diff --git a/bin/contentctl_project/contentctl_core/application/factory/factory.py b/bin/contentctl_project/contentctl_core/application/factory/factory.py
index 9ca556db7d..b28aeeea70 100644
--- a/bin/contentctl_project/contentctl_core/application/factory/factory.py
+++ b/bin/contentctl_project/contentctl_core/application/factory/factory.py
@@ -86,7 +86,7 @@ class Factory():
      def createSecurityContent(self, type: SecurityContentType) -> list[Tuple[pathlib.Path,  ValidationError]]:
           objects = []
           if type == SecurityContentType.deployments:
-               files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name), 'ESCU'))
+               files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name)))
           elif type == SecurityContentType.unit_tests:
                files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, 'tests'))
           else:
diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py
index 62a9e243c9..02c2eb7dfe 100644
--- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py
+++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_baseline_builder.py
@@ -34,18 +34,26 @@ class SecurityContentBaselineBuilder(BaselineBuilder):
 
         for d in deployments:
             d_tags = dict(d.tags)
+            baseline_dict = self.baseline.dict()
+            baseline_tags_dict = self.baseline.tags.dict()
             for d_tag in d_tags.keys():
-                for attr in dir(self.baseline):
-                    if not (attr.startswith('__') or attr.startswith('_')):
-                        if attr == d_tag:
-                            if type(self.baseline.__getattribute__(attr)) is str:
-                                attr_values = [self.baseline.__getattribute__(attr)]
-                            else:
-                                attr_values = self.baseline.__getattribute__(attr)
-                            
-                            for attr_value in attr_values:
-                                if attr_value == d_tags[d_tag]:
-                                    matched_deployments.append(d)
+                for attr in baseline_dict.keys():
+                    if attr == d_tag:
+                        if isinstance(baseline_dict[attr], str):
+                            if baseline_dict[attr] == d_tags[d_tag]:
+                                matched_deployments.append(d)
+                        elif isinstance(baseline_dict[attr], list):
+                            if d_tags[d_tag] in baseline_dict[attr]:
+                                matched_deployments.append(d)
+
+                for attr in baseline_tags_dict.keys():
+                    if attr == d_tag:
+                        if isinstance(baseline_tags_dict[attr], str):
+                            if baseline_tags_dict[attr] == d_tags[d_tag]:
+                                matched_deployments.append(d)
+                        elif isinstance(baseline_tags_dict[attr], list):
+                            if d_tags[d_tag] in baseline_tags_dict[attr]:
+                                matched_deployments.append(d)
 
         if len(matched_deployments) == 0:
             raise ValueError('No deployment found for baseline: ' + self.baseline.name)
diff --git a/deployments/ESCU/00_default_anomaly.yml b/deployments/00_default_anomaly.yml
similarity index 96%
rename from deployments/ESCU/00_default_anomaly.yml
rename to deployments/00_default_anomaly.yml
index 034de012d0..4ed7d3dadb 100644
--- a/deployments/ESCU/00_default_anomaly.yml
+++ b/deployments/00_default_anomaly.yml
@@ -14,4 +14,3 @@ alert_action:
     enabled: 'true'
 tags:
   type: Anomaly
-  product: ESCU
diff --git a/deployments/ESCU/00_default_baseline.yml b/deployments/00_default_baseline.yml
similarity index 100%
rename from deployments/ESCU/00_default_baseline.yml
rename to deployments/00_default_baseline.yml
diff --git a/deployments/ESCU/00_default_correlation.yml b/deployments/00_default_correlation.yml
similarity index 97%
rename from deployments/ESCU/00_default_correlation.yml
rename to deployments/00_default_correlation.yml
index b1cca041a6..6667ddccd2 100644
--- a/deployments/ESCU/00_default_correlation.yml
+++ b/deployments/00_default_correlation.yml
@@ -18,4 +18,3 @@ alert_action:
     - dest
 tags:
   type: 'Correlation'
-  product: ESCU
