diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml
deleted file mode 100644
index 4175681ff2..0000000000
--- a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Splunk Risky Command Abuse ML Detection Baseline
-id: 273df2f7-643a-451a-8d4d-637e39eadc87
-version: 1
-date: '2022-05-27'
-author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
-type: Baseline
-datamodel:
-- Splunk_Audit
-description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction 
-  algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running 
-  search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of 
-  user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to 
-  run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model 
-  generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same 
-  account of training this model will be used to perfeorm inference using this model for anomaly detection. 
-  The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". '
-search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count 
-  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
-  AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) 
-  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
-  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
-  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
-  BY _time, Search_Activity.user span=1h 
-  | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" '
-how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. 
-  For large enterprises, training the model might take significant computing resources, and might 
-  need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc.
-known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of
-  a search exceeds the boundaries of outlier defined by the fitted density function model. 
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  cis20:
-  - CIS 3
-  - CIS 6
-  confidence: 40
-  context:
-  - Source:Endpoint
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-  impact: 50
-  kill_chain_phases:
-  - Actions on Objectives
-  message: ML model "risky_command_abuse" training is completed.
-  mitre_attack_id:
-  - T1203
-  nist:
-  - DE.AE
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search
-  - Search_Activity.total_run_time 
-  - Search_Activity.user 
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-  detections: 
-  - Splunk Risky Command Abuse ML Detection
-
diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml
deleted file mode 100644
index 709d3b7182..0000000000
--- a/detections/application/splunk_risky_command_abuse_ml_detection.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Splunk Risky Command Abuse ML Detection
-id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca
-version: 1
-date: '2022-05-27'
-author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
-type: Anomaly
-datamodel:
-- Splunk_Audit
-description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk 
-  Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour 
-  to detect whether a user has run searches containing risky keywords with abnormal long running time in the 
-  past two hours, comparing with his/her past seven days history. '
-search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time,
-  values(Search_Activity.search) as searches, count 
-  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
-  AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) 
-  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
-  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
-  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
-  BY _time, Search_Activity.user span=1h 
-  | apply risky_command_abuse
-  | fields _time, user, searches, run_time, IsOutlier(run_time)
-  | rename IsOutlier(run_time) as isOutlier, _time as timestamp
-  | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`'
-how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. 
-known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of 
-  a search exceeds the boundaries of outlier defined by the fitted density function model. 
-references:
-- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
-tags:
-  analytic_story:
-  - Splunk Vulnerabilities
-  asset_type: Web Server
-  cis20:
-  - CIS 3
-  - CIS 6
-  confidence: 40
-  context:
-  - Source:Endpoint
-  dataset:
-  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-  impact: 50
-  kill_chain_phases:
-  - Actions on Objectives
-  message: $user used abnormally long run time for searches with risky command.
-  mitre_attack_id:
-  - T1203
-  nist:
-  - DE.AE
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Search_Activity.search 
-  - Search_Activity.total_run_time 
-  - Search_Activity.user 
-  - Search_Activity.search_type
-  risk_score: 20
-  security_domain: audit
-  
\ No newline at end of file
diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml
deleted file mode 100644
index c937b44717..0000000000
--- a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Splunk Risky Command Abuse ML Detection Unit Test
-tests:
-- name: Splunk Risky Command Abuse ML Detection
-  file: application/splunk_risky_command_abuse_ml_detection.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -1h
-  latest_time: now
-  baselines:
-  - name: Splunk Risky Command Abuse ML Detection Baseline
-    file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml
-    pass_condition: '| stats count | where count > 0'
-    earliest_time: -7d
-    latest_time: now
-  attack_data: 
-  - file_name: search_activity.json
-    data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
-    source: audittrail
-    sourcetype: audittrail
-    update_timestamp: true
-    custom_index: _audit