diff --git a/bin/contentctl_project/contentctl_core/domain/entities/baseline.py b/bin/contentctl_project/contentctl_core/domain/entities/baseline.py
index 6f6026ed2e..0044c7cc1e 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/baseline.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/baseline.py
@@ -86,17 +86,9 @@ class Baseline(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Baseline!"))
-        
 
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
+
 
     @validator('search')
     def search_validate(cls, v, values):
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/common_validators.py b/bin/contentctl_project/contentctl_core/domain/entities/common_validators.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py
index 2db26c076c..8e818dc735 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py
@@ -133,18 +133,7 @@ class Detection(BaseModel, SecurityContentObject):
    
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Detection!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
-        return v
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 
     @validator('search')
     def search_validate(cls, v, values):
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/investigation.py b/bin/contentctl_project/contentctl_core/domain/entities/investigation.py
index 340a544c2b..3e6f827573 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/investigation.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/investigation.py
@@ -83,17 +83,7 @@ class Investigation(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Investigation!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 
     @validator('search')
     def search_validate(cls, v, values):
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/link_validator.py b/bin/contentctl_project/contentctl_core/domain/entities/link_validator.py
index a022f2a963..f12bd027de 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/link_validator.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/link_validator.py
@@ -1,4 +1,3 @@
-from lib2to3.pytree import Base
 import re
 from tracemalloc import start
 from unittest.mock import DEFAULT
@@ -157,3 +156,19 @@ class LinkValidator(abc.ABC):
             print(f"Link {failure.reference} invalid with HTTP Status Code [{failure.status_code}] and referenced by the following files:")
             for ref in failure.referencing_files:
                 print(f"\t* {ref}")
+
+    @staticmethod
+    def SecurityContentObject_validate_references(v:list, values: dict)->list:
+        if 'check_references' not in values:
+            raise(Exception("Member 'check_references' missing from Baseline!"))
+        elif values['check_references'] is False:
+            #Reference checking is enabled
+            pass
+        elif values['check_references'] is True:
+            for reference in v:
+                LinkValidator.validate_reference(reference, values['name'])
+                #Remove the check_references key from the values dict so that it is not
+        #output by the serialization code
+        del values['check_references']
+
+        return v
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/playbook.py b/bin/contentctl_project/contentctl_core/domain/entities/playbook.py
index 9fcafb78c1..9ab12034da 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/playbook.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/playbook.py
@@ -28,15 +28,5 @@ class Playbook(BaseModel, SecurityContentObject):
     
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Playbook!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
 
diff --git a/bin/contentctl_project/contentctl_core/domain/entities/story.py b/bin/contentctl_project/contentctl_core/domain/entities/story.py
index 107879cc0b..ced7ec3810 100644
--- a/bin/contentctl_project/contentctl_core/domain/entities/story.py
+++ b/bin/contentctl_project/contentctl_core/domain/entities/story.py
@@ -65,14 +65,4 @@ class Story(BaseModel, SecurityContentObject):
 
     @validator('references')
     def references_check(cls, v, values):
-        
-        
-        if 'check_references' in values and values['check_references'] is False:
-            #Reference checking is NOT enabled
-            return v
-        elif 'check_references' not in values:
-            raise(Exception("Member 'check_references' missing from Story!"))
-        
-
-        for reference in v:
-            LinkValidator.validate_reference(reference, values['name'])
\ No newline at end of file
+        return LinkValidator.SecurityContentObject_validate_references(v, values)
\ No newline at end of file
diff --git a/bin/contentctl_project/contentctl_core/tests/application/factory/test_factory.py b/bin/contentctl_project/contentctl_core/tests/application/factory/test_factory.py
index b3e17729f2..e1e36fa079 100644
--- a/bin/contentctl_project/contentctl_core/tests/application/factory/test_factory.py
+++ b/bin/contentctl_project/contentctl_core/tests/application/factory/test_factory.py
@@ -1,5 +1,6 @@
 import os
 from re import A
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryInputDto
 from bin.contentctl_project.contentctl_core.application.factory.factory import FactoryOutputDto
@@ -25,9 +26,9 @@ def test_factory_ESCU():
         SecurityContentStoryBuilder(),
         SecurityContentBaselineBuilder(),
         SecurityContentInvestigationBuilder(),
-        SecurityContentPlaybookBuilder(),
+        SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT),
         SecurityContentDirector(),
-        AttackEnrichment.get_attack_lookup()
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT)
     )
 