diff --git a/deployments/ESCU/00_default_hunting.yml b/deployments/00_default_hunting.yml
similarity index 95%
rename from deployments/ESCU/00_default_hunting.yml
rename to deployments/00_default_hunting.yml
index 89598ab6b3..bd562c3955 100644
--- a/deployments/ESCU/00_default_hunting.yml
+++ b/deployments/00_default_hunting.yml
@@ -10,4 +10,3 @@ scheduling:
   schedule_window: auto
 tags:
   type: Hunting
-  product: ESCU
diff --git a/deployments/ESCU/00_default_ttp.yml b/deployments/00_default_ttp.yml
similarity index 100%
rename from deployments/ESCU/00_default_ttp.yml
rename to deployments/00_default_ttp.yml
diff --git a/deployments/10_enterprise_security_deployment_configuration.yml b/deployments/10_enterprise_security_deployment_configuration.yml
deleted file mode 100644
index 6a9681fd71..0000000000
--- a/deployments/10_enterprise_security_deployment_configuration.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: Enterprise Security deployment configuration
-id: bc91a8cd-35e7-4bb2-6140-e756cc46f212
-date: '2020-04-27'
-author: Bhavin Patel
-description: This configuration file applies to all correlation searches that are
-  used for detection
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  analytic_story: all
diff --git a/deployments/11_detect_arp_poisoning.yml b/deployments/11_detect_arp_poisoning.yml
index a0e0b55c3a..c8ab23b4e9 100644
--- a/deployments/11_detect_arp_poisoning.yml
+++ b/deployments/11_detect_arp_poisoning.yml
@@ -19,4 +19,4 @@ alert_action:
     - lastTime
     - count
 tags:
-  detection_name: Detect ARP Poisoning
+  name: Detect ARP Poisoning
diff --git a/deployments/12_detect_dhcp_poisoning.yml b/deployments/12_detect_dhcp_poisoning.yml
index c1d0771fec..eb52b57951 100644
--- a/deployments/12_detect_dhcp_poisoning.yml
+++ b/deployments/12_detect_dhcp_poisoning.yml
@@ -20,4 +20,4 @@ alert_action:
     - count
     - message_type
 tags:
-  detection_name: Detect Rogue DHCP Server
+  name: Detect Rogue DHCP Server
diff --git a/deployments/14_credential_dumping_story.yml b/deployments/14_credential_dumping_story.yml
deleted file mode 100644
index 3f074dea45..0000000000
--- a/deployments/14_credential_dumping_story.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Credential Dumping Story
-id: 52f52a7c-078f-4413-84da-388b61ccac26
-date: '2021-01-13'
-author: Patrick Bareiss
-description: Example for a deployment for a specific Analytics Story
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  analytic_story: Credential Dumping
diff --git a/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml b/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml
deleted file mode 100644
index d274b9c85b..0000000000
--- a/deployments/15_detection_access_LSASS_memory_for_dump_creation.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Access LSASS Memory for Dump Creation Deployment
-id: 974c422f-db3f-4538-8f2a-ee5bf8eec0fa
-date: '2021-01-13'
-author: Patrick Bareiss
-description: Example for a deployment for a specific Detection
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-alert_action:
-  notable:
-    rule_description: '%description%'
-    rule_title: '%name%'
-    nes_fields:
-    - user
-    - dest
-    - src
-tags:
-  detection_name: Access LSASS Memory for Dump Creation
diff --git a/deployments/16_splunk_security_analytics_for_aws.yml b/deployments/16_splunk_security_analytics_for_aws.yml
deleted file mode 100644
index b3a7974301..0000000000
--- a/deployments/16_splunk_security_analytics_for_aws.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Enterprise Security config for Splunk Security Analytics for AWS customers
-id: bc91a8cd-35e7-4bb2-6140-e756cc46f211
-date: '2021-01-20'
-author: Bhavin Patel
-description: This configuration file applies to all correlation searches that are
-  used in the Splunk Security Analytics for AWS product. NOTE - Splunk Security Analytics
-  for AWS searches do not need notable  configurations
-scheduling:
-  cron_schedule: 0 * * * *
-  earliest_time: -70m@m
-  latest_time: -10m@m
-  schedule_window: auto
-tags:
-  product: 
-    - Splunk Security Analytics for AWS
diff --git a/deployments/20_baseline_cache_hourly_updates.yml b/deployments/20_baseline_cache_hourly_updates.yml
index 54c51d4bc8..a29fb96a55 100644
--- a/deployments/20_baseline_cache_hourly_updates.yml
