diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index ec89bbd1e5..96c30258b6 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -1,12 +1,13 @@
 name: auto-merge
-
 on:
-  pull_request:
+  pull_request_target:
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v2
       - uses: ahmadnassri/action-dependabot-auto-merge@v2
         with:
+          target: minor
           github-token: ${{ secrets.AUTOMERGE }}
diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index 792ea30512..1fb179755b 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -13,7 +13,10 @@
 
 
 name: build-and-validate
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
   validate-tag-if-present:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 241c21d3ec..475c3b3320 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -1,5 +1,8 @@
 name: detection-testing
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present:
@@ -30,16 +33,20 @@ jobs:
       runs-on: ubuntu-latest
       environment: Detection-Testing-Approval
       needs: [validate-tag-if-present]
-      #Only run when we are pushing to the head of a branch or on a PR.
-      #This implicitly means that we do not run on a tag
-      if: startsWith(github.ref, 'refs/heads/')  || startsWith(github.ref, 'refs/pull/')
       steps:  
 
           - name: Checkout Repo
             uses: actions/checkout@v2
-            with:
-              ref: 'develop'
           
+
+          #The following branch name only works (and is only used) for a push
+          #to a branch. We used a different method for getting the source branch
+          #from a PR
+          - name: Get branch and PR required for detection testing main.py
+            id: vars
+            run: |
+              echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
+
           - name: Install System Packages
             run: | 
               sudo apt update -qq
@@ -58,10 +65,6 @@ jobs:
               source venv/bin/activate
               python3 -m pip install -q -r requirements.txt
           
-          - name: Get branch and PR required for detection testing main.py
-            id: vars
-            run: |
-              echo ::set-output name=tag::${GITHUB_REF#refs/tags/}
               
           #Set up credentials in the environment so that boto will be able to find them
           - uses: aws-actions/configure-aws-credentials@v1
@@ -80,9 +83,15 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
-                  python3 main.py -b develop -pr ${{ github.event.issue.number }}
-                
+              echo "github.event.issue.pull_request    : [${{ github.event.issue.pull_request }}]"
+              echo "github.event.pull_request.number   : [${{ github.event.pull_request.number }}]"
+              echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
+              echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
+
+              if [[ ! -z "${{  github.event.pull_request.head.ref }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
+                echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
-                  python3 main.py -b develop
+                echo "Push from branch [${{ steps.vars.outputs.branch }}]"
+                python3 main.py -b ${{ steps.vars.outputs.branch }}
               fi
diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml
index 9c3ea7cee0..dc62c7f86a 100644
--- a/.github/workflows/semgrep-analysis.yml
+++ b/.github/workflows/semgrep-analysis.yml
@@ -5,7 +5,10 @@
 
 name: Semgrep
 
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present:
diff --git a/README.md b/README.md
index dcad75faaf..791780d157 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@
 
 Welcome to the Splunk Security Content
 
-This project gives you access to our repository of Analytic Stories, security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
+This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
 
 # Get Content🛡
 The latest Splunk Security Content can be obtained via:
diff --git a/bin/generate.py b/bin/generate.py
index 86abe3e838..241fddcb5f 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -361,7 +361,7 @@ def add_rba(detection):
             if entity['type'].lower() in risk_object_user_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
 
                         risk_object['risk_object_type'] = 'user'
                         risk_object['risk_object_field'] = entity['name']
@@ -373,7 +373,7 @@ def add_rba(detection):
             elif entity['type'].lower() in risk_object_system_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
                         
                         risk_object['risk_object_type'] = 'system'
                         risk_object['risk_object_field'] = entity['name']
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index a14fc89726..44d1cf8a46 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,18 +1,17 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 4
-date: '2020-07-21'
+version: 5
+date: '2021-08-29'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This search looks for the creation of local administrator accounts using
-  net.exe.
+  net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
-  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add*
-  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
+  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your
diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index f02aaacce0..b86174c023 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -29,8 +29,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -38,9 +38,14 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled Registry Tools
+  message: Disabled Registry Tools on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index cfb7714f9f..8db415439d 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -31,8 +31,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -40,10 +40,15 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Show Hidden Files'
+  message: Disabled 'Show Hidden Files' on $dest$
   mitre_attack_id:
   - T1564.001
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index 43ddd6ec43..6fee3152df 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -33,16 +33,21 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Windows App Hotkeys'
+  message: Disabled 'Windows App Hotkeys' on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
index 2624d8c5e6..7830a68142 100644
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ b/detections/endpoint/start_up_during_safe_mode_boot.yml
@@ -37,10 +37,15 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: Safeboot registry $Registry.registry_path$ was added or modified with a
-    new value $Registry.registry_value_name$
+  message: Safeboot registry $registry_path$ was added or modified with a
+    new value $registry_value_name$ on $dest$
   mitre_attack_id:
   - T1547.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security