     output_dto = FactoryOutputDto([],[],[],[],[],[],[],[],[])
diff --git a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_content_changer.py b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_content_changer.py
index cf663dfb0b..4bd6d9fb22 100644
--- a/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_content_changer.py
+++ b/bin/contentctl_project/contentctl_core/tests/application/use_cases/test_content_changer.py
@@ -1,4 +1,5 @@
 import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.application.use_cases.content_changer import ContentChanger, ContentChangerInputDto
 from bin.contentctl_project.contentctl_core.application.factory.object_factory import ObjectFactoryInputDto
@@ -21,7 +22,7 @@ def test_content_changer_author_uppercase():
     )
 
     input_dto = ContentChangerInputDto(
-        ObjToYmlAdapter(),
+        ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT),
         factory_input_dto,
         'example_converter_func'
     )
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json
index aa656a9850..fff623f0ad 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json
@@ -1 +1 @@
-{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
\ No newline at end of file
+{"baselines": [{"name": "Previously Seen Users In CloudTrail - Update", "id": "66ff71c2-7e01-47dd-a041-906688c9d322", "version": 1, "date": "2020-05-28", "author": "Rico Valdez, Splunk", "type": "Baseline", "datamodel": ["Authentication"], "description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.", "search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins", "how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.", "known_false_positives": "none", "check_references": false, "references": [], "tags": {"analytic_story": ["Suspicious Cloud Authentication Activities"], "deployments": ["Daily Cache Updates"], "detections": ["Detect AWS Console Login by User from New Country", "Detect AWS Console Login by User from New Region", "Detect AWS Console Login by User from New City", "Detect AWS Console Login by New User", "Attempted Credential Dump From Registry via Reg exe"], "product": ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Authentication.signature", "Authentication.user", "Authentication.src"], "security_domain": "network"}}]}
\ No newline at end of file
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json
index 3598427247..1e4ef53d39 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json
@@ -1 +1 @@
-{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/jhernandez/splunk/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}
\ No newline at end of file
+{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "check_references": false, "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/private/tmp/pytest/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]}
\ No newline at end of file
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json
index 78631ceb29..676e93489a 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json
@@ -1 +1 @@
-{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
\ No newline at end of file
+{"response_tasks": [{"name": "Get Parent Process Info", "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", "version": 2, "date": "2019-02-28", "author": "Bhavin Patel, Splunk", "type": "Investigation", "datamodel": ["Endpoint"], "description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest", "search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search  parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`", "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.", "known_false_positives": "", "check_references": false, "references": [], "inputs": ["parent_process_name", "dest"], "tags": {"analytic_story": ["Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "DarkSide Ransomware"], "product": ["Splunk Phantom"], "required_fields": ["_time", "Processes.user", "Processes.parent_process_name", "Processes.process_name", "Processes.dest"], "security_domain": "endpoint"}, "lowercase_name": "get_parent_process_info"}]}
\ No newline at end of file
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json
index b3c6439f68..0f76adfa16 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json
@@ -1 +1 @@
-{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]}
\ No newline at end of file
+{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "check_references": false, "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel", "detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "source": "detection", "type": "TTP", "tags": {"mitre_attack_enrichments": [{"mitre_attack_technique": "Security Account Manager"}, {"mitre_attack_technique": "OS Credential Dumping"}]}}]}]}
\ No newline at end of file
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md
index 3cb7373f9b..8140e824f9 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_stories/darkside_ransomware.md
@@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 #### Reference
 
 * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md
index 3cb7373f9b..8140e824f9 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_stories/darkside_ransomware.md
@@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 #### Reference
 
