diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml
index 46ec4d1f2b..3b143f5652 100644
--- a/.github/workflows/unit-testing.yml
+++ b/.github/workflows/unit-testing.yml
@@ -13,7 +13,7 @@ jobs:
           with:
             ref: develop
 
-        - uses: actions/setup-python@v4
+        - uses: actions/setup-python@v5
           with:
             python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
             architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
diff --git a/.github/workflows/validate-and-build.yml b/.github/workflows/validate-and-build.yml
index bea48cc794..95b35acd10 100644
--- a/.github/workflows/validate-and-build.yml
+++ b/.github/workflows/validate-and-build.yml
@@ -11,14 +11,11 @@ jobs:
     steps:
       - name: Check out the repository code
         uses: actions/checkout@v3
-        with:
-          node-version: '20'
        
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
           architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
-          node-version: '20'
 
       - name: Install System Packages
         run: |
diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
index 5e5a80f73a..04d4d021a0 100644
--- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
@@ -1,6 +1,6 @@
 name: Access LSASS Memory for Dump Creation
 id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
-version: 4
+version: 3
 date: '2024-05-13'
 author: Patrick Bareiss, Splunk
 status: production
diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index ce9e97269f..2f4a8fd313 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -1,6 +1,6 @@
 name: Account Discovery With Net App
 id: 339805ce-ac30-11eb-b87d-acde48001122
-version: 6
+version: 5
 date: '2024-05-22'
 author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community
 status: production
diff --git a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
index e9e20c80d9..2ee10a8f52 100644
--- a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
+++ b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
@@ -1,6 +1,6 @@
 name: Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
 id: 15838756-f425-43fa-9d88-a7f88063e81a
-version: 3
+version: 2
 date: '2024-05-14'
 author: Michael Haag, Splunk
 status: production
diff --git a/detections/web/adobe_coldfusion_access_control_bypass.yml b/detections/web/adobe_coldfusion_access_control_bypass.yml
index f344db1e74..5828ebffb2 100644
--- a/detections/web/adobe_coldfusion_access_control_bypass.yml
+++ b/detections/web/adobe_coldfusion_access_control_bypass.yml
@@ -15,7 +15,7 @@ description: The following analytic detects potential exploitation attempts agai
   unauthorized access to ColdFusion administration endpoints. If confirmed malicious,
   this could result in data theft, brute force attacks, or further exploitation of
   other vulnerabilities, posing a serious security risk to the environment.
-search: 'x| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
+search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
   where Web.url IN ("//restplay*", "//CFIDE/restplay*", "//CFIDE/administrator*",
   "//CFIDE/adminapi*", "//CFIDE/main*", "//CFIDE/componentutils*", "//CFIDE/wizards*",
   "//CFIDE/servermanager*","/restplay*", "/CFIDE/restplay*", "/CFIDE/administrator*",