic_story is defined %}
 action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
-{% if detection.tags.risk_score is defined %}
+{% if detection.tags.risk_score is defined and detection.type | lower != "correlation" %}
 action.risk = 1
 action.risk.param._risk_message = {{ detection.tags.message }}
 action.risk.param._risk = {{ detection.risk | tojson }}
@@ -54,6 +54,8 @@ dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
 {% if detection.deprecated %}
 action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
+{% elif detection.type | lower == "correlation" %}
+action.correlationsearch.label = ESCU - RIR - {{ detection.name }} - Rule
 {% else %}
 action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
 {% endif %}
diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml
index 3c5f684833..ea3f339e48 100644
--- a/detections/endpoint/living_off_the_land.yml
+++ b/detections/endpoint/living_off_the_land.yml
@@ -1,19 +1,18 @@
 name: Living Off The Land
 id: 1be30d80-3a39-4df9-9102-64a467b24abc
 version: 2
-date: '2022-08-19'
+date: '2022-09-09'
 author: Michael Haag, Splunk
 type: Correlation
 datamodel:
   - Risk
 description: The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior. 
-search: '| tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source 
-  | `drop_dm_object_name(All_Risk)` 
-  | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type
-  | where source_count >= 5
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `living_off_the_land_filter`'
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic  
+| `drop_dm_object_name(All_Risk)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| where source_count >= 5
+| `living_off_the_land_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Living Off The Land Analytic Story and confirm it is generating risk events.
   A simple search `index=risk analyticstories="Living Off The Land"` should contain