 * [https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/)
-* [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
 
 
 
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py
index 67a9674d99..0409be32a0 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py
@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_svg_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,7 +55,7 @@ def test_svg_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     adapter = ObjToAttackNavAdapter()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py
index 8666ae11c7..1d90c19441 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py
@@ -2,6 +2,8 @@ import os
 import datetime
 import pytest
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
+
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_conf_adapter import ObjToConfAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -40,7 +42,7 @@ def test_write_conf_files(patch_datetime_now):
     director.constructDeployment(deployment_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject()
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -71,7 +73,7 @@ def test_write_conf_files(patch_datetime_now):
         [detection], [baseline], [investigation])
     story = story_builder.getObject()
     output_path = os.path.join(os.path.dirname(__file__), 'data')
-    adapter = ObjToConfAdapter()
+    adapter = ObjToConfAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeHeaders(output_path)
     adapter.writeObjects([detection, detection_deprecated], output_path, SecurityContentType.detections)
     adapter.writeObjects([story], output_path, SecurityContentType.stories)
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py
index 83d569bb73..3fd64d4982 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py
@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_json_adapter import ObjToJsonAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -29,7 +30,7 @@ def test_write_detections():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [], [], [], [],
-        AttackEnrichment.get_attack_lookup(), [macro], [lookup])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [macro], [lookup])
     detection = detection_builder.getObject()
     
     output_path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data')
@@ -141,7 +142,7 @@ def test_write_stories():
         '../builder/test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -159,7 +160,7 @@ def test_write_stories():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     investigation_builder = SecurityContentInvestigationBuilder()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py
index a043acb019..6beb18d047 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py
@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_md_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,15 +55,15 @@ def test_md_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/deprecated/detect_new_user_aws_console_login.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection_deprecated = detection_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py
index b572d55df9..e6d8211ae9 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py
@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_md_adapter import ObjToMdAdapter
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
@@ -46,7 +47,7 @@ def test_svg_writer():
         '../builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml'))
     test = unit_test_builder.getObject()
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -54,7 +55,7 @@ def test_svg_writer():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         '../builder/test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     adapter = ObjToSvgAdapter()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_yml_adapter.py
index 82c2b0bbb9..17b4158702 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_yml_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_yml_adapter.py
@@ -1,5 +1,6 @@
 import os
 import filecmp
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.builder.yml_reader import YmlReader
 from bin.contentctl_project.contentctl_infrastructure.adapter.obj_to_yml_adapter import ObjToYmlAdapter
@@ -12,7 +13,7 @@ def test_read_and_write_yml():
     file_path = os.path.join(os.path.dirname(__file__), 
         'obj_to_yml_data/attempted_credential_dump_from_registry_via_reg_exe.yml')
     yml_obj = YmlReader.load_file(file_path)
-    adapter = ObjToYmlAdapter()
+    adapter = ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeObjectsInPlace([yml_obj])
 
     ref_file_path = os.path.join(os.path.dirname(__file__), 
@@ -35,7 +36,7 @@ def test_write_ssa_detection():
         {}, [], [])
     detection = detection_builder.getObject()
 
-    adapter = ObjToYmlAdapter()
+    adapter = ObjToYmlAdapter(input_path = SECURITY_CONTENT_ROOT)
     adapter.writeObjects([detection], os.path.join(os.path.dirname(__file__), 'obj_to_yml_data'))
 
     detection_file_path = os.path.join(os.path.dirname(__file__), 
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_attack_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_attack_enrichment.py
index c1a63be658..b8ab873174 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_attack_enrichment.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_attack_enrichment.py
@@ -1,8 +1,9 @@
-
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 
 
+
 def test_mitre_attack_enrichment():
-    attack_enrichment = AttackEnrichment.get_attack_lookup()
+    attack_enrichment = AttackEnrichment.get_attack_lookup(SECURITY_CONTENT_ROOT)
     assert attack_enrichment["T1003.002"]["technique"] == "Security Account Manager"
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py
index 7b014e4002..6ee380ee6d 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py
@@ -1,5 +1,6 @@
 import pytest
 import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentProduct
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
@@ -12,6 +13,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 
 
