diff --git a/response_templates/NIST80061_v2.json b/response_templates/NIST80061_v2.json
deleted file mode 100644
index 2766ec7983..0000000000
--- a/response_templates/NIST80061_v2.json
+++ /dev/null
@@ -1 +0,0 @@
-{"id": "475a4c40-0996-4b54-a634-711205549572", "create_time": 1765482414.4679432, "update_time": 1765482414.4679432, "name": "NIST%20800-61:%20Computer%20Security%20Incident%20Handling%20Guide", "description": "", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 2, "phases": [{"id": "97bc8622-69ca-48a1-bf2b-e4067281f71a", "create_time": 1765482414.4685507, "update_time": 1765482414.4685512, "name": "Detection", "order": 1, "tasks": [{"id": "9126eb2f-d5e2-48e7-a9f5-0c851f2ecc57", "create_time": 1764758755.7593036, "update_time": 1765482414.4680352, "name": "Determine if an incident has occurred", "order": 1, "tag": "dd8a2e5b-9131-4321-ad10-0cef889e30f1", "description": "Suggested%20Integrations%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BIdentity%20Investigator%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/identity_investigator)%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "1d9a756c-20dc-4e2e-94e1-87f4eb164447", "create_time": 1764758755.7594106, "update_time": 1765482414.4681613, "name": "Analyze precursors and indicators", "order": 2, "tag": "cd6639cc-79b1-4f66-b03a-0b29118e9439", "description": "Suggested%20Integrations%0A1.%20%5BSplunk%20Attack%20Analyzer%5D(https://splunkbase.splunk.com/app/6783)%0A2.%20%5BCisco%20Talos%20Intelligence%5D(https://splunkbase.splunk.com/app/7711)%0A3.%20%5BVirusTotal%20v3%5D(https://splunkbase.splunk.com/app/5865)%0A4.%20%20PhishTank%20(preconfigured)%0A5.%20%5BEmail%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/email_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "974fdd62-7d20-40f3-912d-60d708146ac7", "create_time": 1764758755.7595055, "update_time": 1765482414.4682908, "name": "Look for correlating information", "order": 3, "tag": "64b3aaa7-416e-4ec2-8cc1-b54b1e0758db", "description": "Suggested%20Integrations%0A1.%20%5BAnalyst%20Queue%5D(/app/SplunkEnterpriseSecuritySuite/incident_review)%0A2.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "c8d1664e-4d06-4470-8b99-124c615500ca", "create_time": 1764758755.759612, "update_time": 1765482414.4683938, "name": "Perform research", "order": 4, "tag": "c534e89d-327c-4deb-bc29-51fb49f65af6", "description": "Use%20search%20engines,%20knowledge%20bases,%20etc..%0A%0ASuggested%20Integrations%0A1.%20%5BSplunk%20Attack%20Analyzer%5D(https://splunkbase.splunk.com/app/6783)%0A2.%20%5BCisco%20Talos%20Intelligence%5D(https://splunkbase.splunk.com/app/7711)%0A3.%20%5BVirusTotal%20v3%5D(https://splunkbase.splunk.com/app/5865)%0A4.%20%20PhishTank%20(preconfigured)%0A5.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "247f8ee3-e7db-437d-9a16-07e2d19673c0", "create_time": 1764758755.7597096, "update_time": 1765482414.4685001, "name": "Confirmed incident", "order": 5, "tag": "415e3412-85ed-4af6-bf6e-09e6e13542b3", "description": "For a confirmed incident, document the investigation and gather evidence. Attach all relevant information from detection steps to the notable.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "ef47436d-de45-4aab-ba6b-736137c41076", "create_time": 1765482414.4691532, "update_time": 1765482414.469154, "name": "Analysis and Containment", "order": 2, "tasks": [{"id": "27f4ca0d-ef69-4211-9401-34d3817e879f", "create_time": 1764758755.759852, "update_time": 1765482414.4686282, "name": "Determine functional impact", "order": 1, "tag": "58850454-d4af-4cc4-a5dd-fded4be0ff4d", "description": "Suggested categories: None, Low, Medium, High", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "b298ad0a-b53c-4e4d-9e27-0307d2b49d9f", "create_time": 