From e06cfa133d76e154babb121ebaa89251ac0f17ba Mon Sep 17 00:00:00 2001
From: Gowthamaraj rajendran <gowthamarajr@splunk.com>
Date: Fri, 15 Sep 2023 10:58:38 -0700
Subject: [PATCH] Edit how_to_implement for Endpoint.Processes

---
 ...servers_executing_suspicious_processes.yml | 15 +--
 ...n_of_file_with_spaces_before_extension.yml | 13 ++-
 .../first_time_seen_command_line_argument.yml | 18 ++--
 .../deprecated/processes_created_by_netsh.yml | 12 ++-
 .../prohibited_software_on_endpoint.yml       | 54 +++++------
 ...de_files_directories_via_registry_keys.yml | 14 ++-
 ...led_tasks_used_in_badrabbit_ransomware.yml | 14 ++-
 ...uspicious_changes_to_file_associations.yml | 13 ++-
 ...ious_powershell_command_line_arguments.yml | 14 ++-
 .../deprecated/suspicious_rundll32_rename.yml | 14 ++-
 .../uncommon_processes_on_endpoint.yml        | 17 ++--
 ...indows_connhost_exe_started_forcefully.yml | 13 ++-
 .../7zip_commandline_to_smb_share_path.yml    | 13 ++-
 .../account_discovery_with_net_app.yml        | 14 ++-
 .../add_or_set_windows_defender_exclusion.yml | 13 ++-
 ..._file_and_printing_sharing_in_firewall.yml | 14 ++-
 .../allow_network_discovery_in_firewall.yml   | 14 ++-
 .../endpoint/anomalous_usage_of_7zip.yml      | 12 ++-
 .../endpoint/any_powershell_downloadfile.yml  | 22 +++--
 .../any_powershell_downloadstring.yml         | 21 +++--
 .../endpoint/attacker_tools_on_endpoint.yml   | 27 ++++--
 ..._to_add_certificate_to_untrusted_store.yml | 33 +++++--
 .../attempt_to_stop_security_service.yml      | 24 +++--
 ...dential_dump_from_registry_via_reg_exe.yml | 14 ++-
 ...dedit_command_back_to_normal_mode_boot.yml | 13 ++-
 .../bcdedit_failure_recovery_modification.yml | 12 ++-
 detections/endpoint/bits_job_persistence.yml  | 20 ++--
 .../endpoint/bitsadmin_download_file.yml      | 22 +++--
 ...load_with_urlcache_and_split_arguments.yml | 21 +++--
 ...oad_with_verifyctl_and_split_arguments.yml | 21 +++--
 .../certutil_exe_certificate_extraction.yml   | 20 ++--
 .../certutil_with_decode_argument.yml         | 21 +++--
 ...hange_to_safe_mode_with_network_config.yml | 13 ++-
 .../endpoint/chcp_command_execution.yml       | 22 +++--
 .../check_elevated_cmd_using_whoami.yml       | 13 ++-
 .../child_processes_of_spoolsv_exe.yml        | 14 ++-
 ...ar_unallocated_sector_using_cipher_app.yml | 12 ++-
 .../endpoint/clop_common_exec_parameter.yml   | 21 +++--
 ...cmd_carry_out_string_command_parameter.yml | 14 ++-
 .../endpoint/cmd_echo_pipe___escalation.yml   | 18 ++--
 ...cmdline_tool_not_executed_in_cmd_shell.yml | 14 ++-
 .../endpoint/conti_common_exec_parameter.yml  | 13 ++-
 ..._loading_from_world_writable_directory.yml | 14 ++-
 ...ate_local_admin_accounts_using_net_exe.yml | 14 ++-
 ...or_delete_windows_shares_using_net_exe.yml | 20 ++--
 .../endpoint/creation_of_shadow_copy.yml      | 13 ++-
 ...f_shadow_copy_with_wmic_and_powershell.yml | 19 ++--
 ...ping_via_copy_command_from_shadow_copy.yml | 19 ++--
 ...ial_dumping_via_symlink_to_shadow_copy.yml | 20 ++--
 .../csc_net_on_the_fly_compilation.yml        | 14 ++-
 .../curl_download_and_bash_execution.yml      | 15 +--
 detections/endpoint/deleting_of_net_users.yml | 14 ++-
 .../endpoint/deleting_shadow_copies.yml       | 13 ++-
 ...tect_azurehound_command_line_arguments.yml | 12 ++-
 .../detect_certify_command_line_arguments.yml | 42 ++++++---
 .../endpoint/detect_html_help_renamed.yml     | 14 ++-
 .../detect_html_help_spawn_child_process.yml  | 12 ++-
 .../detect_html_help_url_in_command_line.yml  | 14 ++-
 ...l_help_using_infotech_storage_handlers.yml | 14 ++-
 .../detect_mshta_inline_hta_execution.yml     | 14 ++-
 detections/endpoint/detect_mshta_renamed.yml  | 14 ++-
 .../detect_mshta_url_in_command_line.yml      | 14 ++-
 ...nterception_by_creation_of_program_exe.yml | 14 ++-
 ...system_network_configuration_discovery.yml | 15 +--
 ...ohibited_applications_spawning_cmd_exe.yml | 18 ++--
 .../detect_psexec_with_accepteula_flag.yml    | 14 ++-
 .../endpoint/detect_rare_executables.yml      | 18 ++--
 .../detect_rclone_command_line_usage.yml      | 14 ++-
 .../detect_regasm_spawning_a_process.yml      | 12 ++-
 ..._regasm_with_no_command_line_arguments.yml | 14 ++-
 .../detect_regsvcs_spawning_a_process.yml     | 12 ++-
 ...regsvcs_with_no_command_line_arguments.yml | 14 ++-
 ...ct_regsvr32_application_control_bypass.yml | 14 ++-
 detections/endpoint/detect_renamed_7_zip.yml  | 12 ++-
 detections/endpoint/detect_renamed_psexec.yml | 14 ++-
 detections/endpoint/detect_renamed_rclone.yml | 14 ++-
 detections/endpoint/detect_renamed_winrar.yml | 14 ++-
 .../endpoint/detect_rtlo_in_process.yml       | 48 +++++-----
 ...2_application_control_bypass___advpack.yml | 14 ++-
 ..._application_control_bypass___setupapi.yml | 12 ++-
 ..._application_control_bypass___syssetup.yml | 14 ++-
 .../detect_rundll32_inline_hta_execution.yml  | 14 ++-
 ...tect_sharphound_command_line_arguments.yml | 12 ++-
 .../endpoint/detect_sharphound_usage.yml      | 14 ++-
 ...ssnames_using_pretrained_model_in_dsdl.yml | 94 +++++++------------
 ..._cmd_exe_to_launch_script_interpreters.yml | 13 ++-
 .../detect_webshell_exploit_behavior.yml      | 14 ++-
 .../detection_of_tools_built_by_nirsoft.yml   | 13 ++-
 ...disable_defender_enhanced_notification.yml | 13 ++-
 .../endpoint/disable_logs_using_wevtutil.yml  | 13 ++-
 detections/endpoint/disable_schedule_task.yml | 13 ++-
 .../disabling_firewall_with_netsh.yml         | 14 ++-
 .../endpoint/disabling_net_user_account.yml   | 14 ++-
 ...curity_authority_defences_via_registry.yml | 38 ++++----
 ...no_command_line_arguments_with_network.yml | 12 ++-
 .../dns_exfiltration_using_nslookup_app.yml   | 13 ++-
 .../domain_account_discovery_with_dsquery.yml | 13 ++-
 .../domain_account_discovery_with_net_app.yml | 13 ++-
 .../domain_account_discovery_with_wmic.yml    | 13 ++-
 ...omain_controller_discovery_with_nltest.yml | 12 ++-
 .../domain_controller_discovery_with_wmic.yml | 12 ++-
 .../domain_group_discovery_with_dsquery.yml   | 12 ++-
 .../domain_group_discovery_with_net.yml       | 12 ++-
 .../domain_group_discovery_with_wmic.yml      | 12 ++-
 .../endpoint/dsquery_domain_discovery.yml     | 12 ++-
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   | 37 ++++++--
 .../endpoint/dump_lsass_via_procdump.yml      | 14 ++-
 .../elevated_group_discovery_with_net.yml     | 12 ++-
 .../elevated_group_discovery_with_wmic.yml    | 12 ++-
 detections/endpoint/esentutl_sam_copy.yml     | 14 ++-
 detections/endpoint/eventvwr_uac_bypass.yml   | 13 ++-
 .../endpoint/excel_spawning_powershell.yml    | 14 ++-
 .../excel_spawning_windows_script_host.yml    | 12 ++-
 .../excessive_attempt_to_disable_services.yml | 13 ++-
 ...e_distinct_processes_from_windows_temp.yml | 13 ++-
 ...r_of_service_control_start_as_disabled.yml | 14 ++-
 ...excessive_number_of_taskhost_processes.yml | 12 ++-
 .../excessive_service_stop_attempt.yml        | 14 ++-
 .../endpoint/excessive_usage_of_cacls_app.yml | 12 ++-
 .../endpoint/excessive_usage_of_net_app.yml   | 14 ++-
 .../endpoint/excessive_usage_of_taskkill.yml  | 13 ++-
 ...cute_javascript_with_jscript_com_clsid.yml | 12 ++-
 ...ution_of_file_with_multiple_extensions.yml | 12 ++-
 .../endpoint/extraction_of_registry_hives.yml | 12 ++-
 .../firewall_allowed_program_enable.yml       | 14 ++-
 .../first_time_seen_child_process_of_zoom.yml | 17 ++--
 detections/endpoint/fodhelper_uac_bypass.yml  | 12 ++-
 detections/endpoint/fsutil_zeroing_file.yml   | 13 ++-
 ...ltdomainpasswordpolicy_with_powershell.yml | 13 ++-
 .../endpoint/get_aduser_with_powershell.yml   | 13 ++-
 ...esultantpasswordpolicy_with_powershell.yml | 13 ++-
 .../get_domainpolicy_with_powershell.yml      | 13 ++-
 .../get_domaintrust_with_powershell.yml       | 14 ++-
 .../get_domainuser_with_powershell.yml        | 13 ++-
 .../get_foresttrust_with_powershell.yml       | 14 ++-
 .../get_wmiobject_group_discovery.yml         | 14 ++-
 .../getadcomputer_with_powershell.yml         | 12 ++-
 .../endpoint/getadgroup_with_powershell.yml   | 12 ++-
 .../getcurrent_user_with_powershell.yml       | 12 ++-
 .../getdomaincomputer_with_powershell.yml     | 12 ++-
 .../getdomaincontroller_with_powershell.yml   | 12 ++-
 .../getdomaingroup_with_powershell.yml        | 12 ++-
 .../endpoint/getlocaluser_with_powershell.yml | 12 ++-
 .../getnettcpconnection_with_powershell.yml   | 12 ++-
 ...twmiobject_ds_computer_with_powershell.yml | 12 ++-
 .../getwmiobject_ds_group_with_powershell.yml | 12 ++-
 .../getwmiobject_ds_user_with_powershell.yml  | 13 ++-
 ...wmiobject_user_account_with_powershell.yml | 12 ++-
 ...no_command_line_arguments_with_network.yml | 12 ++-
 ..._files_and_directories_with_attrib_exe.yml | 14 ++-
 .../hunting_3cxdesktopapp_software.yml        | 50 ++++++----
 detections/endpoint/icacls_deny_command.yml   | 38 ++++----
 detections/endpoint/icacls_grant_command.yml  | 39 ++++----
 ...ateral_movement_commandline_parameters.yml | 12 ++-
 ...ovement_smbexec_commandline_parameters.yml | 14 ++-
 ...ovement_wmiexec_commandline_parameters.yml | 14 ++-
 .../jscript_execution_using_cscript_app.yml   | 13 ++-
 .../endpoint/linux_add_user_account.yml       | 13 ++-
 ...ux_adding_crontab_using_list_parameter.yml | 28 +++++-
 .../linux_apt_get_privilege_escalation.yml    | 13 ++-
 .../linux_apt_privilege_escalation.yml        | 13 ++-
 .../linux_at_application_execution.yml        | 37 ++++++--
 .../linux_awk_privilege_escalation.yml        | 13 ++-
 .../linux_busybox_privilege_escalation.yml    | 13 ++-
 .../linux_c89_privilege_escalation.yml        | 13 ++-
 .../linux_c99_privilege_escalation.yml        | 13 ++-
 .../linux_change_file_owner_to_root.yml       | 13 ++-
 .../endpoint/linux_clipboard_data_copy.yml    | 14 ++-
 ...x_common_process_for_elevation_control.yml | 13 ++-
 .../linux_composer_privilege_escalation.yml   | 13 ++-
 .../linux_cpulimit_privilege_escalation.yml   | 13 ++-
 .../linux_csvtool_privilege_escalation.yml    | 13 ++-
 .../endpoint/linux_curl_upload_file.yml       | 14 ++-
 .../linux_data_destruction_command.yml        | 13 ++-
 .../endpoint/linux_dd_file_overwrite.yml      | 13 ++-
 .../endpoint/linux_decode_base64_to_shell.yml | 14 ++-
 ...ng_critical_directory_using_rm_command.yml | 13 ++-
 .../endpoint/linux_disable_services.yml       | 13 ++-
 .../endpoint/linux_doas_tool_execution.yml    | 13 ++-
 .../linux_docker_privilege_escalation.yml     | 13 ++-
 .../linux_edit_cron_table_parameter.yml       | 33 +++++--
 .../linux_emacs_privilege_escalation.yml      | 13 ++-
 .../linux_find_privilege_escalation.yml       | 13 ++-
 .../linux_gdb_privilege_escalation.yml        | 13 ++-
 .../linux_gem_privilege_escalation.yml        | 13 ++-
 .../linux_gnu_awk_privilege_escalation.yml    | 13 ++-
 .../linux_hardware_addition_swapoff.yml       | 13 ++-
 .../linux_impair_defenses_process_kill.yml    | 13 ++-
 .../linux_indicator_removal_clear_cache.yml   | 13 ++-
 ...ndicator_removal_service_file_deletion.yml | 13 ++-
 .../linux_ingress_tool_transfer_hunting.yml   | 14 ++-
 .../linux_ingress_tool_transfer_with_curl.yml | 14 ++-
 ...ert_kernel_module_using_insmod_utility.yml | 13 ++-
 ...l_kernel_module_using_modprobe_utility.yml | 13 ++-
 .../linux_iptables_firewall_modification.yml  | 13 ++-
 .../endpoint/linux_java_spawning_shell.yml    | 14 ++-
 .../linux_kernel_module_enumeration.yml       | 14 ++-
 ...orker_process_in_writable_process_path.yml | 13 ++-
 .../linux_make_privilege_escalation.yml       | 13 ++-
 .../linux_mysql_privilege_escalation.yml      | 13 ++-
 .../linux_ngrok_reverse_proxy_usage.yml       | 13 ++-
 .../linux_node_privilege_escalation.yml       | 13 ++-
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 13 ++-
 ...ted_files_or_information_base64_decode.yml | 14 ++-
 .../linux_octave_privilege_escalation.yml     | 13 ++-
 .../linux_openvpn_privilege_escalation.yml    | 13 ++-
 .../linux_php_privilege_escalation.yml        | 13 ++-
 .../linux_pkexec_privilege_escalation.yml     | 17 ++--
 ...ss_or_modification_of_sshd_config_file.yml | 13 ++-
 ...ux_possible_access_to_credential_files.yml | 13 ++-
 .../linux_possible_access_to_sudoers_file.yml | 13 ++-
 ...append_command_to_at_allow_config_file.yml | 24 +++--
 ..._append_command_to_profile_config_file.yml | 13 ++-
 ...cronjob_entry_on_existing_cronjob_file.yml | 34 +++++--
 ...sible_cronjob_modification_with_editor.yml | 36 +++++--
 .../linux_preload_hijack_library_calls.yml    | 13 ++-
 .../endpoint/linux_proxy_socks_curl.yml       | 14 ++-
 .../linux_puppet_privilege_escalation.yml     | 13 ++-
 .../linux_rpm_privilege_escalation.yml        | 13 ++-
 .../linux_ruby_privilege_escalation.yml       | 13 ++-
 .../endpoint/linux_service_restarted.yml      | 33 +++++--
 .../linux_service_started_or_enabled.yml      | 24 ++++-
 .../linux_setuid_using_chmod_utility.yml      | 13 ++-
 .../linux_setuid_using_setcap_utility.yml     | 13 ++-
 .../linux_shred_overwrite_command.yml         | 13 ++-
 .../linux_sqlite3_privilege_escalation.yml    | 13 ++-
 ...linux_ssh_authorized_keys_modification.yml | 14 ++-
 ...nux_ssh_remote_services_script_execute.yml | 25 +++--
 ...ux_stdout_redirection_to_dev_null_file.yml | 13 ++-
 detections/endpoint/linux_stop_services.yml   | 13 ++-
 .../endpoint/linux_sudo_or_su_execution.yml   | 13 ++-
 .../linux_system_network_discovery.yml        | 13 ++-
 ...x_system_reboot_via_system_request_key.yml | 13 ++-
 ..._unix_shell_enable_all_sysrq_functions.yml | 13 ++-
 .../linux_visudo_utility_execution.yml        | 13 ++-
 .../local_account_discovery_with_net.yml      | 12 ++-
 .../local_account_discovery_with_wmic.yml     | 12 ++-
 .../macos___re_opened_applications.yml        | 14 ++-
 .../malicious_inprocserver32_modification.yml | 14 ++-
 ...s_powershell_process___encoded_command.yml | 14 ++-
 ...hell_process___execution_policy_bypass.yml | 14 ++-
 ...ll_process_with_obfuscation_techniques.yml | 14 ++-
 ...z_passtheticket_commandline_parameters.yml | 13 ++-
 .../mmc_lolbas_execution_process_spawn.yml    | 12 ++-
 ...dify_acl_permission_to_files_or_folder.yml | 13 ++-
 ...d_suspicious_spawned_by_script_process.yml | 14 ++-
 ..._spawning_rundll32_or_regsvr32_process.yml | 14 ++-
 .../endpoint/net_localgroup_discovery.yml     | 14 ++-
 .../network_connection_discovery_with_arp.yml | 12 ++-
 .../network_connection_discovery_with_net.yml | 12 ++-
 ...work_connection_discovery_with_netstat.yml | 12 ++-
 ...work_discovery_using_route_windows_app.yml | 14 ++-
 .../endpoint/nishang_powershelltcponeline.yml | 14 ++-
 .../nltest_domain_trust_discovery.yml         | 12 ++-
 ...notepad_with_no_command_line_arguments.yml | 46 ++++++---
 detections/endpoint/ntdsutil_export_ntds.yml  | 13 ++-
 ...ice_application_spawn_regsvr32_process.yml | 14 ++-
 ...ice_application_spawn_rundll32_process.yml | 14 ++-
 ...ment_spawned_child_process_to_download.yml | 27 +++---
 .../office_product_spawn_cmd_process.yml      | 24 +++--
 .../office_product_spawning_bitsadmin.yml     | 22 +++--
 .../office_product_spawning_certutil.yml      | 24 +++--
 .../office_product_spawning_mshta.yml         | 22 +++--
 ..._product_spawning_rundll32_with_no_dll.yml | 20 ++--
 ...e_product_spawning_windows_script_host.yml | 23 +++--
 .../endpoint/office_product_spawning_wmic.yml | 24 +++--
 .../endpoint/office_spawning_control.yml      | 14 ++-
 ...nnection_from_java_using_default_ports.yml | 12 ++-
 .../password_policy_discovery_with_net.yml    | 13 ++-
 ...mission_modification_using_takeown_app.yml | 13 ++-
 .../endpoint/ping_sleep_batch_command.yml     | 13 ++-
 .../possible_browser_pass_view_parameter.yml  | 13 ++-
 ...ible_lateral_movement_powershell_spawn.yml | 23 ++++-
 ...entially_malicious_code_on_commandline.yml | 14 ++-
 ...connect_to_internet_with_hidden_window.yml | 14 ++-
 ...powershell_disable_security_monitoring.yml | 22 +++--
 .../powershell_get_localgroup_discovery.yml   | 14 ++-
 .../powershell_start_bitstransfer.yml         | 14 ++-
 ...nt_automatic_repair_mode_using_bcdedit.yml | 13 ++-
 .../endpoint/process_execution_via_wmi.yml    | 13 ++-
 .../process_kill_base_on_file_path.yml        | 14 ++-
 .../endpoint/processes_launching_netsh.yml    | 14 ++-
 ...rsive_delete_of_directory_in_batch_cmd.yml | 14 ++-
 ...ulating_windows_services_registry_keys.yml | 15 +--
 ...2_silent_and_install_param_dll_loading.yml | 14 ++-
 ...svr32_with_known_silent_switch_cmdline.yml | 14 ++-
 .../remcos_client_registry_install_entry.yml  | 13 ++-
 ...mote_desktop_process_running_on_system.yml | 17 ++--
 ..._instantiation_via_dcom_and_powershell.yml | 12 ++-
 ...instantiation_via_winrm_and_powershell.yml | 12 ++-
 ...cess_instantiation_via_winrm_and_winrs.yml | 12 ++-
 .../remote_process_instantiation_via_wmi.yml  | 14 ++-
 ...s_instantiation_via_wmi_and_powershell.yml | 12 ++-
 .../remote_system_discovery_with_dsquery.yml  | 12 ++-
 .../remote_system_discovery_with_net.yml      | 12 ++-
 .../remote_system_discovery_with_wmic.yml     | 12 ++-
 .../endpoint/remote_wmi_command_attempt.yml   | 15 +--
 .../endpoint/resize_shadowstorage_volume.yml  | 13 ++-
 .../endpoint/revil_common_exec_parameter.yml  | 13 ++-
 detections/endpoint/revil_registry_entry.yml  | 13 ++-
 .../rubeus_command_line_parameters.yml        | 13 ++-
 .../runas_execution_in_commandline.yml        | 14 ++-
 .../endpoint/rundll32_control_rundll_hunt.yml | 14 ++-
 ...ontrol_rundll_world_writable_directory.yml | 14 ++-
 .../endpoint/rundll32_lockworkstation.yml     | 13 ++-
 .../endpoint/rundll32_shimcache_flush.yml     | 14 ++-
 ...no_command_line_arguments_with_network.yml | 16 ++--
 .../rundll_loading_dll_by_ordinal.yml         | 14 ++-
 .../endpoint/ryuk_wake_on_lan_command.yml     | 12 ++-
 .../sc_exe_manipulating_windows_services.yml  | 12 ++-
 ...k_creation_on_remote_endpoint_using_at.yml | 29 +++++-
 ...eduled_task_deleted_or_created_via_cmd.yml | 34 ++++---
 ...led_task_initiation_on_remote_endpoint.yml | 21 ++++-
 .../endpoint/schtasks_run_task_on_demand.yml  | 24 +++--
 ...htasks_scheduling_job_on_remote_system.yml | 27 ++++--
 .../schtasks_used_for_forcing_a_reboot.yml    | 28 ++++--
 .../endpoint/script_execution_via_wmi.yml     | 26 ++++-
 detections/endpoint/sdclt_uac_bypass.yml      | 13 ++-
 .../sdelete_application_execution.yml         | 14 ++-
 ...host_with_no_command_line_with_network.yml | 12 ++-
 .../secretdumps_offline_ntds_dumping_tool.yml | 13 ++-
 ...ceprincipalnames_discovery_with_setspn.yml | 14 ++-
 detections/endpoint/services_escalate_exe.yml | 11 ++-
 ...ervices_lolbas_execution_process_spawn.yml | 12 ++-
 ...ution_policy_to_unrestricted_or_bypass.yml | 13 ++-
 ...nstallation_with_suspicious_parameters.yml | 14 ++-
 .../endpoint/silentcleanup_uac_bypass.yml     | 13 ++-
 .../single_letter_process_on_endpoint.yml     | 14 ++-
 detections/endpoint/slui_runas_elevated.yml   | 12 ++-
 .../endpoint/slui_spawning_a_process.yml      | 12 ++-
 .../endpoint/spoolsv_spawning_rundll32.yml    | 14 ++-
 .../endpoint/suspicious_copy_on_system32.yml  | 34 +++----
 .../suspicious_curl_network_connection.yml    | 12 ++-
 ...ious_dllhost_no_command_line_arguments.yml | 14 ++-
 ...ous_gpupdate_no_command_line_arguments.yml | 13 ++-
 .../suspicious_icedid_rundll32_cmdline.yml    | 14 ++-
 .../suspicious_linux_discovery_commands.yml   | 12 ++-
 ...ous_microsoft_workflow_compiler_rename.yml | 14 ++-
 ...ious_microsoft_workflow_compiler_usage.yml | 14 ++-
 .../endpoint/suspicious_msbuild_path.yml      | 14 ++-
 .../endpoint/suspicious_msbuild_rename.yml    | 14 ++-
 .../endpoint/suspicious_msbuild_spawn.yml     | 14 ++-
 .../suspicious_mshta_child_process.yml        | 13 ++-
 .../endpoint/suspicious_mshta_spawn.yml       | 14 ++-
 .../endpoint/suspicious_plistbuddy_usage.yml  | 12 ++-
 ...ss_executed_from_container_file_filter.yml | 42 ++++++---
 .../endpoint/suspicious_process_file_path.yml | 26 +++--
 .../endpoint/suspicious_reg_exe_process.yml   | 17 ++--
 ...ious_regsvr32_register_suspicious_path.yml | 38 ++++----
 .../suspicious_rundll32_dllregisterserver.yml | 18 ++--
 ...ous_rundll32_no_command_line_arguments.yml | 14 ++-
 .../suspicious_rundll32_plugininit.yml        | 14 ++-
 .../endpoint/suspicious_rundll32_startw.yml   | 14 ++-
 ...s_scheduled_task_from_public_directory.yml | 29 ++++--
 ...protocolhost_no_command_line_arguments.yml | 14 ++-
 ...spicious_sqlite3_lsquarantine_behavior.yml | 12 ++-
 .../endpoint/suspicious_wevtutil_usage.yml    | 14 ++-
 ...svchost_lolbas_execution_process_spawn.yml | 24 ++++-
 ...nfo_gathering_using_dxdiag_application.yml | 14 ++-
 ...system_information_discovery_detection.yml | 12 ++-
 ...rocesses_run_from_unexpected_locations.yml | 12 ++-
 .../system_user_discovery_with_query.yml      | 12 ++-
 .../system_user_discovery_with_whoami.yml     | 12 ++-
 .../endpoint/uninstall_app_using_msiexec.yml  | 13 ++-
 ...wn_process_using_the_kerberos_protocol.yml | 11 ++-
 .../endpoint/unload_sysmon_filter_driver.yml  | 15 +--
 .../endpoint/unusually_long_command_line.yml  | 13 ++-
 .../unusually_long_command_line___mltk.yml    | 19 ++--
 ...ser_discovery_with_env_vars_powershell.yml | 12 ++-
 detections/endpoint/usn_journal_deletion.yml  | 14 ++-
 .../vbscript_execution_using_wscript_app.yml  | 14 ++-
 .../endpoint/verclsid_clsid_execution.yml     | 14 ++-
 detections/endpoint/w3wp_spawning_shell.yml   | 14 ++-
 .../wbadmin_delete_system_backups.yml         | 12 ++-
 ...cess_spawned_cmd_or_powershell_process.yml | 14 ++-
 .../wget_download_and_bash_execution.yml      | 15 +--
 .../windows_ad_dsrm_account_changes.yml       | 41 ++++----
 detections/endpoint/windows_adfind_exe.yml    | 12 ++-
 .../windows_apache_benchmark_binary.yml       | 14 ++-
 ...roxy_execution_mavinject_dll_injection.yml | 14 ++-
 .../windows_bypass_uac_via_pkgmgr_tool.yml    | 43 ++++++---
 ...ws_cached_domain_credentials_reg_query.yml | 13 ++-
 ...fault_file_association_for_no_file_ext.yml | 15 +--
 ..._hijacking_inprocserver32_modification.yml | 14 ++-
 ...ing_interpreter_hunting_path_traversal.yml | 14 ++-
 ...ipting_interpreter_path_traversal_exec.yml | 14 ++-
 ...s_command_shell_dcrat_forkbomb_payload.yml | 14 ++-
 ...dows_command_shell_fetch_env_variables.yml | 14 ++-
 ...ential_dumping_lsass_memory_createdump.yml | 14 ++-
 ...credentials_from_password_stores_query.yml | 13 ++-
 ...dows_credentials_in_registry_reg_query.yml | 13 ++-
 ...ndows_curl_download_to_suspicious_path.yml | 14 ++-
 ...dows_curl_upload_to_remote_destination.yml | 14 ++-
 ...group_policy_object_modified_with_gpme.yml | 52 ++++++----
 ...ry_by_a_non_critical_process_file_path.yml | 13 ++-
 ...ows_event_logging_disable_http_logging.yml | 14 ++-
 .../endpoint/windows_diskcryptor_usage.yml    | 14 ++-
 .../windows_diskshadow_proxy_execution.yml    | 14 ++-
 .../endpoint/windows_dism_remove_defender.yml | 14 ++-
 ...indows_dll_search_order_hijacking_hunt.yml | 15 +--
 ...l_search_order_hijacking_with_iscsicpl.yml | 14 ++-
 ...dll_side_loading_process_child_of_calc.yml | 37 +++++---
 .../windows_dns_gather_network_info.yml       | 39 +++++---
 ...ows_dotnet_binary_in_non_standard_path.yml | 14 ++-
 ...s_execute_arbitrary_commands_with_msdt.yml | 14 ++-
 ..._access_rights_modification_via_icacls.yml | 44 +++++----
 .../windows_findstr_gpp_discovery.yml         | 45 +++++----
 .../windows_identify_protocol_handlers.yml    | 14 ++-
 .../windows_iis_components_add_new_module.yml | 15 +--
 ...impair_defense_add_xml_applocker_rules.yml | 14 ++-
 ...ndirect_command_execution_via_forfiles.yml | 13 ++-
 ..._indirect_command_execution_via_pcalua.yml | 13 ++-
 ...mmand_execution_via_series_of_forfiles.yml | 15 +--
 .../windows_information_discovery_fsutil.yml  | 13 ++-
 ...s_ingress_tool_transfer_using_explorer.yml | 14 ++-
 ...ndows_installutil_in_non_standard_path.yml | 14 ++-
 ..._installutil_remote_network_connection.yml | 14 ++-
 .../windows_installutil_uninstall_option.yml  | 14 ++-
 ...tallutil_uninstall_option_with_network.yml | 14 ++-
 ...indows_installutil_url_in_command_line.yml | 14 ++-
 .../endpoint/windows_java_spawning_shells.yml | 15 +--
 .../windows_lateral_tool_transfer_remcom.yml  | 42 ++++++---
 ...ndows_ldifde_directory_object_behavior.yml | 60 ++++++++----
 ...masquerading_explorer_as_child_process.yml | 14 ++-
 .../windows_mimikatz_binary_execution.yml     | 14 ++-
 ...y_registry_qakbot_binary_data_registry.yml | 13 ++-
 .../windows_modify_registry_reg_restore.yml   | 13 ++-
 ...ify_registry_regedit_silent_reg_import.yml | 14 ++-
 ..._mof_event_triggered_execution_via_wmi.yml | 14 ++-
 .../windows_msiexec_dllregisterserver.yml     | 14 ++-
 .../windows_msiexec_remote_download.yml       | 14 ++-
 ...indows_msiexec_spawn_discovery_command.yml | 14 ++-
 ...s_msiexec_unregister_dllregisterserver.yml | 14 ++-
 ...ndows_msiexec_with_network_connections.yml | 16 ++--
 .../windows_ngrok_reverse_proxy_usage.yml     | 14 ++-
 .../endpoint/windows_nirsoft_advancedrun.yml  | 14 ++-
 .../endpoint/windows_nirsoft_utilities.yml    | 14 ++-
 .../endpoint/windows_odbcconf_hunting.yml     | 14 ++-
 .../endpoint/windows_odbcconf_load_dll.yml    | 14 ++-
 .../windows_odbcconf_load_response_file.yml   | 14 ++-
 .../windows_office_product_spawning_msdt.yml  | 14 ++-
 .../windows_papercut_ng_spawn_shell.yml       | 42 ++++++---
 .../windows_password_managers_discovery.yml   | 13 ++-
 ...ws_phishing_pdf_file_executes_url_link.yml | 14 ++-
 .../windows_powershell_remotesigned_file.yml  | 48 +++++-----
 .../windows_private_keys_discovery.yml        | 13 ++-
 ...process_injection_wermgr_child_process.yml | 14 ++-
 ...ows_process_with_namedpipe_commandline.yml | 13 ++-
 .../windows_protocol_tunneling_with_plink.yml | 14 ++-
 .../endpoint/windows_proxy_via_netsh.yml      | 38 ++++----
 .../windows_query_registry_reg_save.yml       | 13 ++-
 ...indows_raccine_scheduled_task_deletion.yml | 14 ++-
 .../windows_rasautou_dll_execution.yml        | 14 ++-
 .../windows_registry_payload_injection.yml    | 62 ++++++++----
 .../windows_regsvr32_renamed_binary.yml       | 14 ++-
 .../windows_remote_access_software_hunt.yml   | 14 ++-
 ...ows_remote_assistance_spawning_process.yml | 14 ++-
 .../windows_remote_create_service.yml         | 43 ++++++---
 ...remote_service_rdpwinst_tool_execution.yml | 14 ++-
 ..._remote_services_allow_rdp_in_firewall.yml | 13 ++-
 .../windows_rundll32_webdav_request.yml       | 51 ++++++----
 ...undll32_webdav_with_network_connection.yml | 64 ++++++++-----
 ...windows_scheduled_task_created_via_xml.yml | 51 ++++++----
 ...s_scheduled_task_service_spawned_shell.yml | 50 ++++++----
 ...scheduled_task_with_highest_privileges.yml | 30 ++++--
 .../windows_schtasks_create_run_as_system.yml | 24 +++--
 ...ndows_security_account_manager_stopped.yml | 13 ++-
 ...ws_security_support_provider_reg_query.yml | 13 ++-
 ...tware_component_gacutil_install_to_gac.yml | 14 ++-
 ...dows_service_create_kernel_mode_driver.yml | 14 ++-
 .../windows_service_create_with_tscon.yml     | 56 ++++++++---
 ...ws_service_creation_on_remote_endpoint.yml | 12 ++-
 ..._service_initiation_on_remote_endpoint.yml | 12 ++-
 .../windows_service_stop_by_deletion.yml      | 13 ++-
 ...rvice_stop_via_net__and_sc_application.yml | 14 ++-
 ...hishing_attachment_onenote_spawn_mshta.yml | 14 ++-
 .../windows_sql_spawning_certutil.yml         | 49 ++++++++--
 ...ntication_certificates_certutil_backup.yml | 14 ++-
 ...cation_certificates_export_certificate.yml | 13 ++-
 ...ion_certificates_export_pfxcertificate.yml | 13 ++-
 ..._steal_or_forge_kerberos_tickets_klist.yml | 13 ++-
 ...execution_compiled_html_file_decompile.yml | 14 ++-
 ...s_system_discovery_using_ldap_nslookup.yml | 14 ++-
 ...windows_system_discovery_using_qwinsta.yml | 14 ++-
 .../windows_system_logoff_commandline.yml     | 14 ++-
 ...m_network_config_discovery_display_dns.yml | 13 ++-
 ...em_network_connections_discovery_netsh.yml | 13 ++-
 .../windows_system_reboot_commandline.yml     | 14 ++-
 ...oxy_execution_syncappvpublishingserver.yml | 14 ++-
 .../windows_system_shutdown_commandline.yml   | 46 +++++----
 ...dows_system_time_discovery_w32tm_delay.yml | 14 ++-
 ...indows_system_user_discovery_via_quser.yml | 13 ++-
 ...id_account_with_never_expires_password.yml | 13 ++-
 ...inlogon_with_public_network_connection.yml | 83 ++++++++++------
 .../windows_wmi_process_and_service_list.yml  | 13 ++-
 .../windows_wmi_process_call_create.yml       | 13 ++-
 .../endpoint/winhlp32_spawning_a_process.yml  | 14 ++-
 .../winrar_spawning_shell_application.yml     | 48 ++++++++--
 .../endpoint/winrm_spawning_a_process.yml     | 12 ++-
 detections/endpoint/winword_spawning_cmd.yml  | 14 ++-
 .../endpoint/winword_spawning_powershell.yml  | 14 ++-
 .../winword_spawning_windows_script_host.yml  | 12 ++-
 detections/endpoint/wmic_group_discovery.yml  | 14 ++-
 ...wmic_noninteractive_app_uninstallation.yml | 14 ++-
 .../endpoint/wmic_xsl_execution_via_url.yml   | 14 ++-
 ...miprsve_lolbas_execution_process_spawn.yml | 12 ++-
 ...pt_or_cscript_suspicious_child_process.yml | 13 ++-
 ...rovhost_lolbas_execution_process_spawn.yml | 12 ++-
 detections/endpoint/wsreset_uac_bypass.yml    | 13 ++-
 .../xsl_script_execution_with_wmic.yml        | 13 ++-
 510 files changed, 5750 insertions(+), 2900 deletions(-)

diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml
index e03cf5122c..fe35ccdfb6 100644
--- a/detections/application/web_servers_executing_suspicious_processes.yml
+++ b/detections/application/web_servers_executing_suspicious_processes.yml
@@ -15,12 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*")
   by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. In addition, web servers will need to be identified in the Assets and Identity
-  Framework of Enterprise Security.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some of these processes may be used legitimately on web servers
   during maintenance or other administrative tasks.
 references: []
diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml
index 06989ed43c..2b512d11e3 100644
--- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml
+++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml
@@ -15,10 +15,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   where Processes.process = "*     .*" by Processes.dest Processes.user Processes.process
   Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | `execution_of_file_with_spaces_before_extension_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified.
 references: []
 tags:
diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/detections/deprecated/first_time_seen_command_line_argument.yml
index 2207d91d3e..3094fd5e77 100644
--- a/detections/deprecated/first_time_seen_command_line_argument.yml
+++ b/detections/deprecated/first_time_seen_command_line_argument.yml
@@ -21,15 +21,15 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   previously_seen_cmd_line_arguments | eval newCmdLineArgument=if(firstTime >= relative_time(now(),
   "-70m@m"), 1, 0) | where newCmdLineArgument=1 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | table process] | `first_time_seen_command_line_argument_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
-  logs with both the process name and command line from your endpoints. The complete
-  process name with command-line arguments are mapped to the "process" field in the
-  Endpoint data model. Please make sure you run the support search "Previously seen
-  command line arguments,"&#151;which creates a lookup file called `previously_seen_cmd_line_arguments.csv`&#151;a
-  historical baseline of all command-line arguments. You must also validate this list.
-  For the search to do accurate calculation, ensure the search scheduling is the same
-  value as the `relative_time` evaluation function.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate programs can also use command-line arguments to
   execute. Please verify the command-line arguments to check what command/program
   is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
diff --git a/detections/deprecated/processes_created_by_netsh.yml b/detections/deprecated/processes_created_by_netsh.yml
index 80e09f91cb..3ecfc79310 100644
--- a/detections/deprecated/processes_created_by_netsh.yml
+++ b/detections/deprecated/processes_created_by_netsh.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   where Processes.process_name=netsh.exe by Processes.user Processes.dest Processes.parent_process
   Processes.parent_process_name Processes.process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `processes_created_by_netsh_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting logs
-  with the process name, command-line arguments, and parent processes from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is unusual for netsh.exe to have any child processes in
   most environments. It makes sense to investigate the child process and verify whether
   the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe"
diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/detections/deprecated/prohibited_software_on_endpoint.yml
index af67f02a67..2abbefd503 100644
--- a/detections/deprecated/prohibited_software_on_endpoint.yml
+++ b/detections/deprecated/prohibited_software_on_endpoint.yml
@@ -1,52 +1,48 @@
 name: Prohibited Software On Endpoint
 id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
 version: 2
-date: "2019-10-11"
+date: '2019-10-11'
 author: David Dorsey, Splunk
 status: deprecated
 type: Hunting
-description:
-  This search looks for applications on the endpoint that you have marked
+description: This search looks for applications on the endpoint that you have marked
   as prohibited.
 data_source:
-  - Sysmon Event ID 1
-search:
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+- Sysmon Event ID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
-  | `prohibited_processes` | `prohibited_software_on_endpoint_filter`"
-how_to_implement:
-  To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is usually generated via logs that report process tracking
-  in your Windows audit settings. In addition, you must also have only the `process_name`
-  (not the entire process path) marked as "prohibited" in the Enterprise Security
-  `interesting processes` table. To include the process names marked as "prohibited",
-  which is included with ES Content Updates, run the included search <code>Add Prohibited
-  Processes to Enterprise Security</code>.
+  | `prohibited_processes` | `prohibited_software_on_endpoint_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified
 references: []
 tags:
   analytic_story:
-    - Monitor for Unauthorized Software
-    - "Emotet Malware  DHS Report TA18-201A "
-    - SamSam Ransomware
+  - Monitor for Unauthorized Software
+  - 'Emotet Malware  DHS Report TA18-201A '
+  - SamSam Ransomware
   asset_type: Endpoint
   confidence: 50
   impact: 50
   message: tbd
   observable:
-    - name: field
-      type: Unknown
-      role:
-        - Unknown
+  - name: field
+    type: Unknown
+    role:
+    - Unknown
   product:
-    - Splunk Enterprise
-    - Splunk Enterprise Security
-    - Splunk Cloud
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
   required_fields:
-    - _times
+  - _times
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml
index 7b6faf5103..29d166c627 100644
--- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml
+++ b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml
@@ -15,11 +15,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process="*REG_DWORD*" by Processes.process_name Processes.parent_process_name
   Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)`| regex process = "(/d\s+2)" | `reg_exe_used_to_hide_files_directories_via_registry_keys_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None at the moment
 references: []
 tags:
diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml
index df4b629fa3..3c511d4da3 100644
--- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml
+++ b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "*delete*") by Processes.parent_process Processes.process_name Processes.user |
   `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | search (process=*rhaegal* OR process=*drogon* OR *viserion_*) | `scheduled_tasks_used_in_badrabbit_ransomware_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No known false positives
 references: []
 tags:
diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/detections/deprecated/suspicious_changes_to_file_associations.yml
index 54923985ef..ade4a24926 100644
--- a/detections/deprecated/suspicious_changes_to_file_associations.yml
+++ b/detections/deprecated/suspicious_changes_to_file_associations.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts*
   by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table
   process_id dest registry_path]| `suspicious_changes_to_file_associations_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on registry changes that include the name of the process responsible for the changes
-  from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
-  nodes.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: There may be other processes in your environment that users
   may legitimately use to modify file associations. If this is the case and you are
   finding false positives, you can modify the search to add those processes as exceptions.
diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml
index 87068b1d4e..5a791c4a41 100644
--- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml
+++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `suspicious_powershell_command_line_arguments_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
 references: []
diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/detections/deprecated/suspicious_rundll32_rename.yml
index a6bd52acfc..6abf25019f 100644
--- a/detections/deprecated/suspicious_rundll32_rename.yml
+++ b/detections/deprecated/suspicious_rundll32_rename.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml
index e788b4d77b..e24e18fe44 100644
--- a/detections/deprecated/uncommon_processes_on_endpoint.yml
+++ b/detections/deprecated/uncommon_processes_on_endpoint.yml
@@ -13,14 +13,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process
   Processes.process_name | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | `uncommon_processes` |`uncommon_processes_on_endpoint_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. This search uses a lookup file `uncommon_processes_default.csv` to track
-  various features of process names that are usually uncommon in most environments.
-  Please consider updating `uncommon_processes_local.csv` to hunt for processes that
-  are uncommon in your environment.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified
 references: []
 tags:
diff --git a/detections/deprecated/windows_connhost_exe_started_forcefully.yml b/detections/deprecated/windows_connhost_exe_started_forcefully.yml
index 3a12cb6556..4eb62ad733 100644
--- a/detections/deprecated/windows_connhost_exe_started_forcefully.yml
+++ b/detections/deprecated/windows_connhost_exe_started_forcefully.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   0xffffffff *-ForceV1*" by Processes.user Processes.process_name Processes.process
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `windows_connhost_exe_started_forcefully_filter`'
-how_to_implement: You must be ingesting data that records the process-system activity
-  from your hosts to populate the Endpoint Processes data-model object. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This process should not be ran forcefully, we have not see
   any false positives for this detection
 references: []
diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
index 4df412bb04..51f1d261f5 100644
--- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_id Processes.process_id  Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `7zip_commandline_to_smb_share_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index de4b3c47d4..766304d018 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user
   Processes.parent_process_name | where count >=4 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product..
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Admin or power user may used this series of command.
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
index cd9ae227df..b5e1b1a919 100644
--- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Admin or user may choose to use this windows features. Filter
   as needed.
 references:
diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index b47cabc958..b2ae4824a1 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index 13fc33529a..8e199753be 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause
   this rule to be triggered.
 references:
diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml
index 3be0e282d8..c0fd2ad9bc 100644
--- a/detections/endpoint/anomalous_usage_of_7zip.yml
+++ b/detections/endpoint/anomalous_usage_of_7zip.yml
@@ -20,9 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this behavior is not normal
   for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
 references:
diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index c0ac9df75d..9a47b50a5a 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -14,15 +14,19 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `any_powershell_downloadfile_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.parent_process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index e20e75817d..9c73250231 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -14,14 +14,19 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString*  by
-  Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml
index 16b6f81910..385b25c0ea 100644
--- a/detections/endpoint/attacker_tools_on_endpoint.yml
+++ b/detections/endpoint/attacker_tools_on_endpoint.yml
@@ -5,7 +5,17 @@ date: '2021-11-04'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
-description: The following analytic aims to identify the use of tools commonly exploited by cybercriminals. The use of these tools often signals nefarious activities like unauthorized access, network scanning, or data exfiltration, representing a significant threat to an organization's security infrastructure. By examining process activity on the host, particularly those processes corresponding to known attacker tool names, this analytic serves as an early warning system for potential security incidents. However, its precision must be balanced with the understanding that some administrative activities might also trigger alerts, resulting in false positives. This underlines the importance of cyber analysts having a clear understanding of typical endpoint activities and behaviors within their organization, enabling them to accurately interpret and respond to these alerts.
+description: The following analytic aims to identify the use of tools commonly exploited
+  by cybercriminals. The use of these tools often signals nefarious activities like
+  unauthorized access, network scanning, or data exfiltration, representing a significant
+  threat to an organization's security infrastructure. By examining process activity
+  on the host, particularly those processes corresponding to known attacker tool names,
+  this analytic serves as an early warning system for potential security incidents.
+  However, its precision must be balanced with the understanding that some administrative
+  activities might also trigger alerts, resulting in false positives. This underlines
+  the importance of cyber analysts having a clear understanding of typical endpoint
+  activities and behaviors within their organization, enabling them to accurately
+  interpret and respond to these alerts.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,12 +25,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
   process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is usually generated via logs that report process tracking
-  in your Windows audit settings.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some administrator activity can be potentially triggered, please
   add those users to the filter macro.
 references: []
diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
index d6ea16c6dc..b79950c531 100644
--- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
@@ -5,19 +5,34 @@ date: '2021-09-16'
 author: Patrick Bareiss, Rico Valdez, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to detect potential security threats involving the misuse of system trust. It works by detecting events where a process attempts to add a certificate to the untrusted certificate store, an action often associated with disabling security tools. The analytic uses Sysmon Event ID 1 data source, particularly focusing on process activities and command-line arguments related to 'certutil -addstore'. It's essential to ingest data that records process activity and logs containing process names and command lines for its effective operation. Be aware, sometimes administrators might legitimately perform this action. The analytic's value lies in detecting isolated or unexpected instances, indicative of potential malicious activities. Cybersecurity analysts should understand the importance of trust mechanisms and their subversion in system security.
+description: The following analytic is designed to detect potential security threats
+  involving the misuse of system trust. It works by detecting events where a process
+  attempts to add a certificate to the untrusted certificate store, an action often
+  associated with disabling security tools. The analytic uses Sysmon Event ID 1 data
+  source, particularly focusing on process activities and command-line arguments related
+  to 'certutil -addstore'. It's essential to ingest data that records process activity
+  and logs containing process names and command lines for its effective operation.
+  Be aware, sometimes administrators might legitimately perform this action. The analytic's
+  value lies in detecting isolated or unexpected instances, indicative of potential
+  malicious activities. Cybersecurity analysts should understand the importance of
+  trust mechanisms and their subversion in system security.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
-  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
-  | `attempt_to_add_certificate_to_untrusted_store_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+  (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: There may be legitimate reasons for administrators to add a
   certificate to the untrusted certificate store. In such cases, this will typically
   be done on a large number of systems.
diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index faaddc8abf..570306820b 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -12,16 +12,20 @@ data_source:
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_net` OR  Processes.process_name = sc.exe Processes.process="* stop
-  *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  |lookup security_services_lookup service as process OUTPUTNEW category, description
-  | search category=security | `attempt_to_stop_security_service_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` |lookup security_services_lookup service as
+  process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified. Attempts to disable security-related services
   should be identified and understood.
 references:
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index e11227f8cc..e24606240d 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
index d16951cad6..ed4cd4f9ab 100644
--- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
   Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml
index 9f1c8b4d5d..b00ba015c9 100644
--- a/detections/endpoint/bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.parent_process_name Processes.dest Processes.user |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bcdedit_failure_recovery_modification_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. Tune based on parent process names.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 4ea33a71e6..4b4742789f 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -18,14 +18,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
   IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
   *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name
-  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives will be present. Typically, applications
   will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
   (legitimate applications) or parent process.
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index 9adebd11d9..e2684ea0b4 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -21,15 +21,19 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
-  IN ("*transfer*", "*addfile*") by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
-  Processes.original_file_name Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  IN ("*transfer*", "*addfile*") by Processes.dest Processes.user Processes.parent_process
+  Processes.parent_process_name Processes.original_file_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives, however it may be required to filter
   based on parent process name or network connection.
 references:
diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 422da9cbf9..fd814d5235 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -17,14 +17,19 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
   Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
-  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
-  Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.original_file_name Processes.parent_process_id |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `certutil_download_with_urlcache_and_split_arguments_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index 33723ededb..f1e93aef98 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -17,14 +17,19 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
   Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
-  Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.original_file_name Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `certutil_download_with_verifyctl_and_split_arguments_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives in most environments, however tune
   as needed based on parent-child relationship or network connection.
 references:
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index b7b8c30f59..6fd31fbb00 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -12,13 +12,19 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `certutil_exe_certificate_extraction_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unless there are specific use cases, manipulating or exporting
   certificates using certutil is uncommon. Extraction of certificate has been observed
   during attacks such as Golden SAML and other campaigns targeting Federated services.
diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index 2c15427702..428222b5b2 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -17,14 +17,19 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
-  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `certutil_with_decode_argument_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Typically seen used to `encode` files, but it is possible to
   see legitimate use of `decode`. Filter based on parent-child relationship, file
   paths, endpoint or user.
diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml
index 0610d1bc1c..422606099d 100644
--- a/detections/endpoint/change_to_safe_mode_with_network_config.yml
+++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml
index 639afc2d6a..342a48cff1 100644
--- a/detections/endpoint/chcp_command_execution.yml
+++ b/detections/endpoint/chcp_command_execution.yml
@@ -12,14 +12,20 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
-  Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by  Processes.process_name
-  Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
-  Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
+  Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*)
+  by  Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process
+  Processes.process_id Processes.parent_process_id Processes.dest Processes.user |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `chcp_command_execution_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: other tools or script may used this to change code page to
   UTF-* or others
 references:
diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml
index 6003188481..22b8d0be52 100644
--- a/detections/endpoint/check_elevated_cmd_using_whoami.yml
+++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references: []
 tags:
diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml
index 07dbf99066..1f6d69d0a5 100644
--- a/detections/endpoint/child_processes_of_spoolsv_exe.yml
+++ b/detections/endpoint/child_processes_of_spoolsv_exe.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro
-  to filter out legitimate child processes spawned by spoolsv.exe.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate printer-related processes may show up as children
   of spoolsv.exe. You should confirm that any activity as legitimate and may be added
   as exclusions in the search.
diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
index c56e5b6502..8df01ccb19 100644
--- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrator may execute this app to manage disk
 references:
 - https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml
index 22aedf38f7..9db57201b0 100644
--- a/detections/endpoint/clop_common_exec_parameter.yml
+++ b/detections/endpoint/clop_common_exec_parameter.yml
@@ -14,14 +14,21 @@ description: The following analytics are designed to identifies some CLOP ransom
   since it is waiting for some parameter to execute properly.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*"
-  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*"
+  Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest
+  Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Operators can execute third party tools using these parameters.
 references:
 - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index 036a01fc20..ca7074bc1e 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cmd_carry_out_string_command_parameter_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be high based on legitimate scripted code
   in any environment. Filter as needed.
 references:
diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index a57fa1ab82..3d7f9059d2 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -14,14 +14,18 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%*
   (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user
-  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. It is possible filtering may be required to ensure
   fidelity.
 references:
diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
index 61fb949ee9..854710ecc2 100644
--- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
@@ -27,11 +27,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_id Processes.process Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an
   automated host discovery application that may generate false positives. Filter as
   needed.
diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml
index 47eb6667f6..19fb921166 100644
--- a/detections/endpoint/conti_common_exec_parameter.yml
+++ b/detections/endpoint/conti_common_exec_parameter.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `conti_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: 3rd party tool may have commandline parameter that can trigger
   this detection.
 references:
diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
index 658f160afb..4a7cf0e367 100644
--- a/detections/endpoint/control_loading_from_world_writable_directory.yml
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives will be present as control.exe does
   not natively load from writable paths as defined. One may add .cpl or .inf to the
   command-line if there is any false positives. Tune as needed.
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index b17e92d725..68f8abd683 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
   OR Processes.process=*administratorer*) by Processes.process Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators often leverage net.exe to create admin accounts.
 references: []
 tags:
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index 798036214c..5e26355b95 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -12,14 +12,18 @@ data_source:
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by
-  Processes.process Processes.process_name  Processes.parent_process_name Processes.original_file_name Processes.dest
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.process Processes.process_name  Processes.parent_process_name Processes.original_file_name
+  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators often leverage net.exe to create or delete network
   shares. You should verify that the activity was intentional and is legitimate.
 references:
diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index d84d1821ed..cdb2792e49 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process  Processes.parent_process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create
   false positives.
 references:
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 5a87fb8dce..df6cee46b1 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -12,13 +12,18 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
   Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
-  Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index aa9ac38edb..47d4de5303 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -14,13 +14,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system*
   OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user
   Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id  Processes.parent_process_name | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.process_id Processes.parent_process_id  Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index 0d953b64fe..166cc109fc 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -11,14 +11,18 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*
   Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name
-  Processes.process  Processes.parent_process Processes.parent_process_name Processes.original_file_name Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.process  Processes.parent_process Processes.parent_process_name Processes.original_file_name
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml
index ad9b32bf2a..3c6c0f0ba5 100644
--- a/detections/endpoint/csc_net_on_the_fly_compilation.yml
+++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `csc_net_on_the_fly_compilation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an
   automated powershell script taht execute .net code that may generate false positive.
   filter is needed.
diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml
index a51e4b2fe4..40bfd9a650 100644
--- a/detections/endpoint/curl_download_and_bash_execution.yml
+++ b/detections/endpoint/curl_download_and_bash_execution.yml
@@ -16,12 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
-  modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
-  as needed to filter.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filtering may be
   required.
 references:
diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml
index d4326f981c..7c073d2c57 100644
--- a/detections/endpoint/deleting_of_net_users.yml
+++ b/detections/endpoint/deleting_of_net_users.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   by  Processes.process_name Processes.original_file_name Processes.dest Processes.user
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: System administrators or scripts may delete user accounts via
   this technique. Filter as needed.
 references:
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index 5fb04d859f..807758110a 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `deleting_shadow_copies_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
   with modern versions of windows. They may be used by administrators to legitimately
   delete old backup copies, although this is typically rare.
diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
index 5211fd79f3..973764df08 100644
--- a/detections/endpoint/detect_azurehound_command_line_arguments.yml
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown.
 references:
 - https://attack.mitre.org/software/S0521/
diff --git a/detections/endpoint/detect_certify_command_line_arguments.yml b/detections/endpoint/detect_certify_command_line_arguments.yml
index 59721aa1cb..c656157f4e 100644
--- a/detections/endpoint/detect_certify_command_line_arguments.yml
+++ b/detections/endpoint/detect_certify_command_line_arguments.yml
@@ -5,12 +5,30 @@ date: '2023-06-25'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies when the attacker tool Certify or Certipy are used to enumerate Active Directory Certificate Services (AD CS) environments. The default command line arguments of these tools are similar and perform near identical enumeration or exploitation functions.
+description: The following analytic identifies when the attacker tool Certify or Certipy
+  are used to enumerate Active Directory Certificate Services (AD CS) environments.
+  The default command line arguments of these tools are similar and perform near identical
+  enumeration or exploitation functions.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("* find *","* auth *","* request *","* req *","* download *",) AND Processes.process IN ("* /vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*","* /ca*", "* -username *","* -u *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_certify_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
-known_false_positives:  Unknown
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("* find
+  *","* auth *","* request *","* req *","* download *",) AND Processes.process IN
+  ("* /vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*","* /ca*", "*
+  -username *","* -u *") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
+  `detect_certify_command_line_arguments_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Unknown
 references:
 - https://github.com/GhostPack/Certify
 - https://github.com/ly4k/Certipy
@@ -45,13 +63,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
-  - Processes.parent_process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
 tests:
@@ -60,4 +78,4 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true
\ No newline at end of file
+    update_timestamp: true
diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index f8ebcc46ba..27efe7de4c 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
 references:
diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml
index 2c7cb7daa6..d532a32bb5 100644
--- a/detections/endpoint/detect_html_help_spawn_child_process.yml
+++ b/detections/endpoint/detect_html_help_spawn_child_process.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications (ex. web browsers)
   may spawn a child process. Filter as needed.
 references:
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index c6a5efecb7..c9e94504c8 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may retrieve
   a CHM remotely, filter as needed.
 references:
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 066b0a8890..7a6643b2dc 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -26,11 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_using_infotech_storage_handlers_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
   used, but it does happen in some legitimate instances. Filter as needed.
 references:
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 044c8605a8..f264b2c5f1 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.process_name Processes.original_file_name Processes.parent_process_name
   Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index 07063fe7a6..29581ca7de 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of mshta.exe, but never renamed, triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 235773c65a..f26be6a2b2 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name
   Processes.original_file_name Processes.dest  | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible legitimate applications may perform this behavior
   and will need to be filtered.
 references:
diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
index adf662dc58..cc80b77ce0 100644
--- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | eval process_name = lower(process_name) | eval service_process = lower(service_process)
   | where process_name != service_process | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
index 09350bf9c2..ba21845195 100644
--- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
@@ -17,12 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   | search `system_network_configuration_discovery_tools` | transaction dest connected=false
   maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name
   process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`'
-how_to_implement: You must be ingesting data that records registry activity from your
-  hosts to populate the Endpoint data model in the processes node. This is typically
-  populated via endpoint detection-and-response product, such as Carbon Black, or
-  endpoint data sources, such as Sysmon. The data used for this search is usually
-  generated via logs that report reads and writes to the registry or that are populated
-  via Windows event logs, after enabling process tracking in your Windows audit settings.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is uncommon for normal users to execute a series of commands
   used for network discovery. System administrators often use scripts to execute these
   commands. These can generate false positives.
diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
index 0cba0683b4..db557ac2ae 100644
--- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -14,15 +14,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts and populates the Endpoint data model with the resultant dataset. This search
-  includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
-  of processes that should not be spawning cmd.exe. You can modify this lookup to
-  better suit your environment. To successfully implement this search you need to
-  be ingesting information on process that include the name of the process responsible
-  for the changes from your endpoints into the `Endpoint` datamodel in the `Processes`
-  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
-  latest TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: There are circumstances where an application may legitimately
   execute and interact with the Windows command-line interface. Investigate and modify
   the lookup file, as appropriate.
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 79b2c07045..5c16489425 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators can leverage PsExec for accessing remote systems
   and might pass `accepteula` as an argument if they are running this tool for the
   first time. However, it is not likely that you'd see multiple occurrences of this
diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml
index 34ff3a3330..8a64f7f8d3 100644
--- a/detections/endpoint/detect_rare_executables.yml
+++ b/detections/endpoint/detect_rare_executables.yml
@@ -16,15 +16,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.dest)
   as process | `filter_rare_process_allow_list` | sort count | head 30 | rex field=user
   "(?<user_domain>.*)\\\\(?<user_name>.*)" | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `detect_rare_executables_filter` '
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts and populating the `Endpoint` data
-  model with the resultant dataset. The macro `filter_rare_process_allow_list` searches
-  two lookup files for allowed processes.  These consist of `rare_process_allow_list_default.csv`
-  and `rare_process_allow_list_local.csv`. To add your own processes to the allow
-  list, add them to `rare_process_allow_list_local.csv`. If you wish to remove an
-  entry from the default lookup file, you will have to modify the macro itself to
-  set the allow_list value for that process to false. You can modify the limit parameter
-  and search scheduling to better suit your environment.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate processes may be only rarely executed in your
   environment. As these are identified, update `rare_process_allow_list_local.csv`
   to filter them out of your search results.
diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml
index 026f7e1413..23076d2732 100644
--- a/detections/endpoint/detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/detect_rclone_command_line_usage.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |  `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this is restricted to
   the Rclone process name. Filter or tune the analytic as needed.
 references:
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
index 657a20b14a..c1a8b3abac 100644
--- a/detections/endpoint/detect_regasm_spawning_a_process.yml
+++ b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -20,9 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
   may cause a false positive. Filter based endpoint usage, command line arguments,
   or process lineage.
diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index bb713095e1..6cd0ea7e1c 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
index 67d265cadf..47f6d8a993 100644
--- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml
+++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
@@ -20,9 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
   may cause a false positive. Filter based endpoint usage, command line arguments,
   or process lineage.
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 19e5f57e14..d41df52b4c 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index 471969d537..afb82b9c0e 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_regsvr32_application_control_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives related to third party software registering
   .DLL's.
 references:
diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 9de0887294..aeec9d0b29 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives, however this analytic will need to
   be modified for each environment if Sysmon is not used.
 references:
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 2c3fcf91b7..e8d41a4c40 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present. It is possible some
   third party applications may use older versions of PsExec, filter as needed.
 references:
diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index 0b05304e75..95387c2829 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this analytic identifies
   renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
   use case.
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 2be889807a..8f264d7a38 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_winrar_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. It is possible third party applications use renamed
   instances of WinRAR.
 references:
diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml
index 2975dade93..ca750a4909 100644
--- a/detections/endpoint/detect_rtlo_in_process.yml
+++ b/detections/endpoint/detect_rtlo_in_process.yml
@@ -5,31 +5,33 @@ date: '2023-04-26'
 author: Steven Dick
 status: production
 type: TTP
-description: This search is used to detect the abuse of the right-to-left override (RTLO or RLO)
-  character (U+202E) RTLO. This technique is used by adversaries to disguise a string and/or 
-  file name to make it appear benign. The RTLO character is a non-printing Unicode 
-  character that causes the text that follows it to be displayed in reverse.
+description: This search is used to detect the abuse of the right-to-left override
+  (RTLO or RLO) character (U+202E) RTLO. This technique is used by adversaries to
+  disguise a string and/or file name to make it appear benign. The RTLO character
+  is a non-printing Unicode character that causes the text that follows it to be displayed
+  in reverse.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from 
-datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.dest 
-Processes.user Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name 
-Processes.process Processes.process_id Processes.process_guid Processes.parent_process_id 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
-| `drop_dm_object_name(Processes)`
-| regex process="\\x{202E}"
-| rex field=process "(?<RTLO_command_1>.+)(?<RTLO_exist_process>\\x{202E})(?<RTLO_command_2>.+)"
-| eval process_with_RTLO=process
-| eval process=RTLO_command_1.RTLO_command_2
-| fields - RTLO*
-| `detect_rtlo_in_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that includes the full command line of the process being launched on
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Implementation in regions that use right to left in native language.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND
+  Processes.action=allowed by Processes.dest Processes.user Processes.original_file_name
+  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.process_guid Processes.parent_process_id | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | regex
+  process="\\x{202E}" | rex field=process "(?<RTLO_command_1>.+)(?<RTLO_exist_process>\\x{202E})(?<RTLO_command_2>.+)"
+  | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 |
+  fields - RTLO* | `detect_rtlo_in_process_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Implementation in regions that use right to left in native
+  language.
 references:
 - https://attack.mitre.org/techniques/T1036/002/
 - https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index bf91213573..45fcaea433 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___advpack_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use advpack.dll
   or ieadvpack.dll, triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index 03173dcee0..e10210cdbb 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -22,9 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___setupapi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use setupapi
   triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index e5cb9ec0b1..f96ae3754e 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_rundll32_application_control_bypass___syssetup_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
   triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 1d4eef6352..4934ee1e77 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name
   Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index 39c1bfb4b6..ccc4e8c8ed 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as the arguments used are
   specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 references:
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 2e49a39067..f047c01262 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.original_file_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this is specific to a
   file attribute not used by anything else. Filter as needed.
 references:
diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
index 0f04adb212..3b71633340 100644
--- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
+++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
@@ -1,71 +1,43 @@
 name: Detect suspicious processnames using pretrained model in DSDL
 id: a15f8977-ad7d-4669-92ef-b59b97219bf5
 version: 1
-date: "2023-01-23"
+date: '2023-01-23'
 author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
 type: Anomaly
 status: experimental
 data_source:
 - Sysmon Event Code 1
-description: The following analytic uses a pre-trained Deep Learning model to
-  predict whether a processname is suspicious or not. Malwares and malicious
-  programs such as ransomware often use tactics, techniques, and procedures
-  (TTPs) such as copying malicious files to the local machine to propagate
-  themselves across the network. A key indicator of compromise is that after
-  a successful execution of the malware, it copies itself as an executable file
-  with a randomly generated filename and places this file in one of the
-  directories. Such techniques are seen in several malwares such as TrickBot.
-  We develop machine learning model that uses a Recurrent Neural Network (RNN)
-  to distinguish between malicious and benign processnames. The model is trained
-  independently and is then made available for download. We use a character level
-  RNN to classify malicious vs. benign processnames. The higher is_malicious_prob,
+description: The following analytic uses a pre-trained Deep Learning model to predict
+  whether a processname is suspicious or not. Malwares and malicious programs such
+  as ransomware often use tactics, techniques, and procedures (TTPs) such as copying
+  malicious files to the local machine to propagate themselves across the network.
+  A key indicator of compromise is that after a successful execution of the malware,
+  it copies itself as an executable file with a randomly generated filename and places
+  this file in one of the directories. Such techniques are seen in several malwares
+  such as TrickBot. We develop machine learning model that uses a Recurrent Neural
+  Network (RNN) to distinguish between malicious and benign processnames. The model
+  is trained independently and is then made available for download. We use a character
+  level RNN to classify malicious vs. benign processnames. The higher is_malicious_prob,
   the more likely is the processname to be suspicious (between [0,1]). The threshold
   for flagging a processname as suspicious is set as 0.5.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes
-  by Processes.process_name Processes.parent_process_name Processes.process
-  Processes.user Processes.dest
-  | `drop_dm_object_name(Processes)`
-  | rename process_name as text
-  | fields text, parent_process_name, process, user, dest
-  | apply detect_suspicious_processnames_using_pretrained_model_in_dsdl
-  | rename predicted_label as is_suspicious_score
-  | rename text as process_name
-  | where is_suspicious_score > 0.5
-  | `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`'
-
-how_to_implement: 'Steps to deploy detect suspicious processnames model into Splunk App
-    DSDL. This detection depends on the Splunk app for Data Science and Deep
-    Learning which can be found here - `https://splunkbase.splunk.com/app/4607/`
-    and the Endpoint datamodel. The detection uses a pre-trained
-    deep learning model that needs to be deployed in the DSDL app. Follow the steps
-    for deployment here - `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\
-
-  * Download the `artifacts .tar.gz` file from the link - `https://seal.splunkresearch.com/detect_suspicious_processnames_using_pretrained_model_in_dsdl.tar.gz`.\
-
-  * Download the `detect_suspicious_processnames_using_pretrained_model_in_dsdl.ipynb`
-    Jupyter notebook from the link - `https://github.com/splunk/security_content/notebooks`.\
-
-  * Login to the Jupyter Lab assigned for `detect_suspicious_processnames_using_pretrained_model_in_dsdl`
-    container. This container should be listed on Containers page for DSDL app.\
-
-  * Follow the steps below inside Jupyter Notebook:\
-
-    * Upload the `detect_suspicious_processnames_using_pretrained_model_in_dsdl.tar.gz` file
-      into `app/model/data/detect_suspicious_processnames_using_pretrained_model_in_dsdl/` path using the upload option in the Jupyter Notebook.\
-
-    * Untar the artifact `detect_suspicious_processnames_using_pretrained_model_in_dsdl.tar.gz` using
-      `tar -xf app/model/data/detect_suspicious_processnames_using_pretrained_model_in_dsdl.tar.gz -C app/model/data/detect_suspicious_processnames_using_pretrained_model_in_dsdl/`.\
-
-    * Upload `detect_suspicious_processnames_using_pretrained_model_in_dsdl.ipynb` into the Jupyter Notebooks
-      folder using the upload option in Jupyter Notebook.\
-
-    * Save the notebook using the save option in Jupyter Notebook.\
-
-    * Upload `detect_suspicious_processnames_using_pretrained_model_in_dsdl.json` into `notebooks/data`
-      folder.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.parent_process_name
+  Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)`
+  | rename process_name as text | fields text, parent_process_name, process, user,
+  dest | apply detect_suspicious_processnames_using_pretrained_model_in_dsdl | rename
+  predicted_label as is_suspicious_score | rename text as process_name | where is_suspicious_score
+  > 0.5 | `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if a suspicious processname
- is similar to a benign processname.
+  is similar to a benign processname.
 references:
 - https://www.cisa.gov/uscert/ncas/alerts/aa20-302a
 - https://www.splunk.com/en_us/blog/security/random-words-on-entropy-and-dns.html
@@ -78,19 +50,19 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   impact: 50
-  message: The process $process$ is running from an unusual place by $user$ on $dest$ with a processname
-    that appears to be randomly generated.
+  message: The process $process$ is running from an unusual place by $user$ on $dest$
+    with a processname that appears to be randomly generated.
   mitre_attack_id:
   - T1059
   observable:
   - name: dest
     type: Hostname
     role:
-      - Victim
+    - Victim
   - name: user
     type: User
     role:
-      - Victim
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
index 201b37b039..d0c2b437a4 100644
--- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate applications may exhibit this behavior.
 references: []
 tags:
diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml
index 216d7dc674..67398cc24f 100644
--- a/detections/endpoint/detect_webshell_exploit_behavior.yml
+++ b/detections/endpoint/detect_webshell_exploit_behavior.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime,
   by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_webshell_exploit_behavior_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that includes the full command line of the process being launched on
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate OS functions called by vendor applications, baseline
   the environment and filter before enabling. Recommend throttle by dest/process_name
 references:
diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml
index 41b56e2cd4..2d9084ca19 100644
--- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml
+++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml
@@ -15,10 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) values(Proce
   /stext *" OR Processes.process="* /scomma *" ) by Processes.parent_process Processes.process_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `detection_of_tools_built_by_nirsoft_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You
   should verfiy that the tool was used for a legitimate purpose.
 references: []
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index 2e02dc9d26..b3b7ca577a 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   process_path process registry_key_name registry_path registry_value_name registry_value_data
   process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: user may choose to disable windows defender AV
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml
index 2f14777a30..b6aa0810ae 100644
--- a/detections/endpoint/disable_logs_using_wevtutil.yml
+++ b/detections/endpoint/disable_logs_using_wevtutil.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.dest
   Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network operator may disable audit event logs for debugging
   purposes.
 references:
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index 1b73052a81..14b1359670 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   Processes.process Processes.parent_process_name Processes.parent_process Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `disable_schedule_task_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: admin may disable problematic schedule task
 references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index 01676b435f..7fd3ee003d 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: admin may disable firewall during testing or fixing network
   problem.
 references:
diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml
index 142b35ef4b..7fd0fa6506 100644
--- a/detections/endpoint/disabling_net_user_account.yml
+++ b/detections/endpoint/disabling_net_user_account.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   by  Processes.process_name Processes.original_file_name Processes.dest Processes.user
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
index f7b9ac7ee7..7eed05426f 100644
--- a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
+++ b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
@@ -7,37 +7,41 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 13
-description: This detection looks for the deletion of registry keys which disable LSA protection and MS Defender Device Guard. 
+description: This detection looks for the deletion of registry keys which disable
+  LSA protection and MS Defender Device Guard.
 search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry
   where Registry.registry_path IN ("*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LsaCfgFlags",
   "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*", "*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL")
   Registry.action IN (deleted, unknown) by Registry.action Registry.registry_path
-  Registry.process_guid
-  | `drop_dm_object_name(Registry)`
-  | join type=outer process_guid [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name Processes.process
-  Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
-  | `drop_dm_object_name(Processes)`]
+  Registry.process_guid | `drop_dm_object_name(Registry)` | join type=outer process_guid
+  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by Processes.user Processes.process_name Processes.process Processes.dest Processes.parent_process_name
+  Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`]
   | table _time action dest user parent_process_name parent_process process_name process
   process_guid registry_path | `disabling_windows_local_security_authority_defences_via_registry_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry. 
-known_false_positives: Potential to be triggered by an administrator disabling protections for troubleshooting purposes.  
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Potential to be triggered by an administrator disabling protections
+  for troubleshooting purposes.
 references:
 - https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
 - https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
 tags:
   analytic_story:
   - Windows Defence Evasion Tactics
-  - Windows Registry Abuse 
+  - Windows Registry Abuse
   asset_type: Endpoint
   confidence: 100
   impact: 60
-  message: An attempt to disable Windows LSA defences was detected on $dest$. The reg key $registry_path$ was deleted by $user$. 
+  message: An attempt to disable Windows LSA defences was detected on $dest$. The
+    reg key $registry_path$ was deleted by $user$.
   mitre_attack_id:
   - T1556
   observable:
@@ -66,4 +70,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_lsa_protection/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
index d40cf5bd4c..9e1ab31356 100644
--- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port)
   as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port
   != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate third party applications
   may use a moved copy of dllhost, triggering a false positive.
 references:
diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
index 2064dbeebc..f918a92cc4 100644
--- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
+++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `dns_exfiltration_using_nslookup_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: admin nslookup usage
 references:
 - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml
index 38f07b957c..8a309adb75 100644
--- a/detections/endpoint/domain_account_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index 03f5d9e2de..8b29a3c400 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml
index d258779b26..7cb16fff50 100644
--- a/detections/endpoint/domain_account_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_account_discovery_with_wmic.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `domain_account_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1087/002/
diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml
index 6cb1fb7a0b..b63df5d031 100644
--- a/detections/endpoint/domain_controller_discovery_with_nltest.yml
+++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml
index 6fcba1e9ba..e28809b010 100644
--- a/detections/endpoint/domain_controller_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml
index 1ce905ae53..7e92e8b7ed 100644
--- a/detections/endpoint/domain_group_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `domain_group_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml
index b7ac8da53b..ef8878fd95 100644
--- a/detections/endpoint/domain_group_discovery_with_net.yml
+++ b/detections/endpoint/domain_group_discovery_with_net.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml
index 5a9aa655f3..02623f44af 100644
--- a/detections/endpoint/domain_group_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_group_discovery_with_wmic.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml
index 8166c5018d..29b7843f6e 100644
--- a/detections/endpoint/dsquery_domain_discovery.yml
+++ b/detections/endpoint/dsquery_domain_discovery.yml
@@ -34,9 +34,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `dsquery_domain_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives. If there is a true false positive,
   filter based on command-line or parent process.
 references:
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index 0dffb958bd..56208ebe20 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -5,7 +5,28 @@ date: '2023-04-14'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: 'The following analytic detects the behavior of dumping credentials from memory, a tactic commonly used by adversaries. Specifically, it targets the exploitation of the Local Security Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. Threat actors can use the comsvcs.dll to exploit this process and obtain valuable credentials. The analytic identifies instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump, indicating potential LSASS dumping attempts. This tactic is often part of more extensive attack campaigns and is associated with numerous threat groups. Identifying this behavior is crucial for security operations center (SOC) analysts, as credential theft can lead to broader system compromise, persistence, lateral movement, and escalated privileges. It is important to note that no legitimate use of this technique has been identified so far. The impact of the attack, if a true positive is found, can be severe. Attackers can use the stolen credentials to access sensitive information or systems, leading to data theft, ransomware attacks, or other damaging outcomes. To implement this analytic, ensure that logs with process information are ingested from your endpoints. However, be aware of potential false positives, as legitimate uses of the LSASS process may cause benign activities to be flagged. Upon triage, review the processes involved in the LSASS dumping attempt, capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. By identifying and mitigating LSASS exploitation attempts early on, SOC analysts can better protect their organization''s assets and prevent potential breaches.'
+description: The following analytic detects the behavior of dumping credentials from
+  memory, a tactic commonly used by adversaries. Specifically, it targets the exploitation
+  of the Local Security Authority Subsystem Service (LSASS) in Windows, which manages
+  system-level authentication. Threat actors can use the comsvcs.dll to exploit this
+  process and obtain valuable credentials. The analytic identifies instances where
+  the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump, indicating
+  potential LSASS dumping attempts. This tactic is often part of more extensive attack
+  campaigns and is associated with numerous threat groups. Identifying this behavior
+  is crucial for security operations center (SOC) analysts, as credential theft can
+  lead to broader system compromise, persistence, lateral movement, and escalated
+  privileges. It is important to note that no legitimate use of this technique has
+  been identified so far. The impact of the attack, if a true positive is found, can
+  be severe. Attackers can use the stolen credentials to access sensitive information
+  or systems, leading to data theft, ransomware attacks, or other damaging outcomes.
+  To implement this analytic, ensure that logs with process information are ingested
+  from your endpoints. However, be aware of potential false positives, as legitimate
+  uses of the LSASS process may cause benign activities to be flagged. Upon triage,
+  review the processes involved in the LSASS dumping attempt, capture and inspect
+  any relevant on-disk artifacts, and look for concurrent processes to identify the
+  attack source. By identifying and mitigating LSASS exploitation attempts early on,
+  SOC analysts can better protect their organization's assets and prevent potential
+  breaches.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -13,11 +34,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.original_file_name
   Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified.
 references:
 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 45cf26107c..03709c372e 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
   Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified.
 references:
 - https://attack.mitre.org/techniques/T1003/001/
diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml
index 285bcae103..4905358c4a 100644
--- a/detections/endpoint/elevated_group_discovery_with_net.yml
+++ b/detections/endpoint/elevated_group_discovery_with_net.yml
@@ -22,9 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `elevated_group_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml
index 0d9ff3327c..0dba6e1440 100644
--- a/detections/endpoint/elevated_group_discovery_with_wmic.yml
+++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml
@@ -20,9 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml
index 6e76b3e66e..864c00bff3 100644
--- a/detections/endpoint/esentutl_sam_copy.yml
+++ b/detections/endpoint/esentutl_sam_copy.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index 331a058229..7f514ea215 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   dest user parent_process_name parent_process process_name process_path process registry_key_name
   registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some false positives may be present and will need to be filtered.
 references:
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml
index 8bf0526a88..36dbb0bf57 100644
--- a/detections/endpoint/excel_spawning_powershell.yml
+++ b/detections/endpoint/excel_spawning_powershell.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.process_name Processes.user Processes.dest Processes.original_file_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `excel_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml
index 6da420a2fd..59a2924958 100644
--- a/detections/endpoint/excel_spawning_windows_script_host.yml
+++ b/detections/endpoint/excel_spawning_windows_script_host.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   "wscript.exe")  by Processes.parent_process Processes.process_name Processes.user
   Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `excel_spawning_windows_script_host_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed. In some instances, `cscript.exe` is used for legitimate business
   practices.
diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index 80a0749ef2..b38b0beefb 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
index 7d0a8f8f57..b64cf95b05 100644
--- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
+++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   = "*\\Windows\\Temp\\*" by Processes.dest Processes.user  _time span=20m | where
   distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the full process path in the process field of CIM's Process data model.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where renamed sc.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Many benign applications will create processes from executables
   in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
 references:
diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
index 64e3242c67..90938507c7 100644
--- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` distinct_count(Processes.proc
   Processes.parent_process Processes.process_name Processes.parent_process_id, _time
   span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
-  logs with both the process name and command line from your endpoints. The complete
-  process name with command-line arguments are mapped to the "process" field in the
-  Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate programs and administrators will execute sc.exe
   with the start disabled flag.  It is possible, but unlikely from the telemetry of
   normal Windows operation we observed, that sc.exe will be called more than seven
diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml
index 1cb4236fea..8cf40e3bb8 100644
--- a/detections/endpoint/excessive_number_of_taskhost_processes.yml
+++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process_id)
   as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count >
   10 and taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `excessive_number_of_taskhost_processes_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting events
-  related to processes on the endpoints that include the name of the process and process
-  id into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators, administrative actions or certain applications
   may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
 references:
diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml
index 4a7d29a7c2..6e745e0744 100644
--- a/detections/endpoint/excessive_service_stop_attempt.yml
+++ b/detections/endpoint/excessive_service_stop_attempt.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml
index ef59d6ecdc..f36b8c501c 100644
--- a/detections/endpoint/excessive_usage_of_cacls_app.yml
+++ b/detections/endpoint/excessive_usage_of_cacls_app.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process
   Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application.
   Filter as needed.
 references:
diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml
index 83246f8a75..66b965166a 100644
--- a/detections/endpoint/excessive_usage_of_net_app.yml
+++ b/detections/endpoint/excessive_usage_of_net_app.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user
   _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown. Filter as needed. Modify the time span as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 73937a219d..8b25eaaaa0 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.process_name Processes.dest Processes.user
   _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
index 400f1f8f98..c83edb1db1 100644
--- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.parent_process Processes.process_id
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index aebaf09f9d..81f7337848 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") by Processes.dest
   Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified.
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index 63bfd73dd4..7994fed1da 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `extraction_of_registry_hives_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible some agent based products will generate false
   positives. Filter as needed.
 references:
diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml
index 41cb565451..f0751603bd 100644
--- a/detections/endpoint/firewall_allowed_program_enable.yml
+++ b/detections/endpoint/firewall_allowed_program_enable.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `firewall_allowed_program_enable_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an
   automated or manual execution of this firewall rule that may generate false positives.
   Filter as needed.
diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
index 599381eae8..da73cf3f74 100644
--- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml
+++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
@@ -19,14 +19,15 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime value
   OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`")
   | `security_content_ctime(firstTime)` | table firstTime dest, process_id, process_name,
   parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You should run
-  the baseline search `Previously Seen Zoom Child Processes - Initial` to build the
-  initial table of child processes and hostnames for this search to work. You should
-  also schedule at the same interval as this search the second baseline search `Previously
-  Seen Zoom Child Processes - Update` to keep this table up to date and to age out
-  old child processes. Please update the `previously_seen_zoom_child_processes_window`
-  macro to adjust the time window.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A new child process of zoom isn't malicious by that fact alone.
   Further investigation of the actions of the child process is needed to verify any
   malicious behavior is taken.
diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index 9d17855860..9ad97b0477 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -26,9 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited to no false positives are expected.
 references:
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml
index c65ada0d25..9289231b8f 100644
--- a/detections/endpoint/fsutil_zeroing_file.yml
+++ b/detections/endpoint/fsutil_zeroing_file.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name
   Processes.dest  Processes.process Processes.parent_process | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index 5a6e180ba4..a2fdcb0738 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml
index c1be54e364..92f51322ac 100644
--- a/detections/endpoint/get_aduser_with_powershell.yml
+++ b/detections/endpoint/get_aduser_with_powershell.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index 74f6ad4815..7d6f1b3828 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index 06ad12c543..8fc15c97a0 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_domainpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml
index a3199925af..1202de2603 100644
--- a/detections/endpoint/get_domaintrust_with_powershell.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives as this requires an active Administrator
   or adversary to bring in, import, and execute.
 references:
diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml
index a69dcb0935..f183e8973a 100644
--- a/detections/endpoint/get_domainuser_with_powershell.yml
+++ b/detections/endpoint/get_domainuser_with_powershell.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_domainuser_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml
index 1a1d8b30f6..cf6f0fc813 100644
--- a/detections/endpoint/get_foresttrust_with_powershell.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives as this requires an active Administrator
   or adversary to bring in, import, and execute.
 references:
diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml
index c066ec4271..685c7f7327 100644
--- a/detections/endpoint/get_wmiobject_group_discovery.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  |
   `get_wmiobject_group_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present. Tune as needed.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml
index 5c5ef96695..19043f9862 100644
--- a/detections/endpoint/getadcomputer_with_powershell.yml
+++ b/detections/endpoint/getadcomputer_with_powershell.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getadcomputer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml
index 3c785a734a..a2f8fce43d 100644
--- a/detections/endpoint/getadgroup_with_powershell.yml
+++ b/detections/endpoint/getadgroup_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getadgroup_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index 0df86d4dba..b6177b36ba 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml
index 37c636c336..9f9f085fae 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaincomputer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml
index 77f2801400..2c17fb0097 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaincontroller_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml
index c7cf9456c0..c4ae48b50e 100644
--- a/detections/endpoint/getdomaingroup_with_powershell.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaingroup_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index e3b5f91a89..6c1a849cbb 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getlocaluser_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this PowerShell commandlet
   for troubleshooting.
 references:
diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml
index d3c4024e38..fccd83abd9 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getnettcpconnection_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1049/
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
index 61e4242607..e7186b0fbc 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getwmiobject_ds_computer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
index b4cb319b6b..70fe7773dc 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
@@ -20,9 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getwmiobject_ds_group_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/002/
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
index 550807d3c0..fa35f83d20 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index 20c3549176..94485d445d 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this PowerShell commandlet
   for troubleshooting.
 references:
diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
index ea56bc7f6d..8eb69f5cb0 100644
--- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)`
   | rename dest as C2 ] | table _time dest parent_process_name process_name process_path
   process process_id dest_port C2 | `gpupdate_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
index 731f2ddba4..6e84a7e296 100644
--- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) values(Proce
   (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user
   Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
   `hiding_files_and_directories_with_attrib_exe_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: 'Some applications and users may legitimately use attrib.exe
   to interact with the files. '
 references: []
diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml
index f2f43b89bc..0eaa841b67 100644
--- a/detections/endpoint/hunting_3cxdesktopapp_software.yml
+++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml
@@ -7,22 +7,36 @@ type: Hunting
 status: production
 data_source:
 - Sysmon Event ID 1
-description: The hunting analytic outlined below is designed to detect any version of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac or Windows systems. It is important to note that this particular analytic employs the Endpoint datamodel Processes node, which means that the file version information is not provided. Recently, 3CX has identified a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+description: The hunting analytic outlined below is designed to detect any version
+  of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac
+  or Windows systems. It is important to note that this particular analytic employs
+  the Endpoint datamodel Processes node, which means that the file version information
+  is not provided. Recently, 3CX has identified a vulnerability specifically in versions
+  18.12.407 and 18.12.416 of the desktop app.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=3CXDesktopApp.exe OR Processes.process_name="3CX Desktop App"
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=3CXDesktopApp.exe
+  OR Processes.process_name="3CX Desktop App" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: There may be false positives generated due to the reliance
+  on version numbers for identification purposes. Despite this limitation, the primary
+  goal of this approach is to aid in the detection of the software within the environment.
 references:
-  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
-  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
-  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
-  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
-  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
+- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+- https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
+- https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+- https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
+- https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
 tags:
   analytic_story:
   - 3CX Supply Chain Attack
@@ -51,11 +65,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -67,4 +81,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml
index f6724acbd8..ce12b9cb77 100644
--- a/detections/endpoint/icacls_deny_command.yml
+++ b/detections/endpoint/icacls_deny_command.yml
@@ -5,24 +5,30 @@ date: '2023-06-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This analytic identifies instances where an adversary modifies the security permissions of a particular file or directory. 
-  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
-  The purpose of this behavior is to actively evade detection and impede access to their associated files. 
-  By identifying these security permission changes, we can enhance our ability to detect and respond to potential threats, 
-  mitigating the impact of malicious activities on the system.
+description: This analytic identifies instances where an adversary modifies the security
+  permissions of a particular file or directory. This technique is frequently observed
+  in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. The
+  purpose of this behavior is to actively evade detection and impede access to their
+  associated files. By identifying these security permission changes, we can enhance
+  our ability to detect and respond to potential threats, mitigating the impact of
+  malicious activities on the system.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
-  AND Processes.process IN ("*/deny*", "*/D*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `icacls_deny_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
+  "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/deny*", "*/D*") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process Processes.process_guid
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
   Filter as needed.
 references:
diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml
index c69495075f..24762d6160 100644
--- a/detections/endpoint/icacls_grant_command.yml
+++ b/detections/endpoint/icacls_grant_command.yml
@@ -5,24 +5,31 @@ date: '2023-06-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This analytic identifies adversaries who manipulate the security permissions of specific files or directories by granting additional access. 
-  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
-  The objective behind this behavior is to actively evade detection mechanisms and tightly control access to their associated files. 
-  By identifying these security permission modifications, we can improve our ability to identify and respond to potential threats, 
-  thereby minimizing the impact of malicious activities on the system.
+description: This analytic identifies adversaries who manipulate the security permissions
+  of specific files or directories by granting additional access. This technique is
+  frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and
+  coinminer scripts. The objective behind this behavior is to actively evade detection
+  mechanisms and tightly control access to their associated files. By identifying
+  these security permission modifications, we can improve our ability to identify
+  and respond to potential threats, thereby minimizing the impact of malicious activities
+  on the system.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
-  AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `icacls_grant_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
+  "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process Processes.process_guid
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index d1509ccfed..b10ea70ef9 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -21,9 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools
   to start a process on remote systems for system administration or automation use
   cases.
diff --git a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
index a8cc6c1b7b..c484bc31f9 100644
--- a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
@@ -26,11 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   AND match(process, "(?i)\\__output") AND  match(process, "(?i)C:\\\\Windows\\\\[a-zA-Z]{1,8}\\.bat")  AND
   match(process, "\\\\127\.0\.0\.1\\.*") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `impacket_lateral_movement_smbexec_commandline_parameters_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools
   to start a process on remote systems for system administration or automation use
   cases.
diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
index 454dbc77b0..85498e3800 100644
--- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process, "\\\\127\.0\.0\.1\\.*")
   AND match(process, "__\\d{1,10}\\.\\d{1,10}") | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `impacket_lateral_movement_wmiexec_commandline_parameters_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools
   to start a process on remote systems for system administration or automation use
   cases.
diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml
index 067a9e53fc..4185a144fd 100644
--- a/detections/endpoint/jscript_execution_using_cscript_app.yml
+++ b/detections/endpoint/jscript_execution_using_cscript_app.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml
index ff3f911e64..f1272c01f2 100644
--- a/detections/endpoint/linux_add_user_account.yml
+++ b/detections/endpoint/linux_add_user_account.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
index d67a345562..cafffa0068 100644
--- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
+++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
@@ -5,7 +5,20 @@ date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic identifies suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. This command line parameter can be abused by malware like Industroyer2, as well as adversaries and red teamers, to add a crontab entry for executing their malicious code on a schedule of their choice. However, it's important to note that administrators or normal users may also use this command for legitimate automation purposes, so filtering is required to minimize false positives. Identifying the modification of cron jobs using list parameters is valuable for a SOC as it indicates potential malicious activity or an attempt to establish persistence on the system. If a true positive is detected, further investigation should be conducted to analyze the added cron job, its associated command, and the impact it may have on the system. This includes examining the purpose of the job, reviewing any on-disk artifacts, and identifying any related processes or activities occurring concurrently. The impact of a true positive can range from unauthorized execution of malicious code to data destruction or other damaging outcomes.
+description: The following analytic identifies suspicious modifications to cron jobs
+  on Linux systems using the crontab command with list parameters. This command line
+  parameter can be abused by malware like Industroyer2, as well as adversaries and
+  red teamers, to add a crontab entry for executing their malicious code on a schedule
+  of their choice. However, it's important to note that administrators or normal users
+  may also use this command for legitimate automation purposes, so filtering is required
+  to minimize false positives. Identifying the modification of cron jobs using list
+  parameters is valuable for a SOC as it indicates potential malicious activity or
+  an attempt to establish persistence on the system. If a true positive is detected,
+  further investigation should be conducted to analyze the added cron job, its associated
+  command, and the impact it may have on the system. This includes examining the purpose
+  of the job, reviewing any on-disk artifacts, and identifying any related processes
+  or activities occurring concurrently. The impact of a true positive can range from
+  unauthorized execution of malicious code to data destruction or other damaging outcomes.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,10 +27,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_adding_crontab_using_list_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml
index 5acd896323..6b7c502f7a 100644
--- a/detections/endpoint/linux_apt_get_privilege_escalation.yml
+++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_apt_get_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/apt-get/
diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml
index e0273a329c..ebe77ca992 100644
--- a/detections/endpoint/linux_apt_privilege_escalation.yml
+++ b/detections/endpoint/linux_apt_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_apt_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/apt/
diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml
index 860e22b911..5dcbd58a75 100644
--- a/detections/endpoint/linux_at_application_execution.yml
+++ b/detections/endpoint/linux_at_application_execution.yml
@@ -5,11 +5,29 @@ date: '2022-05-26'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. The "At" application can be used for automation purposes by administrators or network operators, so the filter macros should be updated to remove false positives. If a true positive is found, it suggests an attacker is trying to maintain access to the environment or potentially deliver additional malicious payloads, leading to data theft, ransomware, or other damaging outcomes. To implement this analytic, ensure you are ingesting logs with the required fields from your endpoints into the Endpoint datamodel. When a true positive is detected, it suggests that an attacker is attempting to establish persistence or deliver additional malicious payloads by leveraging the "At" application. This behavior can lead to data theft, ransomware attacks, or other damaging outcomes.\
+description: 'The following analytic detects the execution of the "At" application
+  in Linux, which can be used by attackers to create persistence entries on a compromised
+  host. The "At" application can be used for automation purposes by administrators
+  or network operators, so the filter macros should be updated to remove false positives.
+  If a true positive is found, it suggests an attacker is trying to maintain access
+  to the environment or potentially deliver additional malicious payloads, leading
+  to data theft, ransomware, or other damaging outcomes. To implement this analytic,
+  ensure you are ingesting logs with the required fields from your endpoints into
+  the Endpoint datamodel. When a true positive is detected, it suggests that an attacker
+  is attempting to establish persistence or deliver additional malicious payloads
+  by leveraging the "At" application. This behavior can lead to data theft, ransomware
+  attacks, or other damaging outcomes.\
 