+++ b/deployments/20_baseline_cache_hourly_updates.yml
@@ -10,5 +10,4 @@ scheduling:
   latest_time: -10m@m
   schedule_window: auto
 tags:
-  deployments:
-  - Hourly Cache Updates
+  deployments: Hourly Cache Updates
diff --git a/deployments/21_baseline_cache_daily_updates.yml b/deployments/21_baseline_cache_daily_updates.yml
index e5ff4a68ee..66b23dad71 100644
--- a/deployments/21_baseline_cache_daily_updates.yml
+++ b/deployments/21_baseline_cache_daily_updates.yml
@@ -10,5 +10,4 @@ scheduling:
   latest_time: -10m@m
   schedule_window: auto
 tags:
-  deployments:
-  - Daily Cache Updates
+  deployments: Daily Cache Updates
diff --git a/deployments/30_long_running_baseline_searches.yml b/deployments/30_long_running_baseline_searches.yml
index 3991fd8909..f8d47d43ad 100644
--- a/deployments/30_long_running_baseline_searches.yml
+++ b/deployments/30_long_running_baseline_searches.yml
@@ -10,5 +10,4 @@ scheduling:
   latest_time: -1d@d
   schedule_window: auto
 tags:
-  deployments:
-  - 90 Day Baseline
+  deployments: 90 Day Baseline
diff --git a/deployments/31_weeky_model_rebuild_90_days.yml b/deployments/31_weeky_model_rebuild_90_days.yml
index cc3d7b76bc..be6eaae38c 100644
--- a/deployments/31_weeky_model_rebuild_90_days.yml
+++ b/deployments/31_weeky_model_rebuild_90_days.yml
@@ -10,5 +10,4 @@ scheduling:
   latest_time: -1d@d
   schedule_window: auto
 tags:
-  deployments:
-  - Weekly Model Rebuild 90 Day Lookback
+  deployments: Weekly Model Rebuild 90 Day Lookback
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index ea8babf4c1..7fcf7af4e8 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 5278d935e4..b3a959cfee 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 8de282fb28..3b71bf3d59 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 3b127db776..0602d44cd0 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 98dd21eb01..d106c4b3c7 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -45770,7 +45770,7 @@ action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
+cron_schedule = 59 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
@@ -45778,9 +45778,9 @@ action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure.
-action.notable.param.rule_title = Detect ARP Poisoning
+action.notable.param.nes_fields = src_interface,firstTime,lastTime,count
+action.notable.param.rule_description = ARP Poisoning has been detected on interface $src_interface$ on host $orig_host$. This may be an indication of a MITM attack.
+action.notable.param.rule_title = ARP Poisoning Detected on $orig_host$
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -46040,7 +46040,7 @@ action.risk.param._risk_message = tbd
 action.risk.param._risk = [{"threat_object_field": "dest", "threat_object_type": "other"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
+cron_schedule = 59 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
@@ -46048,9 +46048,9 @@ action.correlationsearch.label = ESCU - Detect Rogue DHCP Server - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack).
-action.notable.param.rule_title = Detect Rogue DHCP Server
+action.notable.param.nes_fields = src_mac,firstTime,lastTime,count,message_type
+action.notable.param.rule_description = DHCP Snooping has detected a Rogue DHCP Server on $orig_host$ from $src_mac$. This may be an indication of a MITM attack.
+action.notable.param.rule_title = Rogue DHCP Server Detected on $orig_host$
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -48234,9 +48234,9 @@ action.escu.creation_date = 2018-05-07
 action.escu.modification_date = 2018-05-07
 action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48256,10 +48256,10 @@ action.escu.creation_date = 2020-09-07
 action.escu.modification_date = 2020-09-07
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
@@ -48278,10 +48278,10 @@ action.escu.creation_date = 2020-08-25
 action.escu.modification_date = 2020-08-25
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.
@@ -48301,10 +48301,10 @@ action.escu.creation_date = 2020-08-14
 action.escu.modification_date = 2020-08-14
 action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
@@ -48324,10 +48324,10 @@ action.escu.creation_date = 2020-09-07
 action.escu.modification_date = 2020-09-07
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 2 * * 0
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly.