1764758755.759945, "update_time": 1765482414.4687133, "name": "Determine information impact", "order": 2, "tag": "1150410e-72c0-4259-a499-d632727e083b", "description": "Suggested categories: None, Privacy breach, Proprietary breach, Integrity loss", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "650388ac-fa31-48c9-8031-fab7fbc1cce8", "create_time": 1764758755.760036, "update_time": 1765482414.4687974, "name": "Determine recoverability effort", "order": 3, "tag": "d6e187c9-188c-49de-ac41-5092d7ce6435", "description": "Suggested categories: Regular, Supplemented, Extended, Not Recoverable", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "ae810a6c-7314-49f2-84cb-b40557c17734", "create_time": 1764758755.7601304, "update_time": 1765482414.4688811, "name": "Prioritize incident", "order": 4, "tag": "082dfce7-169c-4bd2-aa73-7d39f5e26be8", "description": "Prioritize handling the incident based on the relevant factors", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "3db4552a-5c3b-46e2-8792-88f27397d5ef", "create_time": 1764758755.760304, "update_time": 1765482414.4689677, "name": "Report incident", "order": 5, "tag": "716c8ff4-f8f9-406a-aa10-871b499d0892", "description": "Report%20the%20incident%20to%20the%20the%20appropriate%20internal%20personnel%20and%20external%20organizations%0A%0ASuggested%20Integrations%0A1.%20SMTP%20(preconfigured)%0A2.%20%5BMS%20Graph%20for%20Office%20365%5D(https://splunkbase.splunk.com/app/5824)%0A3.%20%5BG%20Suite%20for%20GMail%5D(https://splunkbase.splunk.com/app/5795)%0A4.%20%5BCisco%20Webex%5D(https://splunkbase.splunk.com/app/5781)%0A5.%20%5BSlack%5D(https://splunkbase.splunk.com/app/5846)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "2ab31b96-9544-4949-8e63-04a674e6bdb6", "create_time": 1764758755.7604578, "update_time": 1765482414.4690719, "name": "Contain incident", "order": 6, "tag": "d05de9e0-1c72-4835-874a-83f6127ef09a", "description": "Suggested%20Integrations%0A1.%20%5BMS%20Graph%20for%20Office%20365%5D(https://splunkbase.splunk.com/app/5824)%0A2.%20%5BG%20Suite%20for%20GMail%5D(https://splunkbase.splunk.com/app/5795)%0A3.%20%5BCisco%20Firepower%5D(https://splunkbase.splunk.com/app/5995)%0A4.%20%5BCisco%20Secure%20Firewall%5D(https://splunkbase.splunk.com/app/7745)%0A5.%20%5B%20Palo%20Alto%5D(https://splunkbase.splunk.com/app/5830)%0A6.%20%5BZscaler%5D(https://splunkbase.splunk.com/app/5872)%0A7.%20%5BCrowdstrike%5D(https://splunkbase.splunk.com/app/5786)%0A8.%20%5BMicrosoft%20Defender%20for%20Endpoint%5D(https://splunkbase.splunk.com/app/5870)%0A9.%20%5BVMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR%5D(https://splunkbase.splunk.com/app/6732)%0A10.%20%5BMS%20Graph%20For%20Active%20Directory%5D(https://splunkbase.splunk.com/app/6395)%0A11.%20%5BAD%20LDAP%5D(https://splunkbase.splunk.com/app/5755)%0A12.%20%5BOkta%5D(https://splunkbase.splunk.com/app/5921)%0A13.%20%5BAWS%20IAM%5D(https://splunkbase.splunk.com/app/5763)%0A14.%20%5BAzure%20AD%20Graph%5D(https://splunkbase.splunk.com/app/5771)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "37031e87-5234-4694-a5d9-cff1c29f8f4d", "create_time": 1765482414.4695153, "update_time": 1765482414.4695156, "name": "Eradicate", "order": 3, "tasks": [{"id": "31e6eacc-4f57-4329-b146-8d3f689e3086", "create_time": 1764758755.7606778, "update_time": 1765482414.4692445, "name": "Identify and mitigate all vulnerabilities", "order": 1, "tag": "f0381ae6-f28f-402a-9f05-3e990496dd50", "description": "Identify%20and%20mitigate%20all%20vulnerabilities%20that%20were%20exploited.%0A%0ASuggested%20Integrations%0A1.%20%5BCrowdstrike%5D(https://splunkbase.splunk.com/app/5786)%0A2.%20%5BMicrosoft%20Defender%20for%20Endpoint%5D(https://splunkbase.splunk.com/app/5870)%0A3.