-  During triage, the SOC analyst should review the context surrounding the execution of the "At" application. This includes identifying the user, the parent process responsible for invoking the application, and the specific command-line arguments used. It is important to consider whether the execution is expected behavior by an administrator or network operator for legitimate automation purposes.\
+  During triage, the SOC analyst should review the context surrounding the execution
+  of the "At" application. This includes identifying the user, the parent process
+  responsible for invoking the application, and the specific command-line arguments
+  used. It is important to consider whether the execution is expected behavior by
+  an administrator or network operator for legitimate automation purposes.\
 
-  The presence of "At" application execution may indicate an attacker's attempt to maintain unauthorized access to the environment. Immediate investigation and response are necessary to mitigate further risks, identify the attacker's intentions, and prevent potential harm to the organization.
+  The presence of "At" application execution may indicate an attacker''s attempt to
+  maintain unauthorized access to the environment. Immediate investigation and response
+  are necessary to mitigate further risks, identify the attacker''s intentions, and
+  prevent potential harm to the organization.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
@@ -18,10 +36,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml
index 016a6cb7a1..db5be8ea15 100644
--- a/detections/endpoint/linux_awk_privilege_escalation.yml
+++ b/detections/endpoint/linux_awk_privilege_escalation.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml
index b3f16f5612..0f1ac020cc 100644
--- a/detections/endpoint/linux_busybox_privilege_escalation.yml
+++ b/detections/endpoint/linux_busybox_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/busybox/
diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml
index b1339692e7..d8993916ce 100644
--- a/detections/endpoint/linux_c89_privilege_escalation.yml
+++ b/detections/endpoint/linux_c89_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/c89/
diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml
index dfb69c07ee..582ceab9e3 100644
--- a/detections/endpoint/linux_c99_privilege_escalation.yml
+++ b/detections/endpoint/linux_c99_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/c99/
diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index 3c4651c0f0..4ff236afcb 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml
index 8d5352bb3d..beee11a1c3 100644
--- a/detections/endpoint/linux_clipboard_data_copy.yml
+++ b/detections/endpoint/linux_clipboard_data_copy.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_clipboard_data_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present on Linux desktop as it may commonly
   be used by administrators or end users. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml
index 2794658c8c..5dbc05670b 100644
--- a/detections/endpoint/linux_common_process_for_elevation_control.yml
+++ b/detections/endpoint/linux_common_process_for_elevation_control.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml
index 707581f208..212eabd753 100644
--- a/detections/endpoint/linux_composer_privilege_escalation.yml
+++ b/detections/endpoint/linux_composer_privilege_escalation.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/composer/
diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml
index 7f946ff8ef..bdb8b5fd9d 100644
--- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml
+++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_cpulimit_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/cpulimit/
diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml
index f97e2000a1..92fd5845b2 100644
--- a/detections/endpoint/linux_csvtool_privilege_escalation.yml
+++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/csvtool/
diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml
index b107ccd8f8..81e0fa4e59 100644
--- a/detections/endpoint/linux_curl_upload_file.yml
+++ b/detections/endpoint/linux_curl_upload_file.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_curl_upload_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering may be required. In addition to AWS credentials,
   add other important files and monitor. The inverse would be to look for _all_ -F
   behavior and tune from there.
diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml
index 187250dd13..5c26de4ae1 100644
--- a/detections/endpoint/linux_data_destruction_command.yml
+++ b/detections/endpoint/linux_data_destruction_command.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://cert.gov.ua/article/3718487
diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml
index deaa7cba46..7d461a9387 100644
--- a/detections/endpoint/linux_dd_file_overwrite.yml
+++ b/detections/endpoint/linux_dd_file_overwrite.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml
index 892d4d83c6..c5c0913a9c 100644
--- a/detections/endpoint/linux_decode_base64_to_shell.yml
+++ b/detections/endpoint/linux_decode_base64_to_shell.yml
@@ -15,11 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_decode_base64_to_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present based on legitimate software
   being utilized. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
index a57e53a19f..6fdfe7bb52 100644
--- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
+++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_deleting_critical_directory_using_rm_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml
index 20bf9f5c6d..55bb168eeb 100644
--- a/detections/endpoint/linux_disable_services.yml
+++ b/detections/endpoint/linux_disable_services.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_disable_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml
index f263f327ff..dc83c6999d 100644
--- a/detections/endpoint/linux_doas_tool_execution.yml
+++ b/detections/endpoint/linux_doas_tool_execution.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_doas_tool_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml
index f3245bb3e6..116d6c3826 100644
--- a/detections/endpoint/linux_docker_privilege_escalation.yml
+++ b/detections/endpoint/linux_docker_privilege_escalation.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
index a426c53022..5c512b87d7 100644
--- a/detections/endpoint/linux_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -5,13 +5,25 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic detects the suspicious editing of cron jobs in Linux via the crontab command-line parameter. This tactic could be used by adversaries or malware to schedule execution of their malicious code, potentially leading to system compromise or unauthorized persistent access. It pinpoints this activity by monitoring command-line executions involving 'crontab' and the edit parameter (-e).\
+description: 'The following analytic detects the suspicious editing of cron jobs in
+  Linux via the crontab command-line parameter. This tactic could be used by adversaries
+  or malware to schedule execution of their malicious code, potentially leading to
+  system compromise or unauthorized persistent access. It pinpoints this activity
+  by monitoring command-line executions involving ''crontab'' and the edit parameter
+  (-e).\
 
-  Recognizing such activity is vital for a SOC as cron job manipulations might signal unauthorized persistence attempts or scheduled malicious actions, potentially resulting in substantial harm. A true positive signifies an active threat, with implications ranging from unauthorized access to broader network compromise.\
+  Recognizing such activity is vital for a SOC as cron job manipulations might signal
+  unauthorized persistence attempts or scheduled malicious actions, potentially resulting
+  in substantial harm. A true positive signifies an active threat, with implications
+  ranging from unauthorized access to broader network compromise.\
 
-  To implement this analytic, logs capturing process name, parent process, and command-line executions from your endpoints must be ingested.\
+  To implement this analytic, logs capturing process name, parent process, and command-line
+  executions from your endpoints must be ingested.\
 
-  Known false positives could stem from valid administrative tasks or automation processes using crontab. To reduce these, fine-tune the filter macros according to the benign activities within your environment. These adjustments ensure legitimate actions aren't mistaken for threats, allowing analysts to focus on genuine potential risks.\
+  Known false positives could stem from valid administrative tasks or automation processes
+  using crontab. To reduce these, fine-tune the filter macros according to the benign
+  activities within your environment. These adjustments ensure legitimate actions
+  aren''t mistaken for threats, allowing analysts to focus on genuine potential risks.\'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -20,10 +32,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml
index 963a3f94e5..7def3206d2 100644
--- a/detections/endpoint/linux_emacs_privilege_escalation.yml
+++ b/detections/endpoint/linux_emacs_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/emacs/
diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml
index d61492540a..2c32cee058 100644
--- a/detections/endpoint/linux_find_privilege_escalation.yml
+++ b/detections/endpoint/linux_find_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml
index b940431f7f..baf12b24ec 100644
--- a/detections/endpoint/linux_gdb_privilege_escalation.yml
+++ b/detections/endpoint/linux_gdb_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_gdb_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/gdb/
diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml
index f10fd858e7..c21647a002 100644
--- a/detections/endpoint/linux_gem_privilege_escalation.yml
+++ b/detections/endpoint/linux_gem_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/gem/
diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
index 3053320692..e3e12d70ee 100644
--- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
+++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/gawk/
diff --git a/detections/endpoint/linux_hardware_addition_swapoff.yml b/detections/endpoint/linux_hardware_addition_swapoff.yml
index 0fb0b9eb7f..ee77fb55c0 100644
--- a/detections/endpoint/linux_hardware_addition_swapoff.yml
+++ b/detections/endpoint/linux_hardware_addition_swapoff.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_hardware_addition_swapoff_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrator may disable swapping of devices in a linux host.
   Filter is needed.
 references:
diff --git a/detections/endpoint/linux_impair_defenses_process_kill.yml b/detections/endpoint/linux_impair_defenses_process_kill.yml
index 87d6109b3e..7530857b1f 100644
--- a/detections/endpoint/linux_impair_defenses_process_kill.yml
+++ b/detections/endpoint/linux_impair_defenses_process_kill.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `linux_impair_defenses_process_kill_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network admin can terminate a process using this linux command.
   Filter is needed.
 references:
diff --git a/detections/endpoint/linux_indicator_removal_clear_cache.yml b/detections/endpoint/linux_indicator_removal_clear_cache.yml
index 44fb1bdb27..f31e64db3f 100644
--- a/detections/endpoint/linux_indicator_removal_clear_cache.yml
+++ b/detections/endpoint/linux_indicator_removal_clear_cache.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `linux_indicator_removal_clear_cache_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
diff --git a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
index 05b1c5bd5f..4a99cb6e7e 100644
--- a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
+++ b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `linux_indicator_removal_service_file_deletion_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network admin can delete services unit configuration file as
   part of normal software installation. Filter is needed.
 references:
diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
index 1ea4bfeee4..48fe8fba14 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_ingress_tool_transfer_hunting_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present. This query is meant to help
   tune other curl and wget analytics.
 references:
diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
index fcd4f6300f..f337572bab 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
   match(process, "(?i)(-O|-sO|-ksO|--output)") | `linux_ingress_tool_transfer_with_curl_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present. Tune and then change type
   to TTP.
 references:
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
index e9e5ba5b43..d5c18f3b12 100644
--- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_insert_kernel_module_using_insmod_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index d1b1e111aa..47d00207fc 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml
index 0d654cad50..0b0d3847e1 100644
--- a/detections/endpoint/linux_iptables_firewall_modification.yml
+++ b/detections/endpoint/linux_iptables_firewall_modification.yml
@@ -26,10 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user
   Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrator may do this commandline for auditing and testing
   purposes. In this scenario filter is needed.
 references:
diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml
index 607f672ed5..b0eca339aa 100644
--- a/detections/endpoint/linux_java_spawning_shell.yml
+++ b/detections/endpoint/linux_java_spawning_shell.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_spawning_shell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly.
-  Add any additional java process names for your environment to the analytic as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering may be required on internal developer build systems
   or classify assets as web facing and restrict the analytic based on asset type.
 references:
diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml
index d61ec44983..8278984606 100644
--- a/detections/endpoint/linux_kernel_module_enumeration.yml
+++ b/detections/endpoint/linux_kernel_module_enumeration.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_kernel_module_enumeration_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
index f67bcaf44f..f80f642295 100644
--- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
+++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_path Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_kworker_process_in_writable_process_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml
index b6b5d1f638..0999b4b664 100644
--- a/detections/endpoint/linux_make_privilege_escalation.yml
+++ b/detections/endpoint/linux_make_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/make/
diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml
index 68efd4db49..dcae35901e 100644
--- a/detections/endpoint/linux_mysql_privilege_escalation.yml
+++ b/detections/endpoint/linux_mysql_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
index 6a2205773b..400625bee9 100644
--- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
+++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_ngrok_reverse_proxy_usage_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if Ngrok is an authorized utility.
   Filter as needed.
 references:
diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml
index 800d9d88ec..53bd573330 100644
--- a/detections/endpoint/linux_node_privilege_escalation.yml
+++ b/detections/endpoint/linux_node_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_node_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 4ffad566fa..9b6dfa7797 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_nopasswd_entry_in_sudoers_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
index 3002f20059..49332decc7 100644
--- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
+++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_obfuscated_files_or_information_base64_decode_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and will require some tuning
   based on processes. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml
index 6e57465cf2..16f7960fb5 100644
--- a/detections/endpoint/linux_octave_privilege_escalation.yml
+++ b/detections/endpoint/linux_octave_privilege_escalation.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_octave_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/octave/
diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml
index 77cd3cb525..f959cda5d9 100644
--- a/detections/endpoint/linux_openvpn_privilege_escalation.yml
+++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/openvpn/
diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml
index b9947d1c00..b90ab3924a 100644
--- a/detections/endpoint/linux_php_privilege_escalation.yml
+++ b/detections/endpoint/linux_php_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/php/
diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml
index 49c8e1c81e..4d85720fea 100644
--- a/detections/endpoint/linux_pkexec_privilege_escalation.yml
+++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml
@@ -16,14 +16,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_path
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(^.{1}$)" | `linux_pkexec_privilege_escalation_filter`'
-how_to_implement: Depending on the EDR product in use, there are multiple ways to
-  "null" the command-line field, Processes.process. Two that may be useful `process="(^.{0}$)"`
-  or `| where isnull(process)`. To generate data for this behavior, Sysmon for Linux
-  was utilized. To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/
diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index a392f93461..87de975185 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml
index 9d0619a57b..a69534ac14 100644
--- a/detections/endpoint/linux_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_possible_access_to_credential_files.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
index 0c0307a887..0d3823ec91 100644
--- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
index 2e3a0368bd..4cc2f24398 100644
--- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
@@ -5,9 +5,16 @@ date: '2022-05-26'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command.\
+description: 'The following analytic is designed to identify suspicious command lines
+  that may append user entries to either /etc/at.allow or /etc/at.deny. These files
+  can be exploited by malicious actors for persistence on a compromised Linux host
+  by altering permissions for scheduled tasks using the at command.\
 
-  In this context, an attacker can create a user or add an existing user to these configuration files to execute their malicious code through scheduled tasks. The detection of such anomalous behavior can serve as an effective indicator warranting further investigation to validate if the activity is indeed malicious or a false positive.
+  In this context, an attacker can create a user or add an existing user to these
+  configuration files to execute their malicious code through scheduled tasks. The
+  detection of such anomalous behavior can serve as an effective indicator warranting
+  further investigation to validate if the activity is indeed malicious or a false
+  positive.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
@@ -16,10 +23,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_possible_append_command_to_at_allow_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 74dbe3a880..4df883fe56 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_profile_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
index 0df7fc5f30..206c016f04 100644
--- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
@@ -5,11 +5,22 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic is designed to detect potential tampering with cronjob files on a Linux system. It specifically searches for command lines that may be used to append code to existing cronjob files, a technique often employed by adversaries, malware, and red teamers for persistence or privilege escalation. Altering existing or sometimes normal cronjob script files allows malicious code to be executed automatically.\
+description: 'The following analytic is designed to detect potential tampering with
+  cronjob files on a Linux system. It specifically searches for command lines that
+  may be used to append code to existing cronjob files, a technique often employed
+  by adversaries, malware, and red teamers for persistence or privilege escalation.
+  Altering existing or sometimes normal cronjob script files allows malicious code
+  to be executed automatically.\
 
-  The analytic operates by monitoring logs for specific process names, parent processes, and command-line executions from your endpoints. It specifically checks for any 'echo' command which modifies files in directories commonly associated with cron jobs such as '/etc/cron*', '/var/spool/cron/', and '/etc/anacrontab'. If such activity is detected, an alert is triggered.\
+  The analytic operates by monitoring logs for specific process names, parent processes,
+  and command-line executions from your endpoints. It specifically checks for any
+  ''echo'' command which modifies files in directories commonly associated with cron
+  jobs such as ''/etc/cron*'', ''/var/spool/cron/'', and ''/etc/anacrontab''. If such
+  activity is detected, an alert is triggered.\
 
-  This behavior is worth identifying for a SOC because malicious cron jobs can lead to system compromises and unauthorized data access, impacting business operations and data integrity.
+  This behavior is worth identifying for a SOC because malicious cron jobs can lead
+  to system compromises and unauthorized data access, impacting business operations
+  and data integrity.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
@@ -18,11 +29,18 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes. Therefore, it's recommended to adjust filter macros to eliminate such false positives.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may arise from legitimate actions by administrators
+  or network operators who may use these commands for automation purposes. Therefore,
+  it's recommended to adjust filter macros to eliminate such false positives.
 references:
 - https://attack.mitre.org/techniques/T1053/003/
 - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
index 959cdb9076..341285302e 100644
--- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
+++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
@@ -5,14 +5,27 @@ date: '2021-12-17'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic detects potential unauthorized modifications to Linux cronjobs using text editors like "nano", "vi" or "vim". It identifies this behavior by tracking command-line executions that interact with paths related to cronjob configuration, a common Linux scheduling utility. Cronjob files may be manipulated by attackers for privilege escalation or persistent access, making such changes critical to monitor.\
-  The identified behavior is significant for a Security Operations Center (SOC) as it could indicate an ongoing attempt at establishing persistent access or privilege escalation, leading to data breaches, system compromise, or other malicious activities.\
+description: 'The following analytic detects potential unauthorized modifications
+  to Linux cronjobs using text editors like "nano", "vi" or "vim". It identifies this
+  behavior by tracking command-line executions that interact with paths related to
+  cronjob configuration, a common Linux scheduling utility. Cronjob files may be manipulated
+  by attackers for privilege escalation or persistent access, making such changes
+  critical to monitor.\ The identified behavior is significant for a Security Operations
+  Center (SOC) as it could indicate an ongoing attempt at establishing persistent
+  access or privilege escalation, leading to data breaches, system compromise, or
+  other malicious activities.\
 
-  In case of a true positive, the impact could be severe. An attacker with escalated privileges or persistent access could carry out damaging actions, such as data theft, sabotage, or further network penetration.\
+  In case of a true positive, the impact could be severe. An attacker with escalated
+  privileges or persistent access could carry out damaging actions, such as data theft,
+  sabotage, or further network penetration.\
 
-  To implement this analytic, ensure ingestion of logs tracking process name, parent process, and command-line executions from your endpoints. Utilize the Add-on for Linux Sysmon from Splunkbase if you're using Sysmon.\
+  To implement this analytic, ensure ingestion of logs tracking process name, parent
+  process, and command-line executions from your endpoints. Utilize the Add-on for
+  Linux Sysmon from Splunkbase if you''re using Sysmon.\
 
-  Known false positives include legitimate administrative tasks, as these commands may also be used for benign purposes. Careful tuning and filtering based on known benign activity in your environment can minimize these instances.
+  Known false positives include legitimate administrative tasks, as these commands
+  may also be used for benign purposes. Careful tuning and filtering based on known
+  benign activity in your environment can minimize these instances.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -22,10 +35,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_possible_cronjob_modification_with_editor_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index a9b0eac93c..bc081670e9 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_preload_hijack_library_calls_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml
index b3381cf4ea..7ded4f6ea8 100644
--- a/detections/endpoint/linux_proxy_socks_curl.yml
+++ b/detections/endpoint/linux_proxy_socks_curl.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_proxy_socks_curl_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present based on proxy usage internally.
   Filter as needed.
 references:
diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml
index 0d1b277e69..8a2cbc67ee 100644
--- a/detections/endpoint/linux_puppet_privilege_escalation.yml
+++ b/detections/endpoint/linux_puppet_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/puppet/
diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml
index 98fd5d7d5a..9e8b7d2bb8 100644
--- a/detections/endpoint/linux_rpm_privilege_escalation.yml
+++ b/detections/endpoint/linux_rpm_privilege_escalation.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml
index 86e9573a31..6bc67a1f79 100644
--- a/detections/endpoint/linux_ruby_privilege_escalation.yml
+++ b/detections/endpoint/linux_ruby_privilege_escalation.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system
   administrative usage. Filter as needed.
 references:
diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml
index b9f0b94f2a..b22b3cf217 100644
--- a/detections/endpoint/linux_service_restarted.yml
+++ b/detections/endpoint/linux_service_restarted.yml
@@ -5,11 +5,25 @@ date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects the restarting or re-enabling of services in the Linux platform. It focuses on the use of the systemctl or service tools for executing these actions. Adversaries may leverage this technique to repeatedly execute malicious payloads as a form of persistence. Linux hosts typically start services during boot to perform background system functions. However, administrators may also create legitimate services for specific tools or applications as part of task automation. In such cases, it is recommended to verify the service path of the registered script or executable and identify the creator of the service for further validation.\
+description: 'The following analytic detects the restarting or re-enabling of services
+  in the Linux platform. It focuses on the use of the systemctl or service tools for
+  executing these actions. Adversaries may leverage this technique to repeatedly execute
+  malicious payloads as a form of persistence. Linux hosts typically start services
+  during boot to perform background system functions. However, administrators may
+  also create legitimate services for specific tools or applications as part of task
+  automation. In such cases, it is recommended to verify the service path of the registered
+  script or executable and identify the creator of the service for further validation.\
 
-  It's important to be aware that this analytic may generate false positives as administrators or network operators may use the same command-line for legitimate automation purposes. Filter macros should be updated accordingly to minimize false positives.\
+  It''s important to be aware that this analytic may generate false positives as administrators
+  or network operators may use the same command-line for legitimate automation purposes.
+  Filter macros should be updated accordingly to minimize false positives.\
 