@@ -48346,9 +48346,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48368,9 +48368,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.escu.data_models = ["Network_Resolution"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48390,9 +48390,9 @@ action.escu.creation_date = 2018-05-21
 action.escu.modification_date = 2018-05-21
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48412,9 +48412,9 @@ action.escu.creation_date = 2018-07-17
 action.escu.modification_date = 2018-07-17
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48434,9 +48434,9 @@ action.escu.creation_date = 2018-04-17
 action.escu.modification_date = 2018-04-17
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48456,9 +48456,9 @@ action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48478,9 +48478,9 @@ action.escu.creation_date = 2017-09-13
 action.escu.modification_date = 2017-09-13
 action.escu.analytic_story = ["Asset Tracking"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48500,9 +48500,9 @@ action.escu.creation_date = 2017-09-13
 action.escu.modification_date = 2017-09-13
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48522,9 +48522,9 @@ action.escu.creation_date = 2018-12-03
 action.escu.modification_date = 2018-12-03
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48544,9 +48544,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48566,9 +48566,9 @@ action.escu.creation_date = 2018-04-09
 action.escu.modification_date = 2018-04-09
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48588,9 +48588,9 @@ action.escu.creation_date = 2019-11-14
 action.escu.modification_date = 2019-11-14
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48612,9 +48612,9 @@ action.escu.creation_date = 2019-11-14
 action.escu.modification_date = 2019-11-14
 action.escu.analytic_story = ["Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48636,9 +48636,9 @@ action.escu.creation_date = 2018-04-16
 action.escu.modification_date = 2018-04-16
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48658,9 +48658,9 @@ action.escu.creation_date = 2018-03-16
 action.escu.modification_date = 2018-03-16
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48680,9 +48680,9 @@ action.escu.creation_date = 2018-03-12
 action.escu.modification_date = 2018-03-12
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48702,9 +48702,9 @@ action.escu.creation_date = 2018-03-08
 action.escu.modification_date = 2018-03-08
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48724,9 +48724,9 @@ action.escu.creation_date = 2018-03-15
 action.escu.modification_date = 2018-03-15
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48746,9 +48746,9 @@ action.escu.creation_date = 2018-04-30
 action.escu.modification_date = 2018-04-30
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48768,9 +48768,9 @@ action.escu.creation_date = 2018-04-30
 action.escu.modification_date = 2018-04-30
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48790,9 +48790,9 @@ action.escu.creation_date = 2019-02-14
 action.escu.modification_date = 2019-02-14
 action.escu.analytic_story = ["DNS Hijacking"]
 action.escu.data_models = ["Network_Resolution"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48812,9 +48812,9 @@ action.escu.creation_date = 2018-10-08
 action.escu.modification_date = 2018-10-08
 action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48834,9 +48834,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48856,9 +48856,9 @@ action.escu.creation_date = 2017-09-15
 action.escu.modification_date = 2017-09-15
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Network_Traffic"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48878,9 +48878,9 @@ action.escu.creation_date = 2019-04-01
 action.escu.modification_date = 2019-04-01
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48900,9 +48900,9 @@ action.escu.creation_date = 2017-09-12
 action.escu.modification_date = 2017-09-12
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48922,9 +48922,9 @@ action.escu.creation_date = 2017-09-12
 action.escu.modification_date = 2017-09-12
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48944,9 +48944,9 @@ action.escu.creation_date = 2018-06-04
 action.escu.modification_date = 2018-06-04
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -48966,10 +48966,10 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
@@ -48988,9 +48988,9 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49010,9 +49010,9 @@ action.escu.creation_date = 2018-01-08
 action.escu.modification_date = 2018-01-08
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49032,10 +49032,10 @@ action.escu.creation_date = 2020-09-03
 action.escu.modification_date = 2020-09-03
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached.