%20%5BVMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR%5D(https://splunkbase.splunk.com/app/6732)%0A4.%20%5BMS%20Graph%20For%20Active%20Directory%5D(https://splunkbase.splunk.com/app/6395)%0A5.%20%5BAD%20LDAP%5D(https://splunkbase.splunk.com/app/5755)%0A6.%20%5BOkta%5D(https://splunkbase.splunk.com/app/5921)%0A7.%20%5BAWS%20IAM%5D(https://splunkbase.splunk.com/app/5763)%0A8.%20%5BAzure%20AD%20Graph%5D(https://splunkbase.splunk.com/app/5771)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "680e54ac-3708-4d38-884f-20a1a7edf0de", "create_time": 1764758755.7608309, "update_time": 1765482414.4693527, "name": "Remove malicious content", "order": 2, "tag": "e7029c6f-cce7-4c43-9a1c-b0425432ad81", "description": "Remove%20malware,%20inappropriate%20materials%20and%20other%20components.%0A%0ASuggested%20Integrations%0A1.%20%5BCrowdstrike%5D(https://splunkbase.splunk.com/app/5786)%0A2.%20%5BMicrosoft%20Defender%20for%20Endpoint%5D(https://splunkbase.splunk.com/app/5870)%0A3.%20%5BVMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR%5D(https://splunkbase.splunk.com/app/6732)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a41b242d-1640-4d15-8104-ec399e12d1de", "create_time": 1764758755.7609744, "update_time": 1765482414.469451, "name": "Verify no other hosts are affected", "order": 3, "tag": "7e41266d-aa31-4b86-b2f4-47f68023fb3e", "description": "If%20more%20affected%20hosts%20are%20discovered,%20repeat%20the%20Detection%20and%20Analysis%20Steps.%0A%0ASuggested%20Integrations%0A1.%20%5BAnalyst%20Queue%5D(/app/SplunkEnterpriseSecuritySuite/incident_review)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A4.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "b12466ec-8616-4519-b133-f6d93f9e32c4", "create_time": 1765482414.4698043, "update_time": 1765482414.4698048, "name": "Recovery", "order": 4, "tasks": [{"id": "43ba0f0e-1fda-4051-a97b-8f7f4682ac33", "create_time": 1764758755.7611475, "update_time": 1765482414.46959, "name": "Restore affected systems", "order": 1, "tag": "3a888228-8354-43a5-809b-41e85114db15", "description": "Return affected systems to an operationally ready state.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "579fa706-4719-4a36-92a0-8c89395b18e6", "create_time": 1764758755.7612762, "update_time": 1765482414.4696727, "name": "Validate restoration", "order": 2, "tag": "39fc29b1-1047-4d0c-bd88-4581b10fe376", "description": "Confirm that the affected systems are functioning normally.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "080aeef1-8fb9-40e2-863e-428fd8f7f017", "create_time": 1764758755.7614079, "update_time": 1765482414.4697568, "name": "Implement additional monitoring", "order": 3, "tag": "7d818e21-eb6b-48ef-92fa-e5c447194ae0", "description": "If necessary, implement additional monitoring to look for future activity.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "1ec64d29-231e-4c34-aec1-4aee974fc8df", "create_time": 1765482414.4700096, "update_time": 1765482414.4700098, "name": "Post Incident Activity", "order": 5, "tasks": [{"id": "bab81f67-66e8-4326-be3c-6c11894e50c7", "create_time": 1764758755.7615948, "update_time": 1765482414.469876, "name": "Create a follow-up report", "order": 1, "tag": "e0d07d6c-00cb-44bc-8536-c8eeda5470a9", "description": "", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "b77497e1-95ce-4ebe-8b62-4929dbfdd8a5", "create_time": 1764758755.7616863, "update_time": 1765482414.4699602, "name": "Lessons learned", "order": 2, "tag": "95974f42-e739-440a-ba79-00fc2d32a7ad", "description": "Hold a lessons learned meeting (mandatory for major incidents, optional otherwise).", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}], "template_id": "8756f985-929a-4076-9343-86c92b82c94f", "active": true, "used": true, "_user": "nobody", "_key": "475a4c40-0996-4b54-a634-711205549572"}