-  Identifying restarted or re-enabled services is valuable for a SOC as it can indicate potential malicious activities attempting to maintain persistence or execute unauthorized actions on Linux systems. By detecting and investigating these events, security analysts can respond promptly to mitigate risks and prevent further compromise. The impact of a true positive can range from unauthorized access to data destruction or other damaging outcomes.
+  Identifying restarted or re-enabled services is valuable for a SOC as it can indicate
+  potential malicious activities attempting to maintain persistence or execute unauthorized
+  actions on Linux systems. By detecting and investigating these events, security
+  analysts can respond promptly to mitigate risks and prevent further compromise.
+  The impact of a true positive can range from unauthorized access to data destruction
+  or other damaging outcomes.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -19,10 +33,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and commandline executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml
index 6c02308a24..9dc4aff3bc 100644
--- a/detections/endpoint/linux_service_started_or_enabled.yml
+++ b/detections/endpoint/linux_service_started_or_enabled.yml
@@ -5,7 +5,16 @@ date: '2021-12-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects the creation or enabling of services in Linux platforms, specifically using the systemctl or service tool application. This behavior is worth identifying as adversaries may create or modify services to execute malicious payloads as part of persistence. Legitimate services created by administrators for automation purposes may also trigger this analytic, so it is important to update the filter macros to remove false positives. If a true positive is found, it suggests an possible attacker is attempting to persist within the environment or deliver additional malicious payloads, leading to data theft, ransomware, or other damaging outcomes. To implement this analytic, ensure you are ingesting logs with the process name, parent process, and command-line executions from your endpoints.
+description: The following analytic detects the creation or enabling of services in
+  Linux platforms, specifically using the systemctl or service tool application. This
+  behavior is worth identifying as adversaries may create or modify services to execute
+  malicious payloads as part of persistence. Legitimate services created by administrators
+  for automation purposes may also trigger this analytic, so it is important to update
+  the filter macros to remove false positives. If a true positive is found, it suggests
+  an possible attacker is attempting to persist within the environment or deliver
+  additional malicious payloads, leading to data theft, ransomware, or other damaging
+  outcomes. To implement this analytic, ensure you are ingesting logs with the process
+  name, parent process, and command-line executions from your endpoints.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -15,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml
index 08dae2f2d8..ce220faee8 100644
--- a/detections/endpoint/linux_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml
@@ -23,10 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml
index 367b8c9014..f8892ab7e2 100644
--- a/detections/endpoint/linux_setuid_using_setcap_utility.yml
+++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_setuid_using_setcap_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml
index 70d6c63322..be1e796716 100644
--- a/detections/endpoint/linux_shred_overwrite_command.yml
+++ b/detections/endpoint/linux_shred_overwrite_command.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shred_overwrite_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml
index 2f50dff9cf..df0bd543bf 100644
--- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml
+++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the
-  Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
 - https://gtfobins.github.io/gtfobins/sqlite3/
diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml
index 6f03caf8ee..21f284c034 100644
--- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml
+++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_ssh_authorized_keys_modification_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering will be required as system administrators will add
   and remove. One way to filter query is to add "echo".
 references:
diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml
index 35352e2568..85fe7ad393 100644
--- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml
+++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml
@@ -10,16 +10,21 @@ description: The following analytic identifies SSH being utilized to move latera
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `linux_ssh_remote_services_script_execute_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name=ssh
+  Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*")
+  AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_ssh_remote_services_script_execute_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This is not a common command to be executed. Filter as needed.
 references:
 - https://redcanary.com/blog/lateral-movement-with-secure-shell/
diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
index 63f81e93d2..ed4a9c072b 100644
--- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
+++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.dest Processes.user Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_stdout_redirection_to_dev_null_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml
index 5f6f7c3fe3..ef7d5cf552 100644
--- a/detections/endpoint/linux_stop_services.yml
+++ b/detections/endpoint/linux_stop_services.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stop_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application
   for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml
index 80de3d5ce2..52c5b98b2b 100644
--- a/detections/endpoint/linux_sudo_or_su_execution.yml
+++ b/detections/endpoint/linux_sudo_or_su_execution.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are
-  using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml
index 7902c25557..9ea3279453 100644
--- a/detections/endpoint/linux_system_network_discovery.yml
+++ b/detections/endpoint/linux_system_network_discovery.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss",
   "route") by _time span=30m Processes.dest Processes.user | where process_name_count
   >=4 | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml
index 79863b79b4..c1e7dd8e00 100644
--- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml
+++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_system_reboot_via_system_request_key_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
diff --git a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
index 8aa8c974c2..80328aa259 100644
--- a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
+++ b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_unix_shell_enable_all_sysrq_functions_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index 3bfe997a1a..4f19d7f2bc 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_visudo_utility_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index 3c8c5f122a..a087b61004 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `local_account_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1087/001/
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index dc05e0b7d6..db65a2142b 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1087/001/
diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/endpoint/macos___re_opened_applications.yml
index ed37ea99ca..2e1f31fe7e 100644
--- a/detections/endpoint/macos___re_opened_applications.yml
+++ b/detections/endpoint/macos___re_opened_applications.yml
@@ -15,11 +15,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `macos___re_opened_applications_filter`'
-how_to_implement: In order to properly run this search, Splunk needs to ingest process
-  data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf)
-  pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be
-  deployed across your indexers and universal forwarders in order to have the data
-  populate the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: At this stage, there are no known false positives. During testing,
   no process events refering the com.apple.loginwindow.plist files were observed during
   normal operation of re-opening applications on reboot. Therefore, it can be asumed
diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml
index d4fc0fb9e9..904d1ff783 100644
--- a/detections/endpoint/malicious_inprocserver32_modification.yml
+++ b/detections/endpoint/malicious_inprocserver32_modification.yml
@@ -30,11 +30,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime
   by dest, process_name registry_path registry_key_name registry_value_name user |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed. In our
   test case, Remcos used regsvr32.exe to modify the registry. It may be required,
   dependent upon the EDR tool producing registry events, to remove (Default) from
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index aac0b4a334..e260077dd4 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -27,11 +27,15 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime
   \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
   \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
   |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: System administrators may use this option, but it's not common.
 references:
 - https://regexr.com/662ov
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index 52222b5fef..6f27691472 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process_id)
   where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass
   *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
   policy. The PowerShell script being run with this parameter should be validated
   to ensure that it is legitimate.
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index ec019553b4..55657bd84b 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1)
   + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
   | search num_obfuscation > 10 '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: These characters might be legitimately on the command-line,
   but it is not common.
 references: []
diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
index fea008f71d..42fddb3d71 100644
--- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although highly unlikely, legitimate applications may use the
   same command line parameters as Mimikatz.
 references:
diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
index 0cfbb343a1..d7f006f0e0 100644
--- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
@@ -30,9 +30,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as
   needed.
 references:
diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
index f5c18a31af..a60dd5d8a6 100644
--- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
+++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name
   Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrators may use this command. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
index 6218e7cbcf..40354a5462 100644
--- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
+++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as developers do not spawn
   MSBuild via a WSH.
 references:
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index 7ad0efd2ef..b37510453b 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
   host.
 references:
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index 2c64bd8956..c609df4766 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_id Processes.parent_process_id |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `net_localgroup_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present. Tune as needed.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml
index b1e441fbf8..08ff5694f6 100644
--- a/detections/endpoint/network_connection_discovery_with_arp.yml
+++ b/detections/endpoint/network_connection_discovery_with_arp.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `network_connection_discovery_with_arp_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1049/
diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/endpoint/network_connection_discovery_with_net.yml
index 781e1ce56e..bfa3c325b3 100644
--- a/detections/endpoint/network_connection_discovery_with_net.yml
+++ b/detections/endpoint/network_connection_discovery_with_net.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1049/
diff --git a/detections/endpoint/network_connection_discovery_with_netstat.yml b/detections/endpoint/network_connection_discovery_with_netstat.yml
index 7696de1c66..953f9d241a 100644
--- a/detections/endpoint/network_connection_discovery_with_netstat.yml
+++ b/detections/endpoint/network_connection_discovery_with_netstat.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `network_connection_discovery_with_netstat_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1049/
diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml
index 4cfd7967e2..4220112e03 100644
--- a/detections/endpoint/network_discovery_using_route_windows_app.yml
+++ b/detections/endpoint/network_discovery_using_route_windows_app.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an
   automated host discovery application that may generate false positives or an amazon
   ec2 script that uses this application. Filter as needed.
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index de6fd0c2d6..5b2a2c75ce 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.original_file_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present. Filter as needed based
   on initial analysis.
 references:
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 9e596e4973..5c1032886e 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `nltest_domain_trust_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may use nltest for troubleshooting purposes,
   otherwise, rarely used.
 references:
diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml
index 8ea3ddb036..832b1795fb 100644
--- a/detections/endpoint/notepad_with_no_command_line_arguments.yml
+++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml
@@ -7,16 +7,31 @@ type: TTP
 status: production
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed.
-  From Microsoft, "The Sideload, SpawnDll, and Execute-Assembly commands spawn and inject into notepad.exe by default. The following query finds process creation events where the same process creates and injects into notepad.exe within 10 seconds."
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | regex process="(?i)(notepad\.exe.{0,4}$)" 
+description: The following analytic identifies behavior related to default SliverC2
+  framework where it will inject into Notepad.exe and spawn Notepad.exe with no command
+  line arguments. In testing, this is a common procedure for SliverC2 usage, however
+  may be modified or changed. From Microsoft, "The Sideload, SpawnDll, and Execute-Assembly
+  commands spawn and inject into notepad.exe by default. The following query finds
+  process creation events where the same process creates and injects into notepad.exe
+  within 10 seconds."
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe
+  AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | regex process="(?i)(notepad\.exe.{0,4}$)"
   | `notepad_with_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on organization endpoint behavior.
 references:
 - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
 - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors#Purple-Team-Section
@@ -26,7 +41,8 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ with no command line arguments.
   mitre_attack_id:
   - T1055
   observable:
@@ -50,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -66,4 +82,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 51f06bb2a1..89ed4f1088 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Highly possible Server Administrators will troubleshoot with
   ntdsutil.exe, generating false positives.
 references:
diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml
index 21befd15f6..ab38257c50 100644
--- a/detections/endpoint/office_application_spawn_regsvr32_process.yml
+++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/380662/0/html
diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index 60093ea33d..d4f83f7b4d 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
   Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://any.run/malware-trends/trickbot
diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index f026ef5d30..b013a5aa71 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -13,17 +13,22 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
-  Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe",
-  "chrome.exe","iexplore.exe","msedge.exe"))  by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances office application and browser may be
-  used.
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe",
+  "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name
+  IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))  by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `office_document_spawned_child_process_to_download_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Default browser not in the filter list.
 references:
 - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index d9aaaf0f52..9e80c568bb 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -17,16 +17,20 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
   = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe" OR Processes.parent_process_name
   = "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name
-  = "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe" OR  Processes.parent_process_name="Graph.exe" OR Processes.parent_process_name="winproj.exe") `process_cmd`
-  by Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.process_guid Processes.user Processes.dest Processes.original_file_name
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
-  | `office_product_spawn_cmd_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  = "onenoteim.exe" OR Processes.parent_process_name = "msaccess.exe" OR  Processes.parent_process_name="Graph.exe"
+  OR Processes.parent_process_name="winproj.exe") `process_cmd` by Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.process_guid
+  Processes.user Processes.dest Processes.original_file_name | `drop_dm_object_name("Processes")`
+  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: IT or network admin may create an document automation that
   will run shell script.
 references:
diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml
index 4d7563ff48..34a2e6fb88 100644
--- a/detections/endpoint/office_product_spawning_bitsadmin.yml
+++ b/detections/endpoint/office_product_spawning_bitsadmin.yml
@@ -21,15 +21,19 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
-  "msaccess.exe", "Graph.exe","winproj.exe") `process_bitsadmin` by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  "msaccess.exe", "Graph.exe","winproj.exe") `process_bitsadmin` by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 55f13dc9ed..61639c3c59 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -19,16 +19,20 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
-  `process_certutil` by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `office_product_spawning_certutil_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe",
+  "Graph.exe","winproj.exe") `process_certutil` by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml
index 73deb19398..43df33f0ae 100644
--- a/detections/endpoint/office_product_spawning_mshta.yml
+++ b/detections/endpoint/office_product_spawning_mshta.yml
@@ -20,15 +20,19 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe", "onenote.exe","onenotem.exe",
-  "msaccess.exe","Graph.exe","winproj.exe") `process_mshta` by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  "msaccess.exe","Graph.exe","winproj.exe") `process_mshta` by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://redcanary.com/threat-detection-report/threats/TA551/
diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
index a0f1fb6803..d116732dd5 100644
--- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
@@ -20,15 +20,19 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
-  "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_rundll32_with_no_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml
index 29c521a044..4d5508e44b 100644
--- a/detections/endpoint/office_product_spawning_windows_script_host.yml
+++ b/detections/endpoint/office_product_spawning_windows_script_host.yml
@@ -13,15 +13,20 @@ data_source:
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
-  "msaccess.exe","Graph.exe","winproj.exe") Processes.process_name IN ("wscript.exe", "cscript.exe") by Processes.dest
-  Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_windows_script_host_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  "msaccess.exe","Graph.exe","winproj.exe") Processes.process_name IN ("wscript.exe",
+  "cscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `office_product_spawning_windows_script_host_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present based on macro based approved
   documents in the organization. Filtering may be needed.
 references:
diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index b878783aba..a3dbffeed3 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -19,16 +19,20 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe")
-  `process_wmic` by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `office_product_spawning_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe",
+  "Graph.exe","winproj.exe") `process_wmic` by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
index 434afcd7f3..a381ec4131 100644
--- a/detections/endpoint/office_spawning_control.yml
+++ b/detections/endpoint/office_spawning_control.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `office_spawning_control_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present.
 references:
 - https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index a574a32798..aed025f33e 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -25,9 +25,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC]
   | table _time dest parent_process_name process_name process_path process connection_to_CNC
   dest_port| `outbound_network_connection_from_java_using_default_ports_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate Java applications may use perform outbound connections
   to these ports. Filter as needed
 references:
diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml
index 661f407d34..0537a7bf27 100644
--- a/detections/endpoint/password_policy_discovery_with_net.yml
+++ b/detections/endpoint/password_policy_discovery_with_net.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `password_policy_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml
index 60cd6a95aa..55491b6922 100644
--- a/detections/endpoint/permission_modification_using_takeown_app.yml
+++ b/detections/endpoint/permission_modification_using_takeown_app.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: takeown.exe is a normal windows application that may used by
   network operator.
 references:
diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml
index 4c2dcda256..9567b07bb4 100644
--- a/detections/endpoint/ping_sleep_batch_command.yml
+++ b/detections/endpoint/ping_sleep_batch_command.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator or network operator may execute this command.
   Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml
index fcabe6461d..31e70ecd7e 100644
--- a/detections/endpoint/possible_browser_pass_view_parameter.yml
+++ b/detections/endpoint/possible_browser_pass_view_parameter.yml
@@ -25,10 +25,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positive is quite limited. Filter is needed
 references:
 - https://www.nirsoft.net/utils/web_browser_password.html
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index 1adcaca163..da0b8f99b4 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -5,9 +5,16 @@ date: '2023-04-14'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to identify possible lateral movement attacks that involve the spawning of a PowerShell process as a child or grandchild process of commonly abused processes. These processes include services.exe, wmiprsve.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.\
+description: 'The following analytic is designed to identify possible lateral movement
+  attacks that involve the spawning of a PowerShell process as a child or grandchild
+  process of commonly abused processes. These processes include services.exe, wmiprsve.exe,
+  svchost.exe, wsmprovhost.exe, and mmc.exe.\
 
-  Such behavior is indicative of legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management, and the DCOM protocol being abused to start a process on a remote endpoint. This behavior is often seen during lateral movement techniques where adversaries or red teams abuse these services for lateral movement and remote code execution.
+  Such behavior is indicative of legitimate Windows features such as the Service Control
+  Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management,
+  and the DCOM protocol being abused to start a process on a remote endpoint. This
+  behavior is often seen during lateral movement techniques where adversaries or red
+  teams abuse these services for lateral movement and remote code execution.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -19,9 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may spawn PowerShell as a child process
   of the the identified processes. Filter as needed.
 references:
diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index afd14aa123..e35b169b15 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits)
   orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `potentially_malicious_code_on_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3
-  or above to apply the pretrained model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This model is an anomaly detector that identifies usage of
   APIs and scripting constructs that are correllated with malicious activity.  These
   APIs and scripting constructs are part of the programming langauge and advanced
diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index b434eb0b62..92cdaca570 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -22,11 +22,15 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime
   \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
   \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
   |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
 references:
diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 9d50af0797..c4b6435046 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -5,9 +5,9 @@ date: '2022-07-15'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: This search identifies a modification in registry to disable the
-  windows defender real time behavior monitoring. This event or technique is commonly
-  seen in RATs, bots, or Trojans to disable AV to evade detections.
+description: This search identifies a modification in registry to disable the windows
+  defender real time behavior monitoring. This event or technique is commonly seen
+  in RATs, bots, or Trojans to disable AV to evade detections.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.original_file_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives. However, tune based on scripts that
   may perform this action.
 references:
@@ -34,7 +38,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: Windows Defender Real-time Behavior Monitoring disabled on $dest$ 
+  message: Windows Defender Real-time Behavior Monitoring disabled on $dest$
   mitre_attack_id:
   - T1562.001
   - T1562
diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml
index b2c8dc9d94..408e11f005 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present. Tune as needed.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index 6baec62181..ccfa90e5f4 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_start_bitstransfer_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives. It is possible administrators will
   utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
   process or command-line arguments.
diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
index 39cb4c7537..3379fdbe8d 100644
--- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `prevent_automatic_repair_mode_using_bcdedit_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration ignore failure
   during testing and debugging.
 references:
diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index 7b372b51ef..ab6d1495a9 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, administrators may use wmi to execute commands
   for legitimate purposes.
 references: []
diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index 3231992cd0..f4b3b9e6b6 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process_name Processes.original_file_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `process_kill_base_on_file_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index 881ca3cd3a..d9a490d0d6 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.original_file_name Processes.process_name Processes.user Processes.dest
   |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.
diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index 2ee1221ffb..ddad2456ca 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id
   Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network operator may use this batch command to delete recursively
   a directory or files within directory
 references:
diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index 4051926fd2..8cb739224a 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -16,12 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process=*Services* by Processes.process_id Processes.dest Processes.process
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `reg_exe_manipulating_windows_services_registry_keys_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is unusual for a service to be created or modified by directly
   manipulating the registry. However, there may be legitimate instances of this behavior.
   It is important to validate and investigate, as appropriate.
diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
index 0ffd192375..4bb6eead6d 100644
--- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
   match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Other third part application may used this parameter but not
   so common in base windows environment.
 references:
diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
index 3743d62d8c..db02c34cdf 100644
--- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
+++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}")
   | `regsvr32_with_known_silent_switch_cmdline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: minimal. but network operator can use this application to load
   dll.
 references:
diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml
index 1c2e06e29a..5d3877de36 100644
--- a/detections/endpoint/remcos_client_registry_install_entry.yml
+++ b/detections/endpoint/remcos_client_registry_install_entry.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   dest user parent_process_name parent_process process_name process_path process registry_key_name
   registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`remcos_client_registry_install_entry_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/570
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://attack.mitre.org/software/S0332/
diff --git a/detections/endpoint/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml
index 2749375633..9a0abf3fde 100644
--- a/detections/endpoint/remote_desktop_process_running_on_system.yml
+++ b/detections/endpoint/remote_desktop_process_running_on_system.yml
@@ -16,14 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user
   Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter` '
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. The search requires you to identify systems that do not commonly
-  use remote desktop. You can use the included support search "Identify Systems Using
-  Remote Desktop" to identify these systems. After identifying them, you will need
-  to add the "common_rdp_source" category to that system using the Enterprise Security
-  Assets and Identities framework. This can be done by adding an entry in the assets.csv
-  file located in `SA-IdentityManagement/lookups`.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Remote Desktop may be used legitimately by users on the network.
 references: []
 tags:
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index 6943bcfa99..49658c595e 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may leverage DCOM to start a process on remote
   systems, but this activity is usually limited to a small set of hosts or users.
 references:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index a82c5b7e6e..378100fa4c 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `remote_process_instantiation_via_winrm_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
   a process on remote systems for system administration or automation use cases. However,
   this activity is usually limited to a small set of hosts or users.
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 56fee65ba6..aebe442a2b 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WinRM and WinRs to start a process
   on remote systems, but this activity is usually limited to a small set of hosts
   or users.
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 95eb915a58..c1722a0c20 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: The wmic.exe utility is a benign Windows application. It may
   be used legitimately by Administrators with these parameters for remote system administration,
   but it's relatively uncommon.
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 1833d4f7d9..db6115819a 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WWMI and powershell.exe to start
   a process on remote systems, but this activity is usually limited to a small set
   of hosts or users.
diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml
index 9a330407d2..5f2f4b5897 100644
--- a/detections/endpoint/remote_system_discovery_with_dsquery.yml
+++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `remote_system_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml
index 2de7076d43..628aff423a 100644
--- a/detections/endpoint/remote_system_discovery_with_net.yml
+++ b/detections/endpoint/remote_system_discovery_with_net.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml
index 27db19dd4f..23fbc224db 100644
--- a/detections/endpoint/remote_system_discovery_with_wmic.yml
+++ b/detections/endpoint/remote_system_discovery_with_wmic.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1018/
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index 8c50722c7f..e92b831bff 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -17,12 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product. Deprecated because duplicate of Remote Process Instantiation via
-  WMI.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may use this legitimately to gather info from
   remote systems. Filter as needed.
 references:
diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml
index 78d5d553da..8d7ac34b4e 100644
--- a/detections/endpoint/resize_shadowstorage_volume.yml
+++ b/detections/endpoint/resize_shadowstorage_volume.yml
@@ -23,10 +23,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process Processes.process_name Processes.process Processes.dest
   Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network admin can resize the shadowstorage for valid purposes.
 references:
 - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml
index 14e6f09d30..42e03be2aa 100644
--- a/detections/endpoint/revil_common_exec_parameter.yml
+++ b/detections/endpoint/revil_common_exec_parameter.yml
@@ -16,10 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `revil_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: third party tool may have same command line parameters as revil
   ransomware.
 references:
diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml
index 823932d4d2..7ab01e5dd9 100644
--- a/detections/endpoint/revil_registry_entry.yml
+++ b/detections/endpoint/revil_registry_entry.yml
@@ -25,10 +25,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   process_path process registry_key_name registry_path registry_value_name registry_value_data
   process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index 4a298022b1..829aeb2c8a 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -27,10 +27,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, legitimate applications may use the same
   command line parameters as Rubeus. Filter as needed.
 references:
diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml
index f2f91a88bc..14511932e0 100644
--- a/detections/endpoint/runas_execution_in_commandline.yml
+++ b/detections/endpoint/runas_execution_in_commandline.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an
   automated or manual execute this command that may generate false positives. filter
   is needed.
diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index b50b9325a3..4e8f6bbac2 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `rundll32_control_rundll_hunt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This is a hunting detection, meant to provide a understanding
   of how voluminous control_rundll is within the environment.
 references:
diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index d28137cd0f..e9eb1cdc8b 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `rundll32_control_rundll_world_writable_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This may be tuned, or a new one related, by adding .cpl to
   command-line. However, it's important to look for both. Tune/filter as needed.
 references:
diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml
index 128167f802..212fa1eb83 100644
--- a/detections/endpoint/rundll32_lockworkstation.yml
+++ b/detections/endpoint/rundll32_lockworkstation.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml
index 444c418c33..de08051a8f 100644
--- a/detections/endpoint/rundll32_shimcache_flush.yml
+++ b/detections/endpoint/rundll32_shimcache_flush.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://blueteamops.medium.com/shimcache-flush-89daff28d15e
diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
index 444db9572a..1bfe52fe6d 100644
--- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
@@ -24,13 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port
   FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host
   All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `rundll32_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
-  To successfully implement this search you need to be ingesting information on process
-  that include the name of the process responsible for the changes from your endpoints
-  into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the
-  latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 6867d4e118..80efc90be6 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") |
   `rundll_loading_dll_by_ordinal_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are possible with native utilities and third
   party applications. Filtering may be needed based on command-line, or add world
   writeable paths to restrict query.
diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index c1d2fe0d07..29a85e4c35 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -22,9 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `ryuk_wake_on_lan_command_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited to no known false positives.
 references:
 - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml
index c30a5db1ff..e87919ee87 100644
--- a/detections/endpoint/sc_exe_manipulating_windows_services.yml
+++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml
@@ -15,9 +15,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   config *") by Processes.process_name Processes.parent_process_name Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
   there may be legitimate instances of this behavior. It is important to validate
   and investigate as appropriate.
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 2c18760f2d..3f597ee292 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -5,9 +5,22 @@ date: '2021-11-11'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic detects the creation of suspicious tasks on a remote Windows endpoint using the at.exe command with command-line arguments. This technique is commonly used by red teams and adversaries for lateral movement and remote code execution. The at.exe binary leverages the deprecated AT protocol, which may still work on previous versions of Windows. Attackers can enable this protocol on demand by modifying a system registry key. It is important to consider potential false positives. While administrators may create scheduled tasks on remote systems, this activity is typically limited to a small set of hosts or users.\
+description: 'The following analytic detects the creation of suspicious tasks on a
+  remote Windows endpoint using the at.exe command with command-line arguments. This
+  technique is commonly used by red teams and adversaries for lateral movement and
+  remote code execution. The at.exe binary leverages the deprecated AT protocol, which
+  may still work on previous versions of Windows. Attackers can enable this protocol
+  on demand by modifying a system registry key. It is important to consider potential
+  false positives. While administrators may create scheduled tasks on remote systems,
+  this activity is typically limited to a small set of hosts or users.\
 