+
 def test_read_detection():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
@@ -112,7 +114,7 @@ def test_detection_add_rba():
 
 
 def test_detection_add_playbooks():
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -160,7 +162,7 @@ def test_attack_enrichment():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'))
-    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup())
+    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT))
     detection = security_content_builder.getObject()
 
     assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_id'] == 'T1003.002'
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py
index 82e22c6d78..ff73d771d8 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py
@@ -1,5 +1,6 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_director import SecurityContentDirector
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
@@ -12,6 +13,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 
 
+
 def test_construct_deployments():
     director = SecurityContentDirector()
     deployment_builder = SecurityContentBasicBuilder()
@@ -48,7 +50,7 @@ def test_construct_macros():
 
 def test_construct_playbooks():
     director = SecurityContentDirector()
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()     
@@ -118,7 +120,7 @@ def test_construct_detections():
         'test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -141,7 +143,7 @@ def test_construct_detections():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [macro], [lookup])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [macro], [lookup])
     detection = detection_builder.getObject()
 
     valid_annotations = {'mitre_attack': ['T1003.002', 'T1003'], 
@@ -186,7 +188,7 @@ def test_construct_stories():
         'test_data/deployment/ESCU/00_default_baseline.yml'))
     deployment_baseline = deployment_builder.getObject() 
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
@@ -204,7 +206,7 @@ def test_construct_stories():
     detection_builder = SecurityContentDetectionBuilder()
     director.constructDetection(detection_builder, os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'), [deployment], [playbook], [baseline], [test],
-        AttackEnrichment.get_attack_lookup(), [], [])
+        AttackEnrichment.get_attack_lookup(input_path = SECURITY_CONTENT_ROOT), [], [])
     detection = detection_builder.getObject()
 
     investigation_builder = SecurityContentInvestigationBuilder()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py
index 3169f37ae8..3831b0a9e5 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py
@@ -1,11 +1,14 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_playbook_builder import SecurityContentPlaybookBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
 
 
+
+
 def test_read_playbook():
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
@@ -15,7 +18,7 @@ def test_read_playbook():
 
 def test_enrich_detections():
 
-    playbook_builder = SecurityContentPlaybookBuilder()
+    playbook_builder = SecurityContentPlaybookBuilder(input_path = SECURITY_CONTENT_ROOT)
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
     playbook_builder.addDetections()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py
index 589d7f3e28..c56b066700 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py
@@ -1,5 +1,6 @@
-import os
+from bin.contentctl_project.contentctl_infrastructure.tests.test_constants import SECURITY_CONTENT_ROOT
 
+import os
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_story_builder import SecurityContentStoryBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_detection_builder import SecurityContentDetectionBuilder
 from bin.contentctl_project.contentctl_infrastructure.builder.security_content_basic_builder import SecurityContentBasicBuilder
@@ -9,6 +10,8 @@ from bin.contentctl_project.contentctl_infrastructure.builder.security_content_b
 from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment import AttackEnrichment
 
 
+
+
 def test_read_story():
     story_builder = SecurityContentStoryBuilder()
     story_builder.setObject(os.path.join(os.path.dirname(__file__), 
@@ -23,7 +26,7 @@ def test_add_detections():
     security_content_builder = SecurityContentDetectionBuilder()
     security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/detection/valid.yml'))
-    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup())
+    security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup(input_path=SECURITY_CONTENT_ROOT))
     detection = security_content_builder.getObject()
 
     story_builder = SecurityContentStoryBuilder()
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/test_constants.py b/bin/contentctl_project/contentctl_infrastructure/tests/test_constants.py
new file mode 100644
index 0000000000..d18b796d9b
--- /dev/null
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/test_constants.py
@@ -0,0 +1,4 @@
+#Some constants that will be used in testing
+import os
+
+SECURITY_CONTENT_ROOT = os.getcwd()
\ No newline at end of file