diff --git a/detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml
similarity index 100%
rename from detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml
rename to detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml
diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/deprecated/high_number_of_login_failures_from_a_single_source.yml
similarity index 96%
rename from detections/cloud/high_number_of_login_failures_from_a_single_source.yml
rename to detections/deprecated/high_number_of_login_failures_from_a_single_source.yml
index 04d49c1634..333ac9e390 100644
--- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
+++ b/detections/deprecated/high_number_of_login_failures_from_a_single_source.yml
@@ -2,7 +2,7 @@ name: High Number of Login Failures from a single source
 id: 7f398cfb-918d-41f4-8db8-2e2474e02222
 version: 1
 date: '2020-12-16'
-description: This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
+description: This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate.
 type: ESCU
 author: Bhavin Patel, Splunk
 search: '`o365_management_activity` Operation=UserLoginFailed  record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory
diff --git a/detections/application/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml
similarity index 100%
rename from detections/application/open_redirect_in_splunk_web.yml
rename to detections/deprecated/open_redirect_in_splunk_web.yml
diff --git a/detections/application/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml
similarity index 100%
rename from detections/application/splunk_enterprise_information_disclosure.yml
rename to detections/deprecated/splunk_enterprise_information_disclosure.yml
diff --git a/detections/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml
similarity index 100%
rename from detections/network/excessive_dns_failures.yml
rename to detections/experimental/network/excessive_dns_failures.yml
diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml
similarity index 100%
rename from detections/network/large_volume_of_dns_any_queries.yml
rename to detections/experimental/network/large_volume_of_dns_any_queries.yml