diff --git a/spec/baselines.json.spec b/spec/baselines.json.spec
new file mode 100644
index 0000000000..0e34e2935f
--- /dev/null
+++ b/spec/baselines.json.spec
@@ -0,0 +1,271 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "title": "Baseline Manifest",
+  "description": "The fields that make up the manifest of a version 2 baseline search",
+  "type": "object",
+  "properties": {
+    "name": {
+      "description": "The name of the search that creates the baseline",
+      "type": "string"
+    },
+    "id": {
+      "description": "The unique identifier for the search",
+      "type": "string"
+    },
+    "type": {
+      "description": "The type of baseline",
+      "enum": [
+        "splunk",
+        "phantom"
+      ]
+    },
+    "description": {
+      "description": "A description of what the search is is doing to create a baseline",
+      "type": "string"
+    },
+    "data_metadata": {
+      "type": "object",
+      "description": "Information about the date being ingested",
+      "properties": {
+        "data_models": {
+          "description": "A list of data models, if any, used by this search",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 0,
+          "uniqueItems": true
+        },
+        "data_eventtypes": {
+          "description": "A list of eventtypes, if any, used by this search",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 0,
+          "uniqueItems": true
+        },
+        "data_source": {
+          "description": "A high-level description of the type of data needed for this search to complete",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 0,
+          "uniqueItems": true
+        },
+        "data_sourcetypes": {
+          "description": "The list of sourcetypes, if any, used by this search",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 0,
+          "uniqueItems": true
+        },
+        "providing_technologies": {
+          "description": "A list of technologies that provide this data",
+          "type": "array",
+          "items": {
+            "enum": [
+              "Apache",
+              "AWS",
+              "Bro",
+              "Microsoft Windows",
+              "Linux",
+              "macOS",
+              "Netbackup",
+              "Splunk Enterprise",
+              "Splunk Enterprise Security",
+              "Splunk Stream",
+              "Active Directory",
+              "Bluecoat",
+              "Carbon Black Response",
+              "Carbon Black Protect",
+              "CrowdStrike Falcon",
+              "Microsoft Exchange",
+              "Nessus",
+              "Palo Alto Firewall",
+              "Qualys",
+              "Sysmon",
+              "Tanium",
+              "Ziften"
+            ]
+          },
+          "minItems": 0,
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "data_source",
+        "providing_technologies"
+      ]
+    },
+    "creation_date": {
+      "description": "The date the baseline manifest was created",
+      "type": "string"
+    },
+    "modification_date": {
+      "description": "The date of the most recent modification to the search",
+      "type": "string"
+    },
+    "original_authors": {
+      "description": "A list of the original authors of the search",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "company": {
+            "type": "string",
+            "description": "Company associated with the person who originally authored the search"
+          },
+          "email": {
+            "type": "string",
+            "description": "Email address of the person who originally authored the search"
+          },
+          "name": {
+            "type": "string",
+            "description": "Name of the person who originally authored the search"
+          }
+        },
+        "additionalProperties": false,
+        "required": [
+          "name",
+          "email",
+          "company"
+        ]
+      }
+    },
+    "maintainers": {
+      "description": "An array of the current maintainers of the Analytic Story.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "company": {
+            "type": "string",
+            "description": "Company associated with the person maintaining this search"
+          },
+          "email": {
+            "type": "string",
+            "description": "Email address of the person maintaining this search"
+          },
+          "name": {
+            "type": "string",
+            "description": "Name of the person maintaining this search"
+          }
+        },
+        "additionalProperties": false,
+        "required": [
+          "name",
+          "email",
+          "company"
+        ]
+      }
+    },
+    "how_to_implement": {
+      "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
+      "type": "string"
+    },
+    "known_false_positives": {
+      "description": "Describe the known false postives while the analyst builds the baseline.",
+      "type": "string"
+    },
+    "eli5": {
+      "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
+      "type": "string"
+    },
+    "spec_version": {
+      "description": "The version of the detection search specification this manifest follows",
+      "type": "integer"
+    },
+    "version": {
+      "description": "The version of the search",
+      "type": "string"
+    },
+    "baseline": {
+      "oneOf": [
+        {
+          "$ref": "#/definitions/splunk"
+        },
+        {
+          "$ref": "#/definitions/phantom"
+        }
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "phantom": {
+      "type": "object",
+      "properties": {
+        "phantom_server": {
+          "type": "string",
+          "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)"
+        },
+        "playbook_name": {
+          "type": "string",
+          "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment"
+        },
+        "playbook_display_name": {
+          "type": "string",
+          "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment"
+        },
+        "playbook_url": {
+          "type": "string",
+          "description": "Url of the playbook on Phantom website."