-  Identifying the creation of scheduled tasks on remote endpoints is crucial for a Security Operations Center (SOC) because it indicates potential unauthorized activity or an attacker attempting to establish persistence or execute malicious code. The impact of a true positive can be significant, leading to unauthorized access, data theft, or other damaging outcomes. During triage, investigate the source and purpose of the scheduled task, inspect relevant on-disk artifacts, and analyze concurrent processes to identify the extent of the attack and take appropriate response actions.
+  Identifying the creation of scheduled tasks on remote endpoints is crucial for a
+  Security Operations Center (SOC) because it indicates potential unauthorized activity
+  or an attacker attempting to establish persistence or execute malicious code. The
+  impact of a true positive can be significant, leading to unauthorized access, data
+  theft, or other damaging outcomes. During triage, investigate the source and purpose
+  of the scheduled task, inspect relevant on-disk artifacts, and analyze concurrent
+  processes to identify the extent of the attack and take appropriate response actions.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -16,9 +29,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may create scheduled tasks on remote systems,
   but this activity is usually limited to a small set of hosts or users.
 references:
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 8505c38fb5..ce195e5cb0 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -5,12 +5,15 @@ date: '2023-04-05'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
-description: This analytic focuses on identifying the creation or deletion of scheduled tasks using the schtasks.exe utility 
-  with the corresponding command-line flags (-create or -delete). This technique has been notably associated with threat actors 
-  like Dragonfly and the SUNBURST attack against SolarWinds. The purpose of this analytic is to detect suspicious activity 
-  related to scheduled tasks that could indicate malicious intent or unauthorized system manipulation. By monitoring for these 
-  specific command-line flags, we can enhance our ability to identify potential threats and prevent attacks similar to the use of 
-  scheduled tasks in the BadRabbit Ransomware incident.
+description: This analytic focuses on identifying the creation or deletion of scheduled
+  tasks using the schtasks.exe utility with the corresponding command-line flags (-create
+  or -delete). This technique has been notably associated with threat actors like
+  Dragonfly and the SUNBURST attack against SolarWinds. The purpose of this analytic
+  is to detect suspicious activity related to scheduled tasks that could indicate
+  malicious intent or unauthorized system manipulation. By monitoring for these specific
+  command-line flags, we can enhance our ability to identify potential threats and
+  prevent attacks similar to the use of scheduled tasks in the BadRabbit Ransomware
+  incident.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
@@ -19,12 +22,19 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
   Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives. Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: While it is possible for legitimate scripts or administrators
+  to trigger this behavior, filtering can be applied based on the parent process and
+  application to reduce false positives. Analysts should reference the provided references
+  to understand the context and threat landscape associated with this activity.
 references:
 - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 - https://www.joesandbox.com/analysis/691823/0/html
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index d6ff47aeeb..b61efd6c77 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -5,7 +5,14 @@ date: '2021-11-11'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: This analytic detects instances of 'schtasks.exe' being used to start a Scheduled Task on a remote endpoint. Adversaries often abuse the Task Scheduler for lateral movement and remote code execution. The search parameters include process details such as the process  name, parent process, and command-line executions. Although legitimate administrators may start scheduled tasks on remote systems, this activity is usually limited to a small set of hosts or users. The findings from this analytic provide valuable insight into potentially malicious activities on an endpoint.
+description: This analytic detects instances of 'schtasks.exe' being used to start
+  a Scheduled Task on a remote endpoint. Adversaries often abuse the Task Scheduler
+  for lateral movement and remote code execution. The search parameters include process
+  details such as the process  name, parent process, and command-line executions.
+  Although legitimate administrators may start scheduled tasks on remote systems,
+  this activity is usually limited to a small set of hosts or users. The findings
+  from this analytic provide valuable insight into potentially malicious activities
+  on an endpoint.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,9 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may start scheduled tasks on remote systems,
   but this activity is usually limited to a small set of hosts or users.
 references:
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index 8f66aec11e..1641839fa2 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -5,7 +5,12 @@ date: '2023-04-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to detect when a Windows Scheduled Task is executed on demand via shell or command line. Adversaries often force the execution of their created Scheduled Tasks for persistent access or lateral movement within a compromised machine. This analytic is driven by process-related data, specifically process name, parent process, and command-line executions, sourced from endpoint logs. The search criteria focus on 'schtasks.exe' with an associated 'run' command.
+description: The following analytic is designed to detect when a Windows Scheduled
+  Task is executed on demand via shell or command line. Adversaries often force the
+  execution of their created Scheduled Tasks for persistent access or lateral movement
+  within a compromised machine. This analytic is driven by process-related data, specifically
+  process name, parent process, and command-line executions, sourced from endpoint
+  logs. The search criteria focus on 'schtasks.exe' with an associated 'run' command.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -14,11 +19,18 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
-known_false_positives: Bear in mind, administrators debugging Scheduled Task entries may trigger this analytic, necessitating fine-tuning and filtering to distinguish between legitimate and potentially malicious use of 'schtasks.exe'.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Bear in mind, administrators debugging Scheduled Task entries
+  may trigger this analytic, necessitating fine-tuning and filtering to distinguish
+  between legitimate and potentially malicious use of 'schtasks.exe'.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index 0198e2799d..cd8c096ebe 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -5,7 +5,14 @@ date: '2022-05-23'
 author: David Dorsey, Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to detect suspicious command-line arguments executed through 'schtasks.exe' to create a scheduled task on a remote endpoint. The analytic scans process data, checking for instances where 'schtasks.exe' has been used with specific command-line flags that suggest an attempt at lateral movement or remote code execution, common techniques employed by adversaries and red teams. Key data points include the process name, the specific command line used, the parent process name, the target destination, and the user involved. Also, timestamp data gives context to when these activities occurred. 
+description: The following analytic is designed to detect suspicious command-line
+  arguments executed through 'schtasks.exe' to create a scheduled task on a remote
+  endpoint. The analytic scans process data, checking for instances where 'schtasks.exe'
+  has been used with specific command-line flags that suggest an attempt at lateral
+  movement or remote code execution, common techniques employed by adversaries and
+  red teams. Key data points include the process name, the specific command line used,
+  the parent process name, the target destination, and the user involved. Also, timestamp
+  data gives context to when these activities occurred.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,12 +21,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process="*/s*") by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: While it is possible to have false positives, due to legitimate
+  administrative tasks, these are usually limited and should still be validated and
+  investigated as appropriate.
 references: []
 tags:
   analytic_story:
diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index cbea55c8ed..ccb90527da 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -5,7 +5,15 @@ date: '2020-12-07'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
-description: The following analytic utilizes a Splunk query to pinpoint potential threats by monitoring the 'schtasks.exe' command-line usage. This particular command, especially when used in tandem with 'shutdown' and '/create' flags, can suggest an adversarial force intending to schedule unwarranted system reboots. The query focuses on endpoint process data and retrieves details such as the process name, the parent process name, the destination, and the user involved. Essential to the investigation are the earliest and latest timestamps of these events, providing an activity timeline. Data such as the targeted host and initiating user offer valuable context for analyst. 
+description: The following analytic utilizes a Splunk query to pinpoint potential
+  threats by monitoring the 'schtasks.exe' command-line usage. This particular command,
+  especially when used in tandem with 'shutdown' and '/create' flags, can suggest
+  an adversarial force intending to schedule unwarranted system reboots. The query
+  focuses on endpoint process data and retrieves details such as the process name,
+  the parent process name, the destination, and the user involved. Essential to the
+  investigation are the earliest and latest timestamps of these events, providing
+  an activity timeline. Data such as the targeted host and initiating user offer valuable
+  context for analyst.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
@@ -14,12 +22,18 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `schtasks_used_for_forcing_a_reboot_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: This analytic may also capture legitimate administrative activities such as system updates or maintenance tasks, which can be classified as false positives. Filter as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: This analytic may also capture legitimate administrative activities
+  such as system updates or maintenance tasks, which can be classified as false positives.
+  Filter as needed.
 references: []
 tags:
   analytic_story:
diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index bb8c2cda02..b5c3cc0f85 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -5,7 +5,18 @@ date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to detect the potential misuse of Windows Management Instrumentation (WMI) for malicious purposes. WMI can be utilized by adversaries to execute scripts, a method often employed for maintaining stealth while carrying out malicious activities. The process 'scrcons.exe', integral to executing WMI scripts, is primarily monitored by this analytic. The underlying threat lies in the fact that successful execution of a malicious script can lead to numerous negative outcomes, including system compromise, data exfiltration, or the establishment of persistence. It's essential for cybersecurity analysts to remain vigilant towards unexpected or isolated script executions via WMI, as such instances often signal suspicious activities or potential security breaches. Although uncommon, administrators may occasionally use WMI to launch scripts for legitimate purposes. Therefore, discerning malicious activities from benign ones is crucial in this context.
+description: The following analytic is designed to detect the potential misuse of
+  Windows Management Instrumentation (WMI) for malicious purposes. WMI can be utilized
+  by adversaries to execute scripts, a method often employed for maintaining stealth
+  while carrying out malicious activities. The process 'scrcons.exe', integral to
+  executing WMI scripts, is primarily monitored by this analytic. The underlying threat
+  lies in the fact that successful execution of a malicious script can lead to numerous
+  negative outcomes, including system compromise, data exfiltration, or the establishment
+  of persistence. It's essential for cybersecurity analysts to remain vigilant towards
+  unexpected or isolated script executions via WMI, as such instances often signal
+  suspicious activities or potential security breaches. Although uncommon, administrators
+  may occasionally use WMI to launch scripts for legitimate purposes. Therefore, discerning
+  malicious activities from benign ones is crucial in this context.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -13,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, administrators may use wmi to launch scripts
   for legitimate purposes. Filter as needed.
 references:
diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml
index edf8701718..1e55241179 100644
--- a/detections/endpoint/sdclt_uac_bypass.yml
+++ b/detections/endpoint/sdclt_uac_bypass.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   dest user parent_process_name parent_process process_name process_path process registry_key_name
   registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited to no false positives are expected.
 references:
 - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml
index 80e781d21a..d2a84ab1cf 100644
--- a/detections/endpoint/sdelete_application_execution.yml
+++ b/detections/endpoint/sdelete_application_execution.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `sdelete_application_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: user may execute and use this application
 references:
 - https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 6282e5a9f7..521121a156 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
   | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name
   process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
index 23317fc878..5accd51ed6 100644
--- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
+++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `secretdumps_offline_ntds_dumping_tool_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index 8c9c7dd6f3..f180e80462 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -37,11 +37,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be caused by Administrators resetting SPNs
   or querying for SPNs. Filter as needed.
 references:
diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml
index 4e7bb63c84..8640c5cb6d 100644
--- a/detections/endpoint/services_escalate_exe.yml
+++ b/detections/endpoint/services_escalate_exe.yml
@@ -25,8 +25,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `services_escalate_exe_filter`'
-how_to_implement: To successfully implement this search, you will need to ensure that
-  DNS data is populating the Network_Resolution data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as `services.exe` should
   never spawn a process from `ADMIN$`. Filter as needed.
 references:
diff --git a/detections/endpoint/services_lolbas_execution_process_spawn.yml b/detections/endpoint/services_lolbas_execution_process_spawn.yml
index 54f6922d45..35cafa383d 100644
--- a/detections/endpoint/services_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_lolbas_execution_process_spawn.yml
@@ -30,9 +30,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as
   needed.
 references:
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index a345fceaea..24c60b0206 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -22,10 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   dest user parent_process_name parent_process process_name process_path process registry_key_name
   registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may attempt to change the default execution
   policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
   or "bypass" as this search is designed to identify, would be unusual. Hits should
diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
index 150a54a207..be8dc202ce 100644
--- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
+++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified
 references: []
 tags:
diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml
index 972480b67d..17506eb9f0 100644
--- a/detections/endpoint/silentcleanup_uac_bypass.yml
+++ b/detections/endpoint/silentcleanup_uac_bypass.yml
@@ -23,10 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   process_path process registry_key_name registry_path registry_value_name registry_value_data
   process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://github.com/hfiref0x/UACME
diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml
index 895b812d07..909a5671d6 100644
--- a/detections/endpoint/single_letter_process_on_endpoint.yml
+++ b/detections/endpoint/single_letter_process_on_endpoint.yml
@@ -15,11 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   endExe = if(substr(process_name, -4) == ".exe", 1, 0) | search process_name_length=5
   AND endExe=1 | table count, firstTime, lastTime, dest, user, process, process_name
   | `single_letter_process_on_endpoint_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Single-letter executables are not always malicious. Investigate
   this activity with your normal incident-response process.
 references: []
diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml
index 8e8303bdeb..53526e61b2 100644
--- a/detections/endpoint/slui_runas_elevated.yml
+++ b/detections/endpoint/slui_runas_elevated.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as this is not commonly
   used by legitimate applications.
 references:
diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml
index 970b792cc5..039e57fff7 100644
--- a/detections/endpoint/slui_spawning_a_process.yml
+++ b/detections/endpoint/slui_spawning_a_process.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate.
   Filtering will be needed to ensure proper monitoring.
 references:
diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml
index dbe539ff7b..24a8fb1494 100644
--- a/detections/endpoint/spoolsv_spawning_rundll32.yml
+++ b/detections/endpoint/spoolsv_spawning_rundll32.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `spoolsv_spawning_rundll32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives have been identified. There are limited
   instances where `rundll32.exe` may be spawned by a legitimate print driver.
 references:
diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml
index e2b5685182..95e7339198 100644
--- a/detections/endpoint/suspicious_copy_on_system32.yml
+++ b/detections/endpoint/suspicious_copy_on_system32.yml
@@ -12,23 +12,25 @@ description: This analytic is to detect a suspicious copy of file from systemroo
   but this is really a anomaly that needs to be check within the network.
 data_source:
 - Sysmon Event ID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
   AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*")
-  AND Processes.process = "*copy*" 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id temp
-  | `drop_dm_object_name(Processes)` 
-  | eval splitted_commandline=split(process," ")
-  | eval first_cmdline=lower(mvindex(splitted_commandline,0))
-  | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%")
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  |`suspicious_copy_on_system32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  temp | `drop_dm_object_name(Processes)` | eval splitted_commandline=split(process,"
+  ") | eval first_cmdline=lower(mvindex(splitted_commandline,0)) | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%")
+  AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: every user may do this event but very un-ussual.
 references:
 - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index 43f0d0e2a4..1d8f33c8bf 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `suspicious_curl_network_connection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. Filter as needed.
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index ec10fa68a3..2d30524090 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 29a48aa774..888596ce00 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
index 7ccc09bd45..6f71e8fcb5 100644
--- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.dest Processes.user |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_icedid_rundll32_cmdline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: limitted. this parameter is not commonly used by windows application
   but can be used by the network operator.
 references:
diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
index d8085344d1..7f8eb4c13a 100644
--- a/detections/endpoint/suspicious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -22,9 +22,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by _time span=5m Processes.user Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| where
   distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/).
-  Please install this add-on to parse fields correctly and execute detection search.
-  Consider customizing the time window and threshold values according to your environment.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unless an administrator is using these commands to troubleshoot
   or audit a system, the execution of these commands should be monitored.
 references:
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 2b6dcd41d1..79fe61e185 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_microsoft_workflow_compiler_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of microsoft.workflow.compiler.exe, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 1abdf8ecf7..1a0d7dc84c 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances have been identified coming
   from native Microsoft utilities similar to SCCM.
 references:
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index b077b803e7..95be6f0226 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.dest Processes.original_file_name Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `suspicious_msbuild_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
   triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
   understand it's path usage. Visual Studio runs an instance out of a path that will
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 990348ae6e..36718b4ba3 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_msbuild_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of msbuild, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index 373a1cd15f..5ff76d6227 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   AND `process_msbuild` by Processes.dest Processes.parent_process Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 2faa81a092..29d4cea38a 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -21,10 +21,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_mshta_child_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index ef28b43cf6..c86d4c347b 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   OR Processes.parent_process_name=wmiprvse.exe) AND `process_mshta` by Processes.dest
   Processes.parent_process Processes.user Processes.original_file_name| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit
   this behavior, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 717d60d71d..bab9808487 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -37,9 +37,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |  `suspicious_plistbuddy_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate applications may use PlistBuddy to create or
   modify property lists and possibly generate false positives. Review the property
   list being modified or created to confirm.
diff --git a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml
index 2afd72ceac..04d64d4076 100644
--- a/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml
+++ b/detections/endpoint/suspicious_process_executed_from_container_file_filter.yml
@@ -5,16 +5,30 @@ date: '2023-06-13'
 author: Steven Dick
 status: production
 type: TTP
-description: This analytic identifies a suspicious process spawned by another process from within common container/archive file types. This technique was a common technique used by adversaries and malware to execute scripts or evade defenses. This TTP may detect some normal software installation or user behaviors where opening archive files is common.
+description: This analytic identifies a suspicious process spawned by another process
+  from within common container/archive file types. This technique was a common technique
+  used by adversaries and malware to execute scripts or evade defenses. This TTP may
+  detect some normal software installation or user behaviors where opening archive
+  files is common.
 data_source:
 - Sysmon 1
 - Windows Security 4688
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process Processes.user| `drop_dm_object_name(Processes)`| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?<file_name>[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?<process_name>.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*")
+  AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process
+  Processes.user| `drop_dm_object_name(Processes)`| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$"
+  | rex field=process "(?i).+\\\\(?<file_name>[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?<process_name>.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"|
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Various business process or userland applications and behavior.
 references:
 - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
@@ -24,12 +38,12 @@ tags:
   analytic_story:
   - Unusual Processes
   asset_type: Endpoint
-  confidence: 20 
+  confidence: 20
   impact: 80
   message: A suspicious process $process_name$ was launched from $file_name$ on $dest$.
   mitre_attack_id:
-  - T1204.002  
-  - T1036.008 
+  - T1204.002
+  - T1036.008
   observable:
   - name: dest
     type: Endpoint
@@ -49,9 +63,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.parent_process 
-  - Processes.process 
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.process
   - Processes.user
   risk_score: 16
   security_domain: endpoint
@@ -60,4 +74,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index 93419d33fe..d3748b72d3 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -5,12 +5,14 @@ date: '2023-06-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: This analytic identifies a suspicious processes running in file paths 
-  that are not typically associated with legitimate software. Adversaries often employ this technique 
-  to drop and execute malicious executables in accessible locations that do not require administrative privileges. 
-  By monitoring for processes running in such unconventional file paths, we can identify potential indicators of 
-  compromise and proactively respond to malicious activity. This analytic plays a crucial role in enhancing system 
-  security by pinpointing suspicious behaviors commonly associated with malware and unauthorized software execution.
+description: This analytic identifies a suspicious processes running in file paths
+  that are not typically associated with legitimate software. Adversaries often employ
+  this technique to drop and execute malicious executables in accessible locations
+  that do not require administrative privileges. By monitoring for processes running
+  in such unconventional file paths, we can identify potential indicators of compromise
+  and proactively respond to malicious activity. This analytic plays a crucial role
+  in enhancing system security by pinpointing suspicious behaviors commonly associated
+  with malware and unauthorized software execution.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
@@ -25,9 +27,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.parent_process Processes.process_path Processes.dest Processes.user |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_process_file_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may allow execution of specific binaries in
   non-standard paths. Filter as needed.
 references:
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index 4c5a58dda3..cecc8cbac0 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup
   process_id| table process_id dest] | `suspicious_reg_exe_process_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It's possible for system administrators to write scripts that
   exhibit this behavior. If this is the case, the search will need to be modified
   to filter them out.
@@ -38,7 +42,8 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to add a registry entry.
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 77296cf780..6088ebe792 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -6,25 +6,27 @@ author: Michael Haag, Splunk
 status: production
 type: TTP
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
-  by using non-standard file extensions to load DLLs. Upon investigating,
-  look for network connections to remote destinations (internal or external). Review
-  additional parrallel processes and child processes for additional activity.
+  by using non-standard file extensions to load DLLs. Upon investigating, look for
+  network connections to remote destinations (internal or external). Review additional
+  parrallel processes and child processes for additional activity.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*"))
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model. Tune the query by filtering additional extensions
-  found to be used by  legitimate processes. To successfully implement this search
-  you need to be ingesting information on process that include the name of the process
-  responsible for the changes from your endpoints into the `Endpoint` datamodel in
-  the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is
-  installed and the latest TA for the endpoint product.
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process
+  IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process
+  IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.original_file_name Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives with the query restricted to specified
   paths. Add more world writeable paths as tuning continues.
 references:
@@ -42,7 +44,9 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension. 
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard
+    file extension.
   mitre_attack_id:
   - T1218
   - T1218.010
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 1d8c98c32f..3b228eb74a 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This is likely to produce false positives and will require
   some filtering. Tune the query by adding command line paths to known good DLLs,
   or filtering based on parent process names.
@@ -44,8 +48,8 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 70
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL.
-    code
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to register a DLL. code
   mitre_attack_id:
   - T1218
   - T1218.011
diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
index e672e78c55..c8d52d74de 100644
--- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
 references:
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index e9cc80bd2e..f6c2b189c0 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: third party application may used this dll export name to execute
   function.
 references:
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index e1691ee157..3e36b2a28c 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_rundll32_startw_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use Start
   as a function and call it via the command line. Filter as needed.
 references:
diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 9c6c84890d..139049ce88 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -5,9 +5,17 @@ date: '2021-03-01'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: The following analytic, "Suspicious Scheduled Task from Public Directory", detects the registration of scheduled tasks aimed to execute a binary or script from public directories, a behavior often associated with malware deployment. It utilizes the Sysmon Event ID 1 data source, searching for instances where schtasks.exe is connected with the directories users\public, \programdata\, or \windows\temp and involves the /create command.\
+description: 'The following analytic, "Suspicious Scheduled Task from Public Directory",
+  detects the registration of scheduled tasks aimed to execute a binary or script
+  from public directories, a behavior often associated with malware deployment. It
+  utilizes the Sysmon Event ID 1 data source, searching for instances where schtasks.exe
+  is connected with the directories users\public, \programdata\, or \windows\temp
+  and involves the /create command.\
 