@@ -49054,9 +49054,9 @@ action.escu.creation_date = 2020-09-03
 action.escu.modification_date = 2020-09-03
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49076,7 +49076,7 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49098,9 +49098,9 @@ action.escu.creation_date = 2020-08-15
 action.escu.modification_date = 2020-08-15
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49120,10 +49120,10 @@ action.escu.creation_date = 2020-10-08
 action.escu.modification_date = 2020-10-08
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances
@@ -49142,9 +49142,9 @@ action.escu.creation_date = 2020-08-12
 action.escu.modification_date = 2020-08-12
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49164,10 +49164,10 @@ action.escu.creation_date = 2020-9-03
 action.escu.modification_date = 2020-9-03
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen cloud compute instance types
@@ -49186,9 +49186,9 @@ action.escu.creation_date = 2020-9-03
 action.escu.modification_date = 2020-9-03
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49208,10 +49208,10 @@ action.escu.creation_date = 2020-07-29
 action.escu.modification_date = 2020-07-29
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance.
@@ -49230,9 +49230,9 @@ action.escu.creation_date = 2020-07-29
 action.escu.modification_date = 2020-07-29
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49252,10 +49252,10 @@ action.escu.creation_date = 2020-08-19
 action.escu.modification_date = 2020-08-19
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached.
@@ -49274,9 +49274,9 @@ action.escu.creation_date = 2020-08-20
 action.escu.modification_date = 2020-08-20
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49296,10 +49296,10 @@ action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
@@ -49318,9 +49318,9 @@ action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49340,9 +49340,9 @@ action.escu.creation_date = 2019-03-01
 action.escu.modification_date = 2019-03-01
 action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "IcedID"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49362,9 +49362,9 @@ action.escu.creation_date = 2018-04-05
 action.escu.modification_date = 2018-04-05
 action.escu.analytic_story = ["Unusual AWS EC2 Modifications"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49384,10 +49384,10 @@ action.escu.creation_date = 2020-06-23
 action.escu.modification_date = 2020-06-23
 action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This collects the services that have been started across your entire enterprise.
@@ -49406,7 +49406,7 @@ action.escu.creation_date = 2020-06-23
 action.escu.modification_date = 2020-06-23
 action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49428,9 +49428,9 @@ action.escu.creation_date = 2018-06-28
 action.escu.modification_date = 2018-06-28
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49450,10 +49450,10 @@ action.escu.creation_date = 2020-05-28
 action.escu.modification_date = 2020-05-28
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
@@ -49472,9 +49472,9 @@ action.escu.creation_date = 2020-05-28
 action.escu.modification_date = 2020-05-28
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.escu.data_models = ["Authentication"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49494,10 +49494,10 @@ action.escu.creation_date = 2020-05-20
 action.escu.modification_date = 2020-05-20
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 0 1 1 1,4,7,10 *
 enableSched = 1
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
+dispatch.earliest_time = -90d@d
+dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
 action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached.
@@ -49516,7 +49516,7 @@ action.escu.creation_date = 2020-05-20
 action.escu.modification_date = 2020-05-20
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.escu.data_models = ["Endpoint"]
-cron_schedule = 0 * * * *
+cron_schedule = 55 * * * *
 enableSched = 1
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
@@ -49560,9 +49560,9 @@ action.escu.creation_date = 2018-01-08
 action.escu.modification_date = 2018-01-08
 action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"]
 action.escu.data_models = ["Change"]
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49582,9 +49582,9 @@ action.escu.creation_date = 2017-09-14
 action.escu.modification_date = 2017-09-14
 action.escu.analytic_story = ["Monitor for Updates"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
@@ -49604,9 +49604,9 @@ action.escu.creation_date = 2017-09-14
 action.escu.modification_date = 2017-09-14
 action.escu.analytic_story = ["Monitor for Updates"]
 action.escu.data_models = []
-cron_schedule = 0 * * * *
+cron_schedule = 10 0 * * *
 enableSched = 1
-dispatch.earliest_time = -70m@m
+dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 4a1a239406..d2a0894d18 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index fd44e43765..ed33172cc9 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-11-29T23:50:21 UTC
+# On Date: 2022-12-01T13:42:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/requirements.txt b/requirements.txt
index a47a9bf4bd..5e8ecf38b5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@ GitPython==3.1.29
 Jinja2==3.1.2
 jsonschema==4.17.0
 mock==4.0.3
-psutil==5.9.3
+psutil==5.9.4
 pycvesearch==1.2
 pydantic==1.10.2
 pytest==7.2.0