+        },
+        "sensitivity": {
+          "type": "string",
+          "description": "TLP colors (White, Green, Amber or Red)"
+        },
+        "severity": {
+          "type": "string",
+          "description": "Severity in phantom (High, Medium, Low)"
+        }
+      }
+    },
+    "splunk": {
+      "type": "object",
+      "properties": {
+        "scheduling": {
+          "type": "object",
+          "description": "Various fields to assist in scheduling the search",
+          "properties": {
+            "earliest_time": {
+              "description": "The earliest time the search should run in Splunk format",
+              "type": "string"
+            },
+            "latest_time": {
+              "description": "The latest time tes search should run against in Splunk format",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
+        "search": {
+          "description": "The search (in SPL) executed within core Splunk for creating a baseline",
+          "type": "string"
+        }
+      }
+    }
+  },
+  "required": [
+    "id",
+    "creation_date",
+    "data_metadata",
+    "eli5",
+    "known_false_positives",
+    "how_to_implement",
+    "maintainers",
+    "modification_date",
+    "original_authors",
+    "name",
+    "description",
+    "type",
+    "spec_version",
+    "version",
+    "baseline"
+  ]
+}
\ No newline at end of file
diff --git a/spec/support_search.json.spec b/spec/support_search.json.spec
index 0e34e2935f..6998d4c8aa 100644
--- a/spec/support_search.json.spec
+++ b/spec/support_search.json.spec
@@ -1,271 +1,200 @@
 {
-  "$schema": "http://json-schema.org/draft-04/schema#",
-  "title": "Baseline Manifest",
-  "description": "The fields that make up the manifest of a version 2 baseline search",
-  "type": "object",
-  "properties": {
-    "name": {
-      "description": "The name of the search that creates the baseline",
-      "type": "string"
-    },
-    "id": {
-      "description": "The unique identifier for the search",
-      "type": "string"
-    },
-    "type": {
-      "description": "The type of baseline",
-      "enum": [
-        "splunk",
-        "phantom"
-      ]
-    },
-    "description": {
-      "description": "A description of what the search is is doing to create a baseline",
-      "type": "string"
-    },
-    "data_metadata": {
-      "type": "object",
-      "description": "Information about the date being ingested",
-      "properties": {
-        "data_models": {
-          "description": "A list of data models, if any, used by this search",
-          "type": "array",
-          "items": {
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "title": "Support Search Manifest",
+    "description": "The fields that make up the manifest of a version 1 support search",
+    "type": "object",
+    "properties": {
+        "channel": {
+            "description": "A grouping function that designates where this search came from. For example, searches and stories in Enterprise Security Updates are in the ESCU channel",
             "type": "string"
-          },
-          "minItems": 0,
-          "uniqueItems": true
         },
-        "data_eventtypes": {
-          "description": "A list of eventtypes, if any, used by this search",
-          "type": "array",
-          "items": {
+        "creation_date": {
+            "description": "The date the story manifest was created",
             "type": "string"
-          },
-          "minItems": 0,
-          "uniqueItems": true
         },
-        "data_source": {
-          "description": "A high-level description of the type of data needed for this search to complete",
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "minItems": 0,
-          "uniqueItems": true
-        },
-        "data_sourcetypes": {
-          "description": "The list of sourcetypes, if any, used by this search",
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "minItems": 0,
-          "uniqueItems": true
-        },
-        "providing_technologies": {
-          "description": "A list of technologies that provide this data",
-          "type": "array",
-          "items": {
-            "enum": [
-              "Apache",
-              "AWS",
-              "Bro",
-              "Microsoft Windows",
-              "Linux",
-              "macOS",
-              "Netbackup",
-              "Splunk Enterprise",
-              "Splunk Enterprise Security",
-              "Splunk Stream",
-              "Active Directory",
-              "Bluecoat",
-              "Carbon Black Response",
-              "Carbon Black Protect",
-              "CrowdStrike Falcon",
-              "Microsoft Exchange",
-              "Nessus",
-              "Palo Alto Firewall",
-              "Qualys",
-              "Sysmon",
-              "Tanium",
-              "Ziften"
-            ]
-          },
-          "minItems": 0,
-          "uniqueItems": true
-        }
-      },
-      "additionalProperties": false,
-      "required": [
-        "data_source",
-        "providing_technologies"
-      ]
-    },
-    "creation_date": {
-      "description": "The date the baseline manifest was created",
-      "type": "string"
-    },
-    "modification_date": {
-      "description": "The date of the most recent modification to the search",
-      "type": "string"
-    },
-    "original_authors": {
-      "description": "A list of the original authors of the search",
-      "type": "array",
-      "items": {
-        "type": "object",
-        "properties": {
-          "company": {
-            "type": "string",
-            "description": "Company associated with the person who originally authored the search"