-  The registration of such scheduled tasks in public directories could suggest that an attacker is trying to maintain persistence or execute malicious scripts. If confirmed as a true positive, this could lead to data compromise, unauthorized access, and potential lateral movement within the network.
+  The registration of such scheduled tasks in public directories could suggest that
+  an attacker is trying to maintain persistence or execute malicious scripts. If confirmed
+  as a true positive, this could lead to data compromise, unauthorized access, and
+  potential lateral movement within the network.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -17,10 +25,19 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: The main source of false positives could be the legitimate use of scheduled tasks from these directories. Careful tuning of this search may be necessary to suit the specifics of your environment, reducing the rate of false positives.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: The main source of false positives could be the legitimate
+  use of scheduled tasks from these directories. Careful tuning of this search may
+  be necessary to suit the specifics of your environment, reducing the rate of false
+  positives.
 references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index d1ed4de967..ae4f0c218c 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
 references:
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index 4559abc30f..89ab275a7b 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `suspicious_sqlite3_lsquarantine_behavior_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown.
 references:
 - https://redcanary.com/blog/clipping-silver-sparrows-wings/
diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml
index 6fc603e530..1204fe9a7e 100644
--- a/detections/endpoint/suspicious_wevtutil_usage.yml
+++ b/detections/endpoint/suspicious_wevtutil_usage.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name
   Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: The wevtutil.exe application is a legitimate Windows event
   log utility. Administrators may use it to manage Windows event logs.
 references:
diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
index 67a706f9b9..ffcd2f2093 100644
--- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
@@ -5,7 +5,17 @@ date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic is designed to spot instances of 'svchost.exe' initiating a Living Off The Land Binaries and Scripts (LOLBAS) execution process. Often, adversaries manipulate Task Scheduler to execute code on remote endpoints, resulting in the spawning of a malicious command as a child process of 'svchost.exe'. By tracking child processes of 'svchost.exe' that align with the LOLBAS project, potential lateral movement activity can be detected. The analytic examines process details, including the process name, parent process, and command-line executions. A comprehensive list of LOLBAS processes is included in the search parameters. Although the analytic might catch legitimate applications exhibiting this behavior, these instances should be filtered accordingly. The findings from this analytic offer valuable insight into potentially malicious activities on an endpoint.
+description: The following analytic is designed to spot instances of 'svchost.exe'
+  initiating a Living Off The Land Binaries and Scripts (LOLBAS) execution process.
+  Often, adversaries manipulate Task Scheduler to execute code on remote endpoints,
+  resulting in the spawning of a malicious command as a child process of 'svchost.exe'.
+  By tracking child processes of 'svchost.exe' that align with the LOLBAS project,
+  potential lateral movement activity can be detected. The analytic examines process
+  details, including the process name, parent process, and command-line executions.
+  A comprehensive list of LOLBAS processes is included in the search parameters. Although
+  the analytic might catch legitimate applications exhibiting this behavior, these
+  instances should be filtered accordingly. The findings from this analytic offer
+  valuable insight into potentially malicious activities on an endpoint.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -23,9 +33,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as
   needed.
 references:
diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
index a1ee591c92..f8e47f7fd9 100644
--- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
+++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `system_info_gathering_using_dxdiag_application_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
-  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
-  latest TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This commandline can be used by a network administrator to
   audit host machine specifications. Thus, a filter is needed.
 references:
diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index 3e65a806ac..698e5db87c 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by dest | where dc_processes_by_dest > 2 | stats values(process) as process min(firstTime)
   as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators debugging servers
 references:
 - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index fe75a693bf..d6e94d08f6 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -24,9 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
   | `system_processes_run_from_unexpected_locations_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This detection may require tuning based on third party applications
   utilizing native Windows binaries in non-standard paths.
 references:
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index c6c42811f0..655dcfcf41 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `system_user_discovery_with_query_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 254b242051..d2ff52866b 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml
index 2e2d1bddd0..c7360cf772 100644
--- a/detections/endpoint/uninstall_app_using_msiexec.yml
+++ b/detections/endpoint/uninstall_app_using_msiexec.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown.
 references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
index c2e3517095..0156a6cbb9 100644
--- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
@@ -21,8 +21,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   where All_Traffic.dest_port = 88 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
   | `drop_dm_object_name(All_Traffic)` ] | table _time dest parent_process_name process_name
   process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting your
-  endpoint events and populating the Endpoint and Network data models.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Custom applications may leverage the Kerberos protocol. Filter
   as needed.
 references:
diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml
index 86d753a443..af40608681 100644
--- a/detections/endpoint/unload_sysmon_filter_driver.yml
+++ b/detections/endpoint/unload_sysmon_filter_driver.yml
@@ -17,12 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   |`unload_sysmon_filter_driver_filter`| table firstTime lastTime dest user count
   process_name process_id parent_process_name process'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro,
-  update this macro to filter out false positives.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown at the moment
 references:
 - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver
diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml
index 2170b2a707..97e3f4b0b1 100644
--- a/detections/endpoint/unusually_long_command_line.yml
+++ b/detections/endpoint/unusually_long_command_line.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process
   | `unusually_long_command_line_filter` |eval threshold = 3 | where maxlen > ((threshold*stdevperhost)
   + avgperhost)'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships, from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the process
-  field in the Endpoint data model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate applications start with long command lines.
 references: []
 tags:
diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml
index fede6de02d..7690063eea 100644
--- a/detections/endpoint/unusually_long_command_line___mltk.yml
+++ b/detections/endpoint/unusually_long_command_line___mltk.yml
@@ -17,16 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | apply cmdline_pdfmodel threshold=0.01 | rename "IsOutlier(processlen)" as isOutlier
   | search isOutlier > 0 | table firstTime lastTime user dest process_name process
   processlen count | `unusually_long_command_line___mltk_filter`'
-how_to_implement: You must be ingesting endpoint data that monitors command lines
-  and populates the Endpoint data model in the Processes node. The command-line arguments
-  are mapped to the "process" field in the Endpoint data model. In addition, MLTK
-  version >= 4.2 must be installed on your search heads, along with any required dependencies.
-  Finally, the support search "Baseline of Command Line Length - MLTK" must be executed
-  before this detection search, as it builds an ML model over the historical data
-  used by this search. It is important that this search is run in the same app context
-  as the associated support search, so that the model created by the support search
-  is available for use. You should periodically re-run the support search to rebuild
-  the model with the latest data available in your environment.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate applications use long command lines for installs
   or updates. You should review identified command lines for legitimacy. You may modify
   the first part of the search to omit legitimate command lines from consideration.
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml
index 7bf3c01aec..07651a87d0 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml
index c8aec9087c..2ed80eef38 100644
--- a/detections/endpoint/usn_journal_deletion.yml
+++ b/detections/endpoint/usn_journal_deletion.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | search process="*deletejournal*" AND process="*usn*" | `usn_journal_deletion_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: None identified
 references: []
 tags:
diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml
index d9558af4db..c058b8c86f 100644
--- a/detections/endpoint/vbscript_execution_using_wscript_app.yml
+++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/369332/0/html
diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml
index 12127e726d..b1ce99972b 100644
--- a/detections/endpoint/verclsid_clsid_execution.yml
+++ b/detections/endpoint/verclsid_clsid_execution.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `verclsid_clsid_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: windows can used this application for its normal COM object
   validation.
 references:
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 0068073ae8..d30d991020 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process
   Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Baseline your environment before production. It is possible
   build systems using IIS will spawn cmd.exe to perform a software build. Filter as
   needed.
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index 72c670c062..766264aaa0 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -16,9 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. Tune based on parent process names.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration.
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index fee4acfb1c..0e68b5c72a 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml
index fa7ba9bd52..d042f6bcca 100644
--- a/detections/endpoint/wget_download_and_bash_execution.yml
+++ b/detections/endpoint/wget_download_and_bash_execution.yml
@@ -17,12 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
-  modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
-  as needed to filter.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filtering may be
   required.
 references:
diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml
index a05fd1da3a..158c48557d 100644
--- a/detections/endpoint/windows_ad_dsrm_account_changes.yml
+++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml
@@ -7,28 +7,31 @@ type: TTP
 status: production
 data_source:
 - Sysmon Event ID 13
-description: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode)
-  account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be
- used in the same way as a local administrator account. This detection is looking for alterations to the behaviour 
- of the account via registry.  
+description: Aside from being used to promote genuine domain controllers, the DSRM
+  (Directory Services Restore Mode) account can be used to persist within a Domain.
+  A DC can be configured to allow the DSRM account to logon & be used in the same
+  way as a local administrator account. This detection is looking for alterations
+  to the behaviour of the account via registry.
 search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior"
   Registry.registry_value_data IN ("*1","*2") by Registry.action Registry.registry_path
   Registry.registry_value_data Registry.registry_value_type Registry.process_guid
-  | `drop_dm_object_name(Registry)`
-  | join type=outer process_guid [| tstats `security_content_summariesonly` count
-  FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name Processes.process
-  Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
-  | `drop_dm_object_name(Processes)`]
-  | table _time action dest user parent_process_name parent_process process_name process
-  process_guid registry_path registry_value_data registry_value_type | `windows_ad_dsrm_account_changes_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Disaster recovery events. 
+  | `drop_dm_object_name(Registry)` | join type=outer process_guid [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time action
+  dest user parent_process_name parent_process process_name process process_guid registry_path
+  registry_value_data registry_value_type | `windows_ad_dsrm_account_changes_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Disaster recovery events.
 references:
 - https://adsecurity.org/?p=1714
 tags:
@@ -68,4 +71,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index b37616845e..e962448b6e 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -22,9 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_adfind_exe_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, and command-line executions from your endpoints. If
-  you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: ADfind is a command-line tool for AD administration and management
   that is seen to be leveraged by various adversaries. Filter out legitimate administrator
   usage using the filter macro.
diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml
index 17c029e46b..6d21d14a53 100644
--- a/detections/endpoint/windows_apache_benchmark_binary.yml
+++ b/detections/endpoint/windows_apache_benchmark_binary.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_apache_benchmark_binary_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as there is a small subset
   of binaries that contain the original file name of ab.exe. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
index e99da55811..03e33e0ab9 100644
--- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
+++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter on DLL name or parent
   process.
 references:
diff --git a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
index f412e936af..39b07f00e9 100644
--- a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
+++ b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
@@ -7,22 +7,35 @@ status: production
 type: Anomaly
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies a potentially suspicious execution of the 'pkgmgr' process involving the use of an XML input file for package management.
-  The 'pkgmgr' process, though deprecated in modern Windows systems, was historically used for managing packages. The presence of an XML input file raises concerns about the nature of the executed command and its potential impact on the system.
-  Due to the deprecated status of 'pkgmgr' and the involvement of an XML file, this activity warrants careful investigation. XML files are commonly used for configuration and data exchange, making it crucial to ascertain the intentions and legitimacy of the command.
-  To ensure system security, it is recommended to use up-to-date package management utilities, such as DISM or PowerShell's PackageManagement module, and exercise caution when executing commands involving potentially sensitive operations or files.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where  Processes.process_name = pkgmgr.exe Processes.process = "*.xml*" NOT(Processes.parent_process_path IN("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "*:\\Program Files*"))
-  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+description: The following analytic identifies a potentially suspicious execution
+  of the 'pkgmgr' process involving the use of an XML input file for package management.
+  The 'pkgmgr' process, though deprecated in modern Windows systems, was historically
+  used for managing packages. The presence of an XML input file raises concerns about
+  the nature of the executed command and its potential impact on the system. Due to
+  the deprecated status of 'pkgmgr' and the involvement of an XML file, this activity
+  warrants careful investigation. XML files are commonly used for configuration and
+  data exchange, making it crucial to ascertain the intentions and legitimacy of the
+  command. To ensure system security, it is recommended to use up-to-date package
+  management utilities, such as DISM or PowerShell's PackageManagement module, and
+  exercise caution when executing commands involving potentially sensitive operations
+  or files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  Processes.process_name = pkgmgr.exe
+  Processes.process = "*.xml*" NOT(Processes.parent_process_path IN("*:\\windows\\system32\\*",
+  "*:\\windows\\syswow64\\*", "*:\\Program Files*")) by Processes.dest Processes.user
+  Processes.parent_process_name Processes.parent_process_path Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_bypass_uac_via_pkgmgr_tool_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present on recent Windows Operating
   Systems. Filtering may be required based on process_name. In addition, look for
   non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by
diff --git a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
index 07896c8f77..341b0205ef 100644
--- a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
+++ b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
@@ -22,10 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_cached_domain_credentials_reg_query_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
diff --git a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml
index 1c1abdf7aa..2851ca5d6b 100644
--- a/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml
+++ b/detections/endpoint/windows_change_default_file_association_for_no_file_ext.yml
@@ -21,12 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | rex field=file_name_association "\.(?<extension>[^\.]*$)" | where isnull(extension)
   and isnotnull(file_name_association) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_change_default_file_association_for_no_file_ext_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
index 270207e6f8..27feb0159b 100644
--- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
+++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_com_hijacking_inprocserver32_modification_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and some filtering may be required.
 references:
 - https://attack.mitre.org/techniques/T1546/015/
diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
index 2759ee34c9..2e817e87c1 100644
--- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
+++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) | search count_of_pattern1
   > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 |
   `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: false positive may vary depends on the score you want to check.
   The bigger number of path traversal string count the better.
 references:
diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
index b28a4fb939..764448a769 100644
--- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
+++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
   Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Not known at this moment.
 references:
 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
index 8ae53f3832..3e87e0212b 100644
--- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
+++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
@@ -24,11 +24,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.user  _time span=30s | where parent_process_id_count>= 10 AND process_id_count
   >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://cert.gov.ua/article/405538
diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/endpoint/windows_command_shell_fetch_env_variables.yml
index a68e6966b6..4c709a01d4 100644
--- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml
+++ b/detections/endpoint/windows_command_shell_fetch_env_variables.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_fetch_env_variables_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: shell process that are not included in this search may cause
   False positive. Filter is needed.
 references:
diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
index cd96dc4215..bda61dca69 100644
--- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
+++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_credential_dumping_lsass_memory_createdump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if an application is dumping
   processes, filter as needed. Recommend reviewing createdump.exe usage across the
   fleet to better understand all usage and by what.
diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml
index 702b9861d8..8a1b5c2b74 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_query.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_query_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network administrator can use this tool for auditing process.
 references:
 - https://ss64.com/nt/cmdkey.html
diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
index 85c66925d2..293e3b2960 100644
--- a/detections/endpoint/windows_credentials_in_registry_reg_query.yml
+++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_credentials_in_registry_reg_query_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://attack.mitre.org/techniques/T1552/002/
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index a8a64525b9..f2730fe0fb 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_curl_download_to_suspicious_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible Administrators or super users will use Curl
   for legitimate purposes. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index 784652179f..9ea1d5122b 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -31,11 +31,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be limited to source control applications
   and may be required to be filtered out.
 references:
diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
index 9447535437..2d0939efdd 100644
--- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
+++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
@@ -5,18 +5,35 @@ date: '2023-04-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-data_source : []
-description: The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain
-  two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment.
-  The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group 
-  policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `windows_default_group_policy_object_modified_with_gpme_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
+data_source: []
+description: The following analytic leverages the Endpoint datamodel to identify the
+  potential edition of a default Group Policy Object. A fresh installation of an Active
+  Directory network will typically contain two default group policy objects `Default
+  Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers
+  policy is used to enforce and set policies to all the domain controllers within
+  the domain environment. The default domain policy is linked to all users and computers
+  by default. An adversary who has obtained privileged access to an Active Directory
+  network may modify the default group policy objects to obtain further access, deploy
+  persistence or execute malware across a large number of hosts. Security teams should
+  monitor the edition of the default GPOs.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe
+  (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*"
+  OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  ) by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_with_gpme_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: The default Group Policy Objects within an AD network may be
+  legitimately updated for administrative operations, filter as needed.
 references:
 - https://attack.mitre.org/techniques/T1484/
 - https://attack.mitre.org/techniques/T1484/001
@@ -30,7 +47,8 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 100
-  message: A default group policy object was opened with Group Policy Manage Editor on $dest$
+  message: A default group policy object was opened with Group Policy Manage Editor
+    on $dest$
   mitre_attack_id:
   - T1484
   - T1484.001
@@ -55,11 +73,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
index c5c4616269..26b74a8144 100644
--- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
+++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
@@ -25,10 +25,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   | fields _time parent_process_name parent_process process_name process_path process
   process_guid registry_path registry_value_name registry_value_data registry_key_name
   action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This detection can catch for third party application updates
   or installation. In this scenario false positive filter is needed.
 references:
diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
index 4858a9ee08..aaf4baccdf 100644
--- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_event_logging_disable_http_logging_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present only if scripts or Administrators
   are disabling logging. Filter as needed by parent process or other.
 references:
diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml
index fb1b54842d..4ff1492f15 100644
--- a/detections/endpoint/windows_diskcryptor_usage.yml
+++ b/detections/endpoint/windows_diskcryptor_usage.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible false positives may be present based on the
   internal name dcinst.exe, filter as needed. It may be worthy to alert on the service
   name.
diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml
index ef04444fa4..b309bd4170 100644
--- a/detections/endpoint/windows_diskshadow_proxy_execution.yml
+++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_diskshadow_proxy_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on processes that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm
-  the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint
-  product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators using the DiskShadow tool in their infrastructure
   as a main backup tool with scripts will cause false positives that can be filtered
   with `windows_diskshadow_proxy_execution_filter`
diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
index 15540d01fe..4247f0d04b 100644
--- a/detections/endpoint/windows_dism_remove_defender.yml
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
   manipulate packages and features of the operating system. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
index 44c64c0db7..cf72279882 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml
@@ -26,12 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary
   = True | rename parent_process_name as "Process Name" process_name AS ImageLoaded
   process_path AS Module_Path | `windows_dll_search_order_hijacking_hunt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product. This may only with with Sysmon data and the Sysmon TA. Your mileage
-  may vary.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present based on paths. Filter or add
   other paths to the exclusion as needed.
 references:
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
index d093df53ea..1cd3df61fd 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `windows_dll_search_order_hijacking_with_iscsicpl_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filtering may be required.
   Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
 references:
diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
index 33d56c45b0..7bafb0f70c 100644
--- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
@@ -7,21 +7,28 @@ status: production
 type: Anomaly
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. 
-  This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses 
-  dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. 
-  This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe"
-  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_dll_side_loading_process_child_of_calc_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process 
-  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
-  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
-  the latest TA for the endpoint product.
+description: The following analytic identifies the suspicious child process of calc.exe
+  due to dll side loading technique to execute another executable. This technique
+  was seen in qakbot malware that uses dll side loading technique to calc applications
+  to load its malicious dll code. The malicious dll that abuses dll side loading technique
+  will load the actual qakbot loader dll using regsvr32.exe application. This TTP
+  is a good indicator of qakbot since the calc.exe will not load other child processes
+  aside from win32calc.exe.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "calc.exe")  AND Processes.process_name != "win32calc.exe" by Processes.parent_process
+  Processes.process_name Processes.process_id Processes.process_guid Processes.process
+  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml
index 6940e99e5e..a1b5044f1f 100644
--- a/detections/endpoint/windows_dns_gather_network_info.yml
+++ b/detections/endpoint/windows_dns_gather_network_info.yml
@@ -7,19 +7,32 @@ type: Anomaly
 status: production
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *"
-  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: The following analytic identifies a process command line used to enumerate
+  DNS records. Adversaries, threat actors, or red teamers may employ this technique
+  to gather information about a victim's DNS, which can be utilized during targeting.
+  This method was also observed as part of a tool used by the Sandworm APT group in
+  a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application,
+  an attacker can enumerate DNS records for specific domains within the targeted network,
+  potentially aiding in further attacks. This anomaly detection can serve as a valuable
+  starting point for identifying users and hostnames that may be compromised or targeted
+  by adversaries seeking to collect data information.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dnscmd.exe"
+  Processes.process = "* /enumrecords *" by Processes.parent_process Processes.process_name
+  Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_dns_gather_network_info_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process 
-  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
-  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
-  the latest TA for the endpoint product.
-known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: network administrator can execute this command to enumerate
+  DNS record. Filter or add other paths to the exclusion as needed.
 references:
 - https://cert.gov.ua/article/3718487
 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
@@ -62,4 +75,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index 0378b37200..d402e3a1d3 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `is_net_windows_file` | `windows_dotnet_binary_in_non_standard_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may be required.
   Certain utilities will run from non-standard paths based on the third-party application
   in use.
diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index 94a31e764f..7a2f5ae2d4 100644
--- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed. Added .xml
   to potentially capture any answer file usage. Remove as needed.
 references:
diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
index 73563de677..946ee02fb3 100644
--- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
+++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
@@ -7,22 +7,31 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: This analytic aims to identify potential adversaries who manipulate the security permissions of specific files or directories. 
-  This technique is frequently observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts. 
-  By modifying the security permissions, adversaries seek to evade detection and impede access to their component files. 
-  Such actions indicate a deliberate effort to maintain control over compromised systems and hinder investigation or remediation efforts. 
-  Detecting these security permission changes can serve as a valuable indicator of an ongoing attack and enable timely response to mitigate the impact of the adversary's activities.
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe")
-  AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This analytic aims to identify potential adversaries who manipulate the
+  security permissions of specific files or directories. This technique is frequently
+  observed in the tradecraft of Advanced Persistent Threats (APTs) and coinminer scripts.
+  By modifying the security permissions, adversaries seek to evade detection and impede
+  access to their component files. Such actions indicate a deliberate effort to maintain
+  control over compromised systems and hinder investigation or remediation efforts.
+  Detecting these security permission changes can serve as a valuable indicator of
+  an ongoing attack and enable timely response to mitigate the impact of the adversary's
+  activities.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
+  "cacls.exe","xcacls.exe") AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",,
+  "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
   Filter as needed.
 references:
@@ -35,8 +44,9 @@ tags:
   - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9
   confidence: 70
   impact: 70
-  message: Process name $process_name$ with access right modification argument executed by $user$ to change
-    security permission of a specific file or directory on host $dest$
+  message: Process name $process_name$ with access right modification argument executed
+    by $user$ to change security permission of a specific file or directory on host
+    $dest$
   mitre_attack_id:
   - T1222.001
   - T1222
diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml
index f2513e5ce3..afec35b5c3 100644
--- a/detections/endpoint/windows_findstr_gpp_discovery.yml
+++ b/detections/endpoint/windows_findstr_gpp_discovery.yml
@@ -6,25 +6,36 @@ author: Mauricio Velazco, Splunk
 type: TTP
 status: production
 data_source: []
-description: The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP).
-  GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.
-  These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).
-  While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
+description: The following analytic identifies the use of the findstr command employed
+  to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools
+  that allow administrators to create domain policies with embedded credentials. These
+  policies allow administrators to set local accounts. These group policies are stored
+  in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL
+  share and decrypt the password (using the AES key that has been made public). While
+  Microsoft released a patch that impedes Administrators to create unsecure credentials,
+  existing Group Policy Preferences files with passwords are not removed from SYSVOL.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe AND Processes.process=*sysvol* AND Processes.process=*cpassword*)
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe
+  AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.original_file_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_findstr_gpp_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Administrators may leverage findstr to find passwords in GPO
+  to validate exposure. Filter as needed.
 references:
 - https://attack.mitre.org/techniques/T1552/006/
 - https://pentestlab.blog/2017/03/20/group-policy-preferences/
-- https://adsecurity.org/?p=2288 
+- https://adsecurity.org/?p=2288
 - https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/
 - https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30
 tags:
@@ -60,9 +71,9 @@ tags:
   - Processes.user
   - Processes.parent_process_name
   - Processes.process_name
-  - Processes.process_id 
+  - Processes.process_id
   - Processes.parent_process_id
-  - Processes.original_file_name 
+  - Processes.original_file_name
   risk_score: 56
   security_domain: endpoint
 tests:
@@ -70,4 +81,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml
index 9addf6cac9..07ae69911e 100644
--- a/detections/endpoint/windows_identify_protocol_handlers.yml
+++ b/detections/endpoint/windows_identify_protocol_handlers.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup windows_protocol_handlers
   handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be found. https and http is a URL Protocol
   handler that will trigger this analytic. Tune based on process or command-line.
 references:
diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml
index 64e17a86c0..8cf0206a78 100644
--- a/detections/endpoint/windows_iis_components_add_new_module.yml
+++ b/detections/endpoint/windows_iis_components_add_new_module.yml
@@ -20,12 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_add_new_module_filter`'
-how_to_implement: Tune the analytic for your environment by filtering by known good
-  modules or processes. Enable as TTP once the volume is low enough. To successfully
-  implement this search you need to be ingesting information on process that include
-  the name of the process responsible for the changes from your endpoints into the
-  `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM
-  App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present until properly tuned. Filter
   as needed.
 references:
diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
index 1ef5d57d6e..6ddfb2424e 100644
--- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
+++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_impair_defense_add_xml_applocker_rules_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command that may cause some
   false positive.
 references:
diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index c80dbb3049..26c43e86bb 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the full process path in the process field of CIM's Process data model.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where  forfiles.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly,
   forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.
 references:
diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 3d4872d990..a8111747c7 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -17,10 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the full process path in the process field of CIM's Process data model.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where pcalua.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter
   these results as needed.
 references:
diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
index 8b2a0a8e18..314ff1e824 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
@@ -19,12 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   "forfiles.exe" by Processes.parent_process_name Processes.parent_process Processes.dest
   Processes.user _time span=1m | where count >=20 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_series_of_forfiles_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml
index a4ea32793a..5f3f4d850b 100644
--- a/detections/endpoint/windows_information_discovery_fsutil.yml
+++ b/detections/endpoint/windows_information_discovery_fsutil.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_information_discovery_fsutil_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil
diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index 52dba86af0..6d3e12b7d8 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_ingress_tool_transfer_using_explorer_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present based on legitimate applications
   or third party utilities. Filter out any additional parent process names.
 references:
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index a87f4d7666..ec9089a0de 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_installutil_in_non_standard_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may be required.
   Certain utilities will run from non-standard paths based on the third-party application
   in use.
diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml
index d17cf16767..893590030a 100644
--- a/detections/endpoint/windows_installutil_remote_network_connection.yml
+++ b/detections/endpoint/windows_installutil_remote_network_connection.yml
@@ -30,11 +30,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)`
   | rename dest as C2 ] | table _time dest parent_process_name process_name process_path
   process process_id dest_port C2 | `windows_installutil_remote_network_connection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
-  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
-  TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as InstallUtil is
   not typically used to download remote files. Filter as needed based on Developers
   requirements.
diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml
index db2bc46381..90c0ee15aa 100644
--- a/detections/endpoint/windows_installutil_uninstall_option.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option.yml
@@ -31,11 +31,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present. Filter as needed
   by parent process or application.
 references:
diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
index c23e7f4a91..6b9136ca3f 100644
--- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
@@ -34,11 +34,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
   | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name
   process_name process_path process process_id dest_port C2 | `windows_installutil_uninstall_option_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
-  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
-  TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as InstallUtil is
   not typically used to download remote files. Filter as needed based on Developers
   requirements.
diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml
index c1df6d4594..9b93de1a26 100644
--- a/detections/endpoint/windows_installutil_url_in_command_line.yml
+++ b/detections/endpoint/windows_installutil_url_in_command_line.yml
@@ -27,11 +27,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as InstallUtil is
   not typically used to download remote files. Filter as needed based on Developers
   requirements.
diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml
index df9b53f3e5..01c43ca59a 100644
--- a/detections/endpoint/windows_java_spawning_shells.yml
+++ b/detections/endpoint/windows_java_spawning_shells.yml
@@ -18,12 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_java_spawning_shells_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives.
-  Add any additional identified web application process name to the query. Add any
-  further Windows process names to the macro (ex. LOLBins) to further expand this
-  query.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering may be required on internal developer build systems
   or classify assets as web facing and restrict the analytic based on that.
 references:
diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
index df209bcb4d..0c3fded0fa 100644
--- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
+++ b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
@@ -7,26 +7,38 @@ type: TTP
 status: production
 data_source:
 - Sysmon Event ID 1
-description: This analytic identifies the use of RemCom.exe - The open source psexec. This utility provides the ability to move laterally and run scripts or commands remotely.
+description: This analytic identifies the use of RemCom.exe - The open source psexec.
+  This utility provides the ability to move laterally and run scripts or commands
+  remotely.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe
+  OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process
+  IN ("*/user:*", "*/pwd:*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_lateral_tool_transfer_remcom_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present based on Administrative use. Filter as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may be present based on Administrative use.
+  Filter as needed.
 references:
-  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
-  - https://github.com/kavika13/RemCom
+- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
+- https://github.com/kavika13/RemCom
 tags:
   analytic_story:
   - Active Directory Discovery
   asset_type: Endpoint
   confidence: 50
   impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to move laterally.
   mitre_attack_id:
   - T1570
   observable:
@@ -54,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml
index 8e8edb3325..4e931da2a9 100644
--- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml
+++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml
@@ -7,21 +7,42 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies the use of Ldifde.exe, which provides the ability to create, modify, or delete LDAP directory objects.
-  Natively, the binary is only installed on a domain controller. However, adversaries or administrators may install the Windows Remote Server Admin Tools for ldifde.exe.
-  Ldifde.exe is a Microsoft Windows command-line utility used to import or export LDAP directory entries. LDAP stands for Lightweight Directory Access Protocol, which is a protocol used for accessing and managing directory information services over an IP network. LDIF, on the other hand, stands for LDAP Data Interchange Format, a standard plain-text data interchange format for representing LDAP directory entries.
-  -i This is a flag used with Ldifde.exe to denote import mode. In import mode, Ldifde.exe takes an LDIF file and imports its contents into the LDAP directory. The data in the LDIF file might include new objects to be created, or modifications or deletions to existing objects.
-  -f This flag is used to specify the filename of the LDIF file that Ldifde.exe will import from (in the case of the -i flag) or export to (without the -i flag). For example, if you wanted to import data from a file called data.ldif, you would use the command ldifde -i -f data.ldif.
-  Keep in mind that while the use of Ldifde.exe is legitimate in many contexts, it can also be used maliciously. For instance, an attacker who has gained access to a domain controller could potentially use Ldifde.exe to export sensitive data or make unauthorized changes to the directory. Therefore, it's important to monitor for unusual or unauthorized use of this tool.
+description: The following analytic identifies the use of Ldifde.exe, which provides
+  the ability to create, modify, or delete LDAP directory objects. Natively, the binary
+  is only installed on a domain controller. However, adversaries or administrators
+  may install the Windows Remote Server Admin Tools for ldifde.exe. Ldifde.exe is
+  a Microsoft Windows command-line utility used to import or export LDAP directory
+  entries. LDAP stands for Lightweight Directory Access Protocol, which is a protocol
+  used for accessing and managing directory information services over an IP network.
+  LDIF, on the other hand, stands for LDAP Data Interchange Format, a standard plain-text
+  data interchange format for representing LDAP directory entries. -i This is a flag
+  used with Ldifde.exe to denote import mode. In import mode, Ldifde.exe takes an
+  LDIF file and imports its contents into the LDAP directory. The data in the LDIF
+  file might include new objects to be created, or modifications or deletions to existing
+  objects. -f This flag is used to specify the filename of the LDIF file that Ldifde.exe
+  will import from (in the case of the -i flag) or export to (without the -i flag).
+  For example, if you wanted to import data from a file called data.ldif, you would
+  use the command ldifde -i -f data.ldif. Keep in mind that while the use of Ldifde.exe
+  is legitimate in many contexts, it can also be used maliciously. For instance, an
+  attacker who has gained access to a domain controller could potentially use Ldifde.exe
+  to export sensitive data or make unauthorized changes to the directory. Therefore,
+  it's important to monitor for unusual or unauthorized use of this tool.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ldifde.exe Processes.process IN ("*-i *", "*-f *")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ldifde.exe
+  Processes.process IN ("*-i *", "*-f *") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_ldifde_directory_object_behavior_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present, filter as needed. 
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may be present, filter as needed.
 references:
 - https://lolbas-project.github.io/lolbas/Binaries/Ldifde/
 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
@@ -31,11 +52,12 @@ tags:
   analytic_story:
   - Volt Typhoon
   asset_type: Endpoint
-  atomic_guid: 
+  atomic_guid:
   - 22cf8cb9-adb1-4e8c-80ca-7c723dfc8784
   confidence: 50
   impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing ldifde on a domain controller.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing ldifde on a domain controller.
   mitre_attack_id:
   - T1105
   - T1069.002
@@ -64,11 +86,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
index 830f54283c..9b0652ae58 100644
--- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
+++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
   Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `windows_masquerading_explorer_as_child_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml
index 5fca729b57..9c13c6eb26 100644
--- a/detections/endpoint/windows_mimikatz_binary_execution.yml
+++ b/detections/endpoint/windows_mimikatz_binary_execution.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_mimikatz_binary_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this is directly looking
   for Mimikatz, the credential dumping utility.
 references:
diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
index a263d59aa4..8d275c5576 100644
--- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
+++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
@@ -34,10 +34,15 @@ search: '| tstats `security_content_summariesonly` count dc(registry_value_name)
   dc(registry_value_name) as registry_value_name_count by process_path registry_key_name
   registry_value_data proc_guid registry_key_name_len registry_value_name_len | where
   registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/
diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/endpoint/windows_modify_registry_reg_restore.yml
index f4f1305076..a232f325b5 100644
--- a/detections/endpoint/windows_modify_registry_reg_restore.yml
+++ b/detections/endpoint/windows_modify_registry_reg_restore.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process
   Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_reg_restore_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry
   before updates or modifying critical registries.
 references:
diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
index 109e60e2ee..e82813ca9d 100644
--- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
+++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command that may cause some
   false positive. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
index ef07bafe4c..4336d06ebd 100644
--- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
+++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present from automation based applications
   (SCCM), filtering may be required. In addition, break the query out based on volume
   of usage. Filter process names or f
diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml
index 0259e45c82..3fae5a864d 100644
--- a/detections/endpoint/windows_msiexec_dllregisterserver.yml
+++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This analytic will need to be tuned for your environment based
   on legitimate usage of msiexec.exe. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml
index bbad5f2d6e..b7783b4bd9 100644
--- a/detections/endpoint/windows_msiexec_remote_download.yml
+++ b/detections/endpoint/windows_msiexec_remote_download.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter by destination or parent
   process as needed.
 references:
diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
index b58c590739..5962384716 100644
--- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
+++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_msiexec_spawn_discovery_command_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present with MSIExec spawning Cmd or
   PowerShell. Filtering will be needed. In addition, add other known discovery processes
   to enhance query.
diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
index ba121d0906..5772d822e6 100644
--- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
+++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This analytic will need to be tuned for your environment based
   on legitimate usage of msiexec.exe. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_msiexec_with_network_connections.yml
index 6223abb2f3..1751bd8ba6 100644
--- a/detections/endpoint/windows_msiexec_with_network_connections.yml
+++ b/detections/endpoint/windows_msiexec_with_network_connections.yml
@@ -19,13 +19,15 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ]
   | table _time dest parent_process_name process_name process_path process process_id
   dest_port dest_ip | `windows_msiexec_with_network_connections_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product. Add parent process as a filter, filter known good processes. This
-  may be voluminous due to the join on process_id. All_Traffic does not have process_guid,
-  yet.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present and filtering is required.
 references:
 - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
index b9914cc27c..d9b176176f 100644
--- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
+++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `windows_ngrok_reverse_proxy_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present based on organizations that
   allow the use of Ngrok. Filter or monitor as needed.
 references:
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index db3bdab6c5..fdc676ef62 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `windows_nirsoft_advancedrun_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as it is specific to AdvancedRun.
   Filter as needed based on legitimate usage.
 references:
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 00a0074fb9..693acfbeab 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_nirsoft_software`
   | `windows_nirsoft_utilities_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present. Filtering may be required before
   setting to alert.
 references:
diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml
index e7ad927e6c..fc2e8513f0 100644
--- a/detections/endpoint/windows_odbcconf_hunting.yml
+++ b/detections/endpoint/windows_odbcconf_hunting.yml
@@ -14,11 +14,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be present as this is meant to assist
   with filtering and tuning.
 references:
diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml
index 1114188be2..be7861e0bc 100644
--- a/detections/endpoint/windows_odbcconf_load_dll.yml
+++ b/detections/endpoint/windows_odbcconf_load_dll.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may need to occur
   based on legitimate application usage. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml
index 3e63374443..ec9f5c9a94 100644
--- a/detections/endpoint/windows_odbcconf_load_response_file.yml
+++ b/detections/endpoint/windows_odbcconf_load_response_file.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may need to occur
   based on legitimate application usage. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml
index 2b82ba6b48..d57d42fe7b 100644
--- a/detections/endpoint/windows_office_product_spawning_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawning_msdt.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`'
-how_to_implement: how To successfully implement this search you need to be ingesting
-  information on process that include the name of the process responsible for the
-  changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
-  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
-  TA for the endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
 - https://isc.sans.edu/diary/rss/28694
diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
index 1a1aa16705..9e312f6c58 100644
--- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
@@ -7,17 +7,30 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: The following analytic is designed to detect instances where the PaperCut NG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell. This behavior may indicate potential malicious activity, such as an attacker attempting to gain unauthorized access or execute harmful commands on the affected system.
+description: The following analytic is designed to detect instances where the PaperCut
+  NG application (pc-app.exe) spawns a Windows shell, specifically cmd.exe or PowerShell.
+  This behavior may indicate potential malicious activity, such as an attacker attempting
+  to gain unauthorized access or execute harmful commands on the affected system.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercut_ng_spawn_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be present, but most likely not. Filter as needed.
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe
+  `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercut_ng_spawn_shell_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may be present, but most likely not. Filter
+  as needed.
 references:
-  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
-  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
+- https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
+- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
 tags:
   analytic_story:
   - PaperCut MF NG Vulnerability
@@ -25,7 +38,8 @@ tags:
   atomic_guid: []
   confidence: 90
   impact: 100
-  message: The PaperCut NG application has spawned a shell $process_name$ on endpoint $dest$ by $user$.
+  message: The PaperCut NG application has spawned a shell $process_name$ on endpoint
+    $dest$ by $user$.
   mitre_attack_id:
   - T1059
   - T1190
@@ -52,11 +66,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
index 7a40b2c22a..1799ba1350 100644
--- a/detections/endpoint/windows_password_managers_discovery.yml
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -26,10 +26,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_password_managers_discovery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://attack.mitre.org/techniques/T1555/005/
diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
index f23e802d93..030b37023c 100644
--- a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
+++ b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "chrome.exe", "iexplore.exe") by Processes.user Processes.parent_process_name Processes.process_name  Processes.parent_process
   Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_pdf_file_executes_url_link_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives in PDF file opened PDF Viewer having legitimate
   URL link, however filter as needed.
 references:
diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml
index fdc253c62a..7fd257f5e6 100644
--- a/detections/endpoint/windows_powershell_remotesigned_file.yml
+++ b/detections/endpoint/windows_powershell_remotesigned_file.yml
@@ -7,20 +7,26 @@ status: production
 type: Anomaly
 data_source:
 - Sysmon Event ID 1
-description: This analytic identifies the use of "remotesigned" execution policy for a file. 
-  This security setting determines whether PowerShell scripts can be executed on a computer. 
-  When the execution policy is set to "remotesigned," it allows locally created scripts to run without any restrictions, 
-  but scripts downloaded from the internet must have a digital signature from a trusted publisher.
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_powershell` Processes.process="* remotesigned *" Processes.process="* -File *"
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `windows_powershell_remotesigned_file_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+description: This analytic identifies the use of "remotesigned" execution policy for
+  a file. This security setting determines whether PowerShell scripts can be executed
+  on a computer. When the execution policy is set to "remotesigned," it allows locally
+  created scripts to run without any restrictions, but scripts downloaded from the
+  internet must have a digital signature from a trusted publisher.
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*
+  remotesigned *" Processes.process="* -File *" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_powershell_remotesigned_file_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible administrators or scripts may run these commands,
   filtering may be required.
 references:
@@ -51,13 +57,13 @@ tags:
   risk_score: 25
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.original_file_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.original_file_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
 tests:
diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml
index d8d59a34ad..21100211cf 100644
--- a/detections/endpoint/windows_private_keys_discovery.yml
+++ b/detections/endpoint/windows_private_keys_discovery.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_private_keys_discovery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://attack.mitre.org/techniques/T1552/004/
diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
index 2fe7f60bf4..419b980ad9 100644
--- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml
+++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_process_injection_wermgr_child_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
index ac68514dde..d04105e563 100644
--- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml
+++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
@@ -22,10 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id
   Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Normal browser application may use this technique. Please update
   the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
index 19624e1124..300616103e 100644
--- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml
+++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `windows_protocol_tunneling_with_plink_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if the organization allows for
   SSH tunneling outbound or internally. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml
index 372f2d2a12..30f8c1eee6 100644
--- a/detections/endpoint/windows_proxy_via_netsh.yml
+++ b/detections/endpoint/windows_proxy_via_netsh.yml
@@ -7,23 +7,27 @@ status: production
 type: Anomaly
 data_source:
 - Sysmon Event ID 1
-description: This search looks for processes launching netsh.exe for connection proxy. Netsh is a command-line
-  scripting utility that allows you to, either locally or remotely, display or modify
-  the network configuration of a computer that is currently running. Netsh can be
-  used as a persistence proxy technique to execute a helper DLL when netsh.exe is
-  executed. In this search, we are looking for processes spawned by netsh.exe and
-  executing commands via the command line.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_netsh` Processes.process = "* portproxy *" Processes.process = "* v4tov4 *" by Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.user Processes.dest
-  |`drop_dm_object_name("Processes")` 
-  |`security_content_ctime(firstTime)` 
-  |`security_content_ctime(lastTime)` 
-  | `windows_proxy_via_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+description: This search looks for processes launching netsh.exe for connection proxy.
+  Netsh is a command-line scripting utility that allows you to, either locally or
+  remotely, display or modify the network configuration of a computer that is currently
+  running. Netsh can be used as a persistence proxy technique to execute a helper
+  DLL when netsh.exe is executed. In this search, we are looking for processes spawned
+  by netsh.exe and executing commands via the command line.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process
+  = "* portproxy *" Processes.process = "* v4tov4 *" by Processes.parent_process_name
+  Processes.parent_process Processes.original_file_name Processes.process_name Processes.process
+  Processes.user Processes.dest |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `windows_proxy_via_netsh_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
   of these instances, it is unusual for an executable to launch netsh.exe and run
   commands.
diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/endpoint/windows_query_registry_reg_save.yml
index 9b49ca71d8..934dfe9188 100644
--- a/detections/endpoint/windows_query_registry_reg_save.yml
+++ b/detections/endpoint/windows_query_registry_reg_save.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process
   Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_reg_save_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry
   before updates or modifying critical registries.
 references:
diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
index a5e250e2c9..d4bc8816f0 100644
--- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
 - https://redcanary.com/blog/blackbyte-ransomware/
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index ff03af9789..751bba5082 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -17,11 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be limited to applications that require
   Rasautou.exe to load a DLL from disk. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml
index 15c7f08022..b156f6c501 100644
--- a/detections/endpoint/windows_registry_payload_injection.yml
+++ b/detections/endpoint/windows_registry_payload_injection.yml
@@ -5,14 +5,35 @@ date: '2023-06-15'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies when suspiciouly long data is written to the registry. This behavior is often associated with certain fileless malware threats or persistence techniques used by threat actors. Data stored in the registy is considered fileless since it does not get written to disk and is traditionally not well defended since normal users can modify thier own registry. 
+description: The following analytic identifies when suspiciouly long data is written
+  to the registry. This behavior is often associated with certain fileless malware
+  threats or persistence techniques used by threat actors. Data stored in the registy
+  is considered fileless since it does not get written to disk and is traditionally
+  not well defended since normal users can modify thier own registry.
 data_source:
 - Sysmon EventID 1
-search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid| `drop_dm_object_name(Processes)` | join max=0 dest process_guid [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name 
-	| `drop_dm_object_name(Registry)`
-	| eval reg_data_len = len(registry_value_data)
-    | where reg_data_len > 512] | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_registry_payload_injection_filter`'
-how_to_implement: The following analytic requires Sysmon or Windows logging with command line and registry modification logging enabled. Use filter to remove known environment known false positives prior to full production usage.
+search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
+  AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
+  Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
+  Processes.parent_process Processes.process_guid| `drop_dm_object_name(Processes)`
+  | join max=0 dest process_guid [| tstats `security_content_summariesonly` count
+  from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h
+  Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid
+  Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)`
+  | eval reg_data_len = len(registry_value_data) | where reg_data_len > 512] | fields
+  firstTime lastTime dest user parent_process_name parent_process process_name process_path
+  process registry_key_name registry_path registry_value_name registry_value_data
+  process_guid | where isnotnull(registry_value_data)| `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `windows_registry_payload_injection_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown, possible custom scripting.
 references:
 - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
@@ -24,7 +45,8 @@ tags:
   asset_type: Endpoint
   confidence: 60
   impact: 100
-  message: The process $process_name$ added a suspicious length of registry data on $dest$.
+  message: The process $process_name$ added a suspicious length of registry data on
+    $dest$.
   mitre_attack_id:
   - T1027
   - T1027.011
@@ -51,24 +73,24 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - user 
-  - dest   
-  - process_id 
-  - process_name 
-  - process 
-  - process_path 
-  - parent_process_name 
-  - parent_process 
+  - user
+  - dest
+  - process_id
+  - process_name
+  - process
+  - process_path
+  - parent_process_name
+  - parent_process
   - process_guid
-  - registry_path 
-  - registry_value_name 
-  - registry_value_data 
+  - registry_path
+  - registry_value_name
+  - registry_value_data
   - registry_key_name
   risk_score: 60
-  security_domain: endpoint  
+  security_domain: endpoint
 tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/endpoint/windows_regsvr32_renamed_binary.yml
index 563327392e..b002fbf510 100644
--- a/detections/endpoint/windows_regsvr32_renamed_binary.yml
+++ b/detections/endpoint/windows_regsvr32_renamed_binary.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_regsvr32_renamed_binary_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml
index 69a39ed87b..4e3bc482d1 100644
--- a/detections/endpoint/windows_remote_access_software_hunt.yml
+++ b/detections/endpoint/windows_remote_access_software_hunt.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | lookup remote_access_software remote_utility
   AS process_name OUTPUT isutility | search isutility = True | `windows_remote_access_software_hunt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be found. Filter as needed and create
   higher fidelity analytics based off banned remote access software.
 references:
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index a0c1a597ba..a41c8d5f93 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed. Add additional
   shells as needed.
 references:
diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml
index 895dc5888d..96062c8282 100644
--- a/detections/endpoint/windows_remote_create_service.yml
+++ b/detections/endpoint/windows_remote_create_service.yml
@@ -7,25 +7,38 @@ status: production
 type: Anomaly
 data_source:
 - Sysmon Event ID 1
-description: This analytic identifies an endpoint that remotely connects to another endpoint to create a new service using sc.exe. On the remote endpoint, the new service will be created and this action will trigger the creation of EventCode 7045 along with all the resulting service information.
+description: This analytic identifies an endpoint that remotely connects to another
+  endpoint to create a new service using sc.exe. On the remote endpoint, the new service
+  will be created and this action will trigger the creation of EventCode 7045 along
+  with all the resulting service information.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe Processes.process IN ("*create*")  Processes.process="*\\\\*"
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`'
-how_to_implement: To implement this search, it is necessary to ingest information on processes that include the name of the process responsible for the changes from your endpoints into the Endpoint data model within the Processes node. Additionally, it is recommended to confirm that the latest version of CIM App (4.20 or higher) and the latest TA for the endpoint product are installed.
-known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe
+  Processes.process IN ("*create*")  Processes.process="*\\\\*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Note that false positives may occur, and filtering may be necessary,
+  especially when it comes to remote service creation by administrators or software
+  management utilities.
 references:
-  - https://attack.mitre.org/techniques/T1543/003/
+- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a remote service.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to create a remote service.
   mitre_attack_id:
   - T1543
   - T1543.003
@@ -54,11 +67,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
index 30d744ec8d..eb9c8b7266 100644
--- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
+++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This tool was designed for home usage and not commonly seen
   in production environment. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
index 6ccf1bc5bc..e1ce428615 100644
--- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
+++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
@@ -23,10 +23,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: administrators may enable or disable this feature that may
   cause some false positive.
 references:
diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml
index 2f0410210c..a3962e215c 100644
--- a/detections/endpoint/windows_rundll32_webdav_request.yml
+++ b/detections/endpoint/windows_rundll32_webdav_request.yml
@@ -7,22 +7,32 @@ type: TTP
 status: production
 data_source:
 - Sysmon Event ID 1
-description: The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. This particular behavior was recently showcased in CVE-2023-23397.
+description: The following analytic identifies rundll32.exe with the commandline arguments
+  loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav
+  instance. This particular behavior was recently showcased in CVE-2023-23397.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*")
-   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`'
-how_to_implement: In addition to getting the correct data, adding a join with network connection will assist with making this higher fidelity. We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives will be present based on legitimate software,
+  filtering may need to occur.
 references:
-  - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
-  - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
-  - https://twitter.com/domchell/status/1635999068282408962?s=20
-  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
-  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
+- https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
+- https://twitter.com/ACEResponder/status/1636116096506818562?s=20
+- https://twitter.com/domchell/status/1635999068282408962?s=20
+- https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
+- https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
 tags:
   analytic_story:
   - CVE-2023-23397 Outlook Elevation of Privilege
@@ -31,7 +41,8 @@ tags:
   - CVE-2023-23397
   confidence: 60
   impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
   mitre_attack_id:
   - T1048.003
   observable:
@@ -59,11 +70,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -75,4 +86,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
index 4601d07fb6..1f78c19138 100644
--- a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
+++ b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
@@ -6,26 +6,39 @@ author: Michael Haag, Splunk
 type: TTP
 status: experimental
 data_source: []
-description: The following analytic identifies rundll32.exe with the commandline arguments loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav instance. The analytic attempts to use join from Processes and All_Traffic to identify the network connection. This particular behavior was recently showcased in CVE-2023-23397.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name=svchost.exe `process_rundll32` Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*", "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | rename dest as src
-  | join host process_id 
-  [
-  | tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port!=0 
-  NOT (All_Traffic.dest_ip IN (10.0.0.0/12, 172.16.0.0/12, 192.168.0.0/16))  by host All_Traffic.process_id 
-  | `drop_dm_object_name(All_Traffic)`]
-  | `windows_rundll32_webdav_with_network_connection_filter`'
-how_to_implement: We removed the parent_process_name=svchost.exe to look more broad, this will need to be tuned. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and the All_Traffic Datamodel. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
+description: The following analytic identifies rundll32.exe with the commandline arguments
+  loading davclnt.dll function - davsetcookie - to be used to access a remote WebDav
+  instance. The analytic attempts to use join from Processes and All_Traffic to identify
+  the network connection. This particular behavior was recently showcased in CVE-2023-23397.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name=svchost.exe
+  `process_rundll32` Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*",
+  "*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by host _time span=1h Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | rename dest as src | join host process_id
+  [ | tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest
+  latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port
+  FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port!=0 NOT (All_Traffic.dest_ip
+  IN (10.0.0.0/12, 172.16.0.0/12, 192.168.0.0/16))  by host All_Traffic.process_id
+  | `drop_dm_object_name(All_Traffic)`] | `windows_rundll32_webdav_with_network_connection_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives will be present based on legitimate software,
+  filtering may need to occur.
 references:
-  - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
-  - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
-  - https://twitter.com/domchell/status/1635999068282408962?s=20
-  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
-  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
+- https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
+- https://twitter.com/ACEResponder/status/1636116096506818562?s=20
+- https://twitter.com/domchell/status/1635999068282408962?s=20
+- https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
+- https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
 tags:
   analytic_story:
   - CVE-2023-23397 Outlook Elevation of Privilege
@@ -34,7 +47,8 @@ tags:
   - CVE-2023-23397
   confidence: 60
   impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
   mitre_attack_id:
   - T1048.003
   observable:
@@ -62,11 +76,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -81,4 +95,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml
index f9ce792f01..4786163e0c 100644
--- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml
+++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml
@@ -7,21 +7,39 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: The following analytic detects the creation of suspicious scheduled tasks in Windows, specifically tasks created using schtasks.exe with the -create flag and an XML parameter in the command-line. This technique is commonly employed by threat actors, adversaries, and red teamers to establish persistence or achieve privilege escalation on targeted hosts. Notably, malware like Trickbot and Winter-Vivern have been observed using XML files to create scheduled tasks. Monitoring and investigating this activity is crucial to mitigate potential security risks. It is important to be aware that scripts or administrators may trigger this analytic, leading to potential false positives. To minimize false positives, adjust the filter based on the parent process or application.\
+description: 'The following analytic detects the creation of suspicious scheduled
+  tasks in Windows, specifically tasks created using schtasks.exe with the -create
+  flag and an XML parameter in the command-line. This technique is commonly employed
+  by threat actors, adversaries, and red teamers to establish persistence or achieve
+  privilege escalation on targeted hosts. Notably, malware like Trickbot and Winter-Vivern
+  have been observed using XML files to create scheduled tasks. Monitoring and investigating
+  this activity is crucial to mitigate potential security risks. It is important to
+  be aware that scripts or administrators may trigger this analytic, leading to potential
+  false positives. To minimize false positives, adjust the filter based on the parent
+  process or application.\
 