-          },
-          "email": {
-            "type": "string",
-            "description": "Email address of the person who originally authored the search"
-          },
-          "name": {
-            "type": "string",
-            "description": "Name of the person who originally authored the search"
-          }
-        },
-        "additionalProperties": false,
-        "required": [
-          "name",
-          "email",
-          "company"
-        ]
-      }
-    },
-    "maintainers": {
-      "description": "An array of the current maintainers of the Analytic Story.",
-      "type": "array",
-      "items": {
-        "type": "object",
-        "properties": {
-          "company": {
-            "type": "string",
-            "description": "Company associated with the person maintaining this search"
-          },
-          "email": {
-            "type": "string",
-            "description": "Email address of the person maintaining this search"
-          },
-          "name": {
-            "type": "string",
-            "description": "Name of the person maintaining this search"
-          }
-        },
-        "additionalProperties": false,
-        "required": [
-          "name",
-          "email",
-          "company"
-        ]
-      }
-    },
-    "how_to_implement": {
-      "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
-      "type": "string"
-    },
-    "known_false_positives": {
-      "description": "Describe the known false postives while the analyst builds the baseline.",
-      "type": "string"
-    },
-    "eli5": {
-      "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
-      "type": "string"
-    },
-    "spec_version": {
-      "description": "The version of the detection search specification this manifest follows",
-      "type": "integer"
-    },
-    "version": {
-      "description": "The version of the search",
-      "type": "string"
-    },
-    "baseline": {
-      "oneOf": [
-        {
-          "$ref": "#/definitions/splunk"
-        },
-        {
-          "$ref": "#/definitions/phantom"
-        }
-      ]
-    }
-  },
-  "additionalProperties": false,
-  "definitions": {
-    "phantom": {
-      "type": "object",
-      "properties": {
-        "phantom_server": {
-          "type": "string",
-          "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)"
-        },
-        "playbook_name": {
-          "type": "string",
-          "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment"
-        },
-        "playbook_display_name": {
-          "type": "string",
-          "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment"
-        },
-        "playbook_url": {
-          "type": "string",
-          "description": "Url of the playbook on Phantom website."
-        },
-        "sensitivity": {
-          "type": "string",
-          "description": "TLP colors (White, Green, Amber or Red)"
-        },
-        "severity": {
-          "type": "string",
-          "description": "Severity in phantom (High, Medium, Low)"
-        }
-      }
-    },
-    "splunk": {
-      "type": "object",
-      "properties": {
-        "scheduling": {
-          "type": "object",
-          "description": "Various fields to assist in scheduling the search",
-          "properties": {
-            "earliest_time": {
-              "description": "The earliest time the search should run in Splunk format",
-              "type": "string"
+        "data_metadata": {
+            "type": "object",
+            "description": "Information about the date being ingested",
+            "properties": {
+                "data_models": {
+                    "description": "A list of data models, if any, used by this search",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "minItems": 0,
+                    "uniqueItems": true
+                },
+                "data_source": {
+                    "description": "A high-level description of the type of data needed for this search to complete",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "minItems": 0,
+                    "uniqueItems": true
+                },
+                "data_sourcetypes": {
+                    "description": "The list of sourcetypes, if any, used by this search",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    },
+                    "minItems": 0,
+                    "uniqueItems": true
+                },
+                "data_eventtypes": {
+                    "description": "A list of eventtypes, if any, used by this search",
+                    "type": "array",
+                    "items": {
+                    "type": "string"
+                    },
+                    "minItems": 0,
+                    "uniqueItems": true
+                },
+                "providing_technologies": {
+                    "description": "A list of technologies that provide this data",
+                    "type": "array",
+                    "items": {
+                        "enum": ["Apache", "AWS", "Bro", "Microsoft Windows", "Linux", "macOS", "Netbackup", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream", "Active Directory", "Bluecoat", "Carbon Black Response", "Carbon Black Protect", "CrowdStrike Falcon", "Microsoft Exchange", "Nessus", "Palo Alto Firewall", "Qualys" , "Sysmon", "Tanium", "Ziften"]
+                    },
+                    "minItems": 0,
+                    "uniqueItems": true
+                }
             },
-            "latest_time": {
-              "description": "The latest time tes search should run against in Splunk format",