-  When a true positive is detected, it suggests an attacker's attempt to gain persistence or execute additional malicious payloads, potentially resulting in data theft, ransomware, or other damaging outcomes. During triage, review the source of the scheduled task, the command to be executed, and capture any relevant on-disk artifacts. Analyze concurrent processes to identify the source of the attack. This analytic enables analysts to detect and respond to potential threats early, mitigating the associated risks effectively.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name=schtasks.exe Processes.process=*create* Processes.process="* /xml *" 
-  by Processes.user  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.process_id Processes.parent_process_guid Processes.dest 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_scheduled_task_created_via_xml_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  When a true positive is detected, it suggests an attacker''s attempt to gain persistence
+  or execute additional malicious payloads, potentially resulting in data theft, ransomware,
+  or other damaging outcomes. During triage, review the source of the scheduled task,
+  the command to be executed, and capture any relevant on-disk artifacts. Analyze
+  concurrent processes to identify the source of the attack. This analytic enables
+  analysts to detect and respond to potential threats early, mitigating the associated
+  risks effectively.'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  Processes.process=*create* Processes.process="* /xml *" by Processes.user  Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process Processes.process_guid
+  Processes.process_id Processes.parent_process_guid Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_created_via_xml_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible scripts or administrators may trigger this analytic.
   Filter as needed based on parent process, application.
 references:
@@ -36,7 +54,8 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log
   impact: 70
-  message: A scheduled task process, $process_name$, with 'create' or 'delete' commands present in the command line.
+  message: A scheduled task process, $process_name$, with 'create' or 'delete' commands
+    present in the command line.
   mitre_attack_id:
   - T1053.005
   - T1053
@@ -72,4 +91,4 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
-    update_timestamp: true
\ No newline at end of file
+    update_timestamp: true
diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
index bf72730ea2..878a83cc05 100644
--- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
+++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
@@ -5,19 +5,34 @@ date: '2023-06-13'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies when the Task Scheduler service "svchost.exe -k netsvcs -p -s Schedule" is the parent process to common command line, scripting, or shell execution binaries. Attackers often abuse the task scheduler service with these binaries as an execution and persistence mechanism in order to blend in with normal Windows operations. This TTP is also commonly seen for legitimate purposes such as business scripts or application updates.
+description: The following analytic identifies when the Task Scheduler service "svchost.exe
+  -k netsvcs -p -s Schedule" is the parent process to common command line, scripting,
+  or shell execution binaries. Attackers often abuse the task scheduler service with
+  these binaries as an execution and persistence mechanism in order to blend in with
+  normal Windows operations. This TTP is also commonly seen for legitimate purposes
+  such as business scripts or application updates.
 data_source:
 - Sysmon 1
 - Windows Security 4688
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where 
-Processes.parent_process="*\\system32\\svchost.exe*" AND Processes.parent_process="*-k*" AND Processes.parent_process= "*netsvcs*" AND Processes.parent_process="*-p*" AND Processes.parent_process="*-s*" AND Processes.parent_process="*Schedule*" Processes.process_name 
-IN("powershell.exe", "wscript.exe", "cscript.exe", "cmd.exe", "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") 
-by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name 
-| `drop_dm_object_name(Processes)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
-| `windows_scheduled_task_service_spawned_shell_filter`'
-how_to_implement: The following analytic requires Sysmon or Windows logging with command line logging enabled. Use filter to remove known environment known false positives prior to full production usage.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*\\system32\\svchost.exe*"
+  AND Processes.parent_process="*-k*" AND Processes.parent_process= "*netsvcs*" AND
+  Processes.parent_process="*-p*" AND Processes.parent_process="*-s*" AND Processes.parent_process="*Schedule*"
+  Processes.process_name IN("powershell.exe", "wscript.exe", "cscript.exe", "cmd.exe",
+  "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") by Processes.dest
+  Processes.user Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.parent_process_name |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_service_spawned_shell_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown, possible custom scripting.
 references:
 - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
@@ -29,9 +44,10 @@ tags:
   asset_type: Endpoint
   confidence: 25
   impact: 80
-  message: A windows scheduled task spawned the shell application $process_name$ on $dest$.
+  message: A windows scheduled task spawned the shell application $process_name$ on
+    $dest$.
   mitre_attack_id:
-  - T1053.005 
+  - T1053.005
   - T1059
   observable:
   - name: dest
@@ -52,13 +68,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
   - Processes.process
   - Processes.process_id
-  - Processes.parent_process_id 
+  - Processes.parent_process_id
   - Processes.parent_process_name
   risk_score: 20
   security_domain: endpoint
diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
index 8d58aebdf3..17e67d5bd4 100644
--- a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
+++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
@@ -5,9 +5,18 @@ date: '2023-01-26'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: The following analytic detects the creation of a new task with the highest execution privilege via Schtasks.exe. This tactic is often observed in AsyncRAT attacks, where the scheduled task is used for persistence and privilege escalation. AsyncRAT sets up a scheduled task with parameters '/rl' and 'highest', triggering this technique. It's a strong indicator of potential malware or adversaries seeking to establish persistence and escalate privileges through scheduled tasks. This is crucial for a Security Operations Center (SOC) as it can prevent unauthorized system access and potential data breaches.\
+description: 'The following analytic detects the creation of a new task with the highest
+  execution privilege via Schtasks.exe. This tactic is often observed in AsyncRAT
+  attacks, where the scheduled task is used for persistence and privilege escalation.
+  AsyncRAT sets up a scheduled task with parameters ''/rl'' and ''highest'', triggering
+  this technique. It''s a strong indicator of potential malware or adversaries seeking
+  to establish persistence and escalate privileges through scheduled tasks. This is
+  crucial for a Security Operations Center (SOC) as it can prevent unauthorized system
+  access and potential data breaches.\
 
-  The analytic works by monitoring logs for process name, parent process, and command-line executions. In the presence of the '*/rl ' and ' highest *' commands in a schtasks.exe process, an alert is triggered.
+  The analytic works by monitoring logs for process name, parent process, and command-line
+  executions. In the presence of the ''*/rl '' and '' highest *'' commands in a schtasks.exe
+  process, an alert is triggered.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -16,11 +25,18 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_highest_privileges_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
-known_false_positives: False positives may arise from legitimate applications that create tasks to run as SYSTEM. Therefore, it's recommended to adjust filters based on parent process or modify the query to include world writable paths for restriction.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may arise from legitimate applications that
+  create tasks to run as SYSTEM. Therefore, it's recommended to adjust filters based
+  on parent process or modify the query to include world writable paths for restriction.
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index b14fc05586..abd1031305 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -5,7 +5,15 @@ date: '2022-02-07'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: The following analytic identifies the creation of a new task to start and run as an elevated user - SYSTEM using Schtasks.exe. This behavior is commonly used by adversaries to spawn a process in an elevated state. If a true positive is found, it suggests an attacker is attempting to persist within the environment or potentially deliver additional malicious payloads, leading to data theft, ransomware, or other damaging outcomes. Upon triage, review the scheduled task's source and the command to be executed. Capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
+description: The following analytic identifies the creation of a new task to start
+  and run as an elevated user - SYSTEM using Schtasks.exe. This behavior is commonly
+  used by adversaries to spawn a process in an elevated state. If a true positive
+  is found, it suggests an attacker is attempting to persist within the environment
+  or potentially deliver additional malicious payloads, leading to data theft, ransomware,
+  or other damaging outcomes. Upon triage, review the scheduled task's source and
+  the command to be executed. Capture and inspect any relevant on-disk artifacts,
+  and look for concurrent processes to identify the attack source. This approach helps
+  analysts detect potential threats earlier and mitigate the risks.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -14,11 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be limited to legitimate applications
   creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
   the query to have world writeable paths to restrict it.
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index 90894e4f77..a4ff3fe6d6 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -14,10 +14,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process"
   | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `windows_security_account_manager_stopped_filter`'
-how_to_implement: You must be ingesting data that records the process-system activity
-  from your hosts to populate the Endpoint Processes data-model object. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: SAM is a critical windows service, stopping it would cause
   major issues on an endpoint this makes false positive rare. AlthoughNo false positives
   have been identified.
diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml
index cbca335be8..bcb529bf31 100644
--- a/detections/endpoint/windows_security_support_provider_reg_query.yml
+++ b/detections/endpoint/windows_security_support_provider_reg_query.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_security_support_provider_reg_query_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
index 3adebab2cd..936478a239 100644
--- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
+++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_server_software_component_gacutil_install_to_gac_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if gacutil.exe is utilized day
   to day by developers. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml
index 85b9162572..f04ff7959c 100644
--- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml
+++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_service_create_kernel_mode_driver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present based on common applications
   adding new drivers, however, filter as needed.
 references:
diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml
index 73c144ee66..02a95e9230 100644
--- a/detections/endpoint/windows_service_create_with_tscon.yml
+++ b/detections/endpoint/windows_service_create_with_tscon.yml
@@ -7,26 +7,52 @@ type: TTP
 status: production
 data_source:
 - Sysmon Event ID 1
-description: 'The following analytic detects potential RDP Hijacking attempts by monitoring a series of actions taken by an attacker to gain unauthorized access to a remote system. The attacker first runs the quser command to query the remote host for disconnected user sessions. Upon identifying a disconnected session, they use the sc.exe command to create a new Windows service with a binary path that launches tscon.exe. By specifying the disconnected session ID and a destination ID, the attacker can transfer the disconnected session to a new RDP session, effectively hijacking the user''s session. This analytic allows security teams to detect and respond to RDP Hijacking attempts, mitigating potential risks and impacts on targeted systems.'
+description: The following analytic detects potential RDP Hijacking attempts by monitoring
+  a series of actions taken by an attacker to gain unauthorized access to a remote
+  system. The attacker first runs the quser command to query the remote host for disconnected
+  user sessions. Upon identifying a disconnected session, they use the sc.exe command
+  to create a new Windows service with a binary path that launches tscon.exe. By specifying
+  the disconnected session ID and a destination ID, the attacker can transfer the
+  disconnected session to a new RDP session, effectively hijacking the user's session.
+  This analytic allows security teams to detect and respond to RDP Hijacking attempts,
+  mitigating potential risks and impacts on targeted systems.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe
-  Processes.process="*/dest:rdp-tcp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_service_create_with_tscon_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection.
+  Processes.process="*/dest:rdp-tcp*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_service_create_with_tscon_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives may arise in the RDP Hijacking analytic when
+  legitimate administrators access remote sessions for maintenance or troubleshooting
+  purposes. These activities might resemble an attacker''s attempt to hijack a disconnected
+  session, leading to false alarms. To mitigate the risk of false positives and improve
+  the overall security posture, organizations can implement Group Policy to automatically
+  disconnect RDP sessions when they are complete. By enforcing this policy, administrators
+  ensure that disconnected sessions are promptly terminated, reducing the window of
+  opportunity for an attacker to hijack a session. Additionally, organizations can
+  also implement access control mechanisms and monitor the behavior of privileged
+  accounts to further enhance security and reduce the chances of false positives in
+  RDP Hijacking detection.
 references:
-  - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md
+- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md
 tags:
   analytic_story:
   - Active Directory Lateral Movement
   asset_type: Endpoint
   confidence: 80
   impact: 80
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to hijack a RDP session.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to hijack a RDP session.
   mitre_attack_id:
   - T1563.002
   - T1563
@@ -57,10 +83,10 @@ tags:
   - Processes.dest
   - Processes.user
   - Processes.parent_process_name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -72,4 +98,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index bec7bd3251..cc40d6ec9b 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -18,9 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `windows_service_creation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may create Windows Services on remote systems,
   but this activity is usually limited to a small set of hosts or users.
 references:
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index 68754298f7..286e8f3f65 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -17,9 +17,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may start Windows Services on remote systems,
   but this activity is usually limited to a small set of hosts or users.
 references:
diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml
index 20ec8ac144..2fd1d18c95 100644
--- a/detections/endpoint/windows_service_stop_by_deletion.yml
+++ b/detections/endpoint/windows_service_stop_by_deletion.yml
@@ -19,10 +19,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: It is possible administrative scripts may start/stop/delete
   services. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml
index a09c91a2f5..82215818f7 100644
--- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml
+++ b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Windows OS or software may stop and restart services due to
   some critical update.
 references:
diff --git a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
index 1a9b4a275a..e0a037b991 100644
--- a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
+++ b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
 - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml
index 3c9689795c..13df0d09fe 100644
--- a/detections/endpoint/windows_sql_spawning_certutil.yml
+++ b/detections/endpoint/windows_sql_spawning_certutil.yml
@@ -7,14 +7,42 @@ status: experimental
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: 'The following analytic detects the use of certutil to download software, a behavior exhibited by the threat actor Flax Typhoon. This actor deploys a VPN connection by downloading an executable file for SoftEther VPN from their network infrastructure using one of several LOLBins, including certutil. The actor then uses the Service Control Manager (SCM) to create a Windows service that launches the VPN connection automatically when the system starts. This behavior allows the actor to monitor the availability of the compromised system and establish an RDP connection. This analytic identifies this behavior by monitoring for the use of certutil in conjunction with the downloading of software. This behavior is worth identifying for a SOC as it indicates a potential compromise of the system and the establishment of a persistent threat. If a true positive is found, it suggests an attacker has gained access to the environment and is attempting to maintain that access, potentially leading to further malicious activities such as data theft or ransomware attacks. Be aware of potential false positives - legitimate uses of certutil in your environment may cause benign activities to be flagged. Upon triage, review the command executed and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.'
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `windows_sql_spawning_certutil_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: The occurrence of false positives should be minimal, given that the SQL agent does not typically download software using CertUtil.
+description: The following analytic detects the use of certutil to download software,
+  a behavior exhibited by the threat actor Flax Typhoon. This actor deploys a VPN
+  connection by downloading an executable file for SoftEther VPN from their network
+  infrastructure using one of several LOLBins, including certutil. The actor then
+  uses the Service Control Manager (SCM) to create a Windows service that launches
+  the VPN connection automatically when the system starts. This behavior allows the
+  actor to monitor the availability of the compromised system and establish an RDP
+  connection. This analytic identifies this behavior by monitoring for the use of
+  certutil in conjunction with the downloading of software. This behavior is worth
+  identifying for a SOC as it indicates a potential compromise of the system and the
+  establishment of a persistent threat. If a true positive is found, it suggests an
+  attacker has gained access to the environment and is attempting to maintain that
+  access, potentially leading to further malicious activities such as data theft or
+  ransomware attacks. Be aware of potential false positives - legitimate uses of certutil
+  in your environment may cause benign activities to be flagged. Upon triage, review
+  the command executed and look for concurrent processes to identify the attack source.
+  This approach helps analysts detect potential threats earlier and mitigate the risks.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe")
+  `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache*
+  by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.original_file_name
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_sql_spawning_certutil_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: The occurrence of false positives should be minimal, given
+  that the SQL agent does not typically download software using CertUtil.
 references:
 - https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
 tags:
@@ -24,7 +52,8 @@ tags:
   atomic_guid: []
   confidence: 100
   impact: 90
-  message: '$process_name$ was launched on $dest$ by $user$. This behavior is uncommon with the SQL process identified.'
+  message: $process_name$ was launched on $dest$ by $user$. This behavior is uncommon
+    with the SQL process identified.
   mitre_attack_id:
   - T1105
   observable:
@@ -55,4 +84,4 @@ tags:
   - Processes.process_id
   - Processes.original_file_name
   - Processes.parent_process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
index 034e7aacf6..852c5dd3ee 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives will be generated based on normal certificate
   store backups. Leave enabled to generate Risk, as this is meant to be an anomaly
   analytic. If CS backups are not normal, enable as TTP.
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
index a24855c7cc..40986e778d 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
@@ -15,10 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_certificate_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering may be requried based on automated utilities and
   third party applications that may export certificates.
 references:
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
index 113ed1d246..d38edaf9af 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
@@ -15,10 +15,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_pfxcertificate_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Filtering may be requried based on automated utilities and
   third party applications that may export certificates.
 references:
diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
index e26abae44b..d4e58b618b 100644
--- a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
+++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process
   Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_or_forge_kerberos_tickets_klist_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 1e653cc3a5..01ceff141d 100644
--- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -18,11 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed.
 references:
 - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
index 6224404d1d..2da1054015 100644
--- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
+++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
@@ -19,11 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
   Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_system_discovery_using_ldap_nslookup_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: dministrator may execute this commandline tool for auditing
   purposes. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_system_discovery_using_qwinsta.yml b/detections/endpoint/windows_system_discovery_using_qwinsta.yml
index 5e14a6a407..bd6d2435b8 100644
--- a/detections/endpoint/windows_system_discovery_using_qwinsta.yml
+++ b/detections/endpoint/windows_system_discovery_using_qwinsta.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.dest Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `windows_system_discovery_using_qwinsta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline tool for auditing
   purposes. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml
index f611623f10..ddd86b2edc 100644
--- a/detections/endpoint/windows_system_logoff_commandline.yml
+++ b/detections/endpoint/windows_system_logoff_commandline.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_system_logoff_commandline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown,
   logoff or restart the host machine.
 references:
diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
index b4b9802852..ceab64ea3a 100644
--- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
+++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
@@ -22,10 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_system_network_config_discovery_display_dns_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://superuser.com/questions/230308/explain-output-of-ipconfig-displaydns
diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
index d45d594282..c7a1742acf 100644
--- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
+++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
@@ -22,10 +22,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_system_network_connections_discovery_netsh_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network administrator can use this tool for auditing process.
 references:
 - https://attack.mitre.org/techniques/T1049/
diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml
index f12df962ab..ab2bd4d0e8 100644
--- a/detections/endpoint/windows_system_reboot_commandline.yml
+++ b/detections/endpoint/windows_system_reboot_commandline.yml
@@ -22,11 +22,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_system_reboot_commandline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown
   or restart the host machine.
 references:
diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
index b1a0e12440..aa78761c18 100644
--- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
+++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
@@ -16,11 +16,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives may be present if the vbscript syncappvpublishingserver
   is used for legitimate purposes. Filter as needed. Adding a n; to the command-line
   arguments may help reduce any noise.
diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml
index 32d0824149..8d0dd1d901 100644
--- a/detections/endpoint/windows_system_shutdown_commandline.yml
+++ b/detections/endpoint/windows_system_shutdown_commandline.yml
@@ -5,30 +5,38 @@ date: '2023-06-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: This detection rule is designed to identify the execution of the Windows shutdown command via command line interface. 
-  The shutdown command can be utilized by system administrators to properly halt, power off, or reboot a computer. 
-  However, in a security context, attackers who have gained unauthorized access to a system may also use this command in an effort to erase tracks, 
-  or to cause disruption and denial of service. In some instances, they might execute the shutdown command after installing a backdoor, 
-  to force the system to restart, ensuring that changes take effect or evading detection by security tools. 
-  Monitoring for the use of the Windows shutdown command, especially in conjunction with other unusual or unauthorized activities, 
-  can be an important part of identifying malicious behavior within a network. 
-  It is advised that security professionals analyze the context in which the shutdown command is being executed to differentiate between 
-  legitimate administrative functions and potentially malicious activity.
+description: This detection rule is designed to identify the execution of the Windows
+  shutdown command via command line interface. The shutdown command can be utilized
+  by system administrators to properly halt, power off, or reboot a computer. However,
+  in a security context, attackers who have gained unauthorized access to a system
+  may also use this command in an effort to erase tracks, or to cause disruption and
+  denial of service. In some instances, they might execute the shutdown command after
+  installing a backdoor, to force the system to restart, ensuring that changes take
+  effect or evading detection by security tools. Monitoring for the use of the Windows
+  shutdown command, especially in conjunction with other unusual or unauthorized activities,
+  can be an important part of identifying malicious behavior within a network. It
+  is advised that security professionals analyze the context in which the shutdown
+  command is being executed to differentiate between legitimate administrative functions
+  and potentially malicious activity.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
-  Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*", "* -r*") AND Processes.process="* /t*"
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_system_shutdown_commandline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+  Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*",
+  "* -r*") AND Processes.process="* /t*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown
   or restart the host machine.
 references:
diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
index 23fc453c06..b77925b9c3 100644
--- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
+++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://cert.gov.ua/article/405538
diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml
index 8ced0332a9..58e4a1ec28 100644
--- a/detections/endpoint/windows_system_user_discovery_via_quser.yml
+++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_system_user_discovery_via_quser_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to audit RDP
   access of user in specific network or host.
 references:
diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml
index 95f90c5b1a..ab08d1197e 100644
--- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml
+++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_valid_account_with_never_expires_password_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: This behavior is not commonly seen in production environment
   and not advisable, filter as needed.
 references:
diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml
index cca97d123c..4a804bf9de 100644
--- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml
+++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml
@@ -6,29 +6,51 @@ author: Michael Haag, Splunk
 status: experimental
 type: Hunting
 data_source:
-  - Sysmon Event ID 1
-  - Sysmon Event ID 3
-description: The following analytic is designed to detect anomalous behavior associated with the BlackLotus Campaign, a sophisticated bootkit attack reported by ESET and further investigated in a blog by Microsoft, which provided hunting queries for security analysts. The primary focus of this analytic is to identify instances of Winlogon.exe, a critical Windows process, connecting to public IP space, which is indicative of potential malicious activity.\
-  The BlackLotus Campaign is a bootkit-based attack that compromises system integrity by infecting the Master Boot Record (MBR) and Volume Boot Record (VBR). This malware variant can bypass traditional security measures, load before the operating system, and maintain persistence on the target system.