-              "type": "string"
+            "additionalProperties": false,
+            "required": ["data_source", "providing_technologies"]
+        },
+        "eli5": {
+            "description": "Explain it like I’m 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
+            "type": "string"
+        },
+        "how_to_implement": {
+            "description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
+            "type": "string"
+        },
+        "maintainers": {
+            "description": "An array of the current maintainers of the Analytic Story.",
+            "type": "array",
+            "items" :{
+                "type": "object",
+                "properties": {
+                    "company": {
+                        "type": "string",
+                        "description": "Company associated with the person maintaining this search"
+                    },
+                    "email": {
+                        "type": "string",
+                        "description": "Email address of the person maintaining this search"
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "Name of the person maintaining this search"
+                    }
+                },
+                "additionalProperties": false,
+                "required": ["name", "email", "company"]
             }
-          },
-          "additionalProperties": false
+        },
+        "modification_date": {
+            "description": "The date of the most recent modification to the search",
+            "type": "string"
+        },
+        "original_authors": {
+            "description": "A list of the original authors of the search",
+            "type": "array",
+            "items" :{
+                "type": "object",
+                "properties": {
+                    "company": {
+                        "type": "string",
+                        "description": "Company associated with the person who originally authored the search"
+                    },
+                    "email": {
+                        "type": "string",
+                        "description": "Email address of the person who originally authored the search"
+                    },
+                    "name": {
+                        "type": "string",
+                        "description": "Name of the person who originally authored the search"
+                    }
+                },
+                "additionalProperties": false,
+                "required": ["name", "email", "company"]
+            }
+        },
+        "scheduling": {
+            "type": "object",
+            "description": "Various fields to assist in scheduling the search",
+            "properties": {
+                "cron_schedule": {
+                    "description": "Schedule of the search in cron format",
+                    "type": "string"
+                },
+                "earliest_time": {
+                    "description": "The earliest time the search should run in Splunk format",
+                    "type": "string"
+                },
+               "latest_time": {
+                    "description": "The latest time the search should run against in Splunk format",
+                    "type": "string"
+                }
+            },
+            "additionalProperties": false
         },
         "search": {
-          "description": "The search (in SPL) executed within core Splunk for creating a baseline",
-          "type": "string"
+            "description": "The search (in SPL) executed within core Splunk",
+            "type": "string"
+        },
+        "search_description": {
+            "description": "A description of what the search is designed to detect",
+            "type": "string"
+        },
+        "search_id": {
+            "description": "The unique identifier for the search",
+            "type": "string"
+        },
+        "search_name": {
+            "description": "The name of the search",
+            "type": "string"
+        },
+        "search_type": {
+            "description": "The type of the search",
+            "enum": ["detection", "investigative", "contextual", "support"]
+        },
+        "spec_version": {
+            "description": "The version of the detection search specification this manifest follows",
+            "type": "integer"
+        },
+        "status": {
+            "description": "The current status of the search - development, experimental, production",
+            "enum": ["development", "experimental", "production"]
+        },
+        "team_notes": {
+            "description": "Notes for the team about the search",
+            "type": "string"
+        },
+        "version": {
+            "description": "The version of the search",
+            "type": "string"
         }
-      }
-    }
-  },
-  "required": [
-    "id",
-    "creation_date",
-    "data_metadata",
-    "eli5",
-    "known_false_positives",
-    "how_to_implement",
-    "maintainers",
-    "modification_date",
-    "original_authors",
-    "name",
-    "description",
-    "type",
-    "spec_version",
-    "version",
-    "baseline"
-  ]
+    },
+    "additionalProperties": false,
+    "required": [
+        "channel",
+        "creation_date",
+        "data_metadata",
+        "eli5",
+        "how_to_implement",
+        "maintainers",
+        "modification_date",
+        "original_authors",
+        "scheduling",
+        "search",
+        "search_description",
+        "search_id",
+        "search_type",
+        "spec_version",
+        "version"
+    ]
 }
\ No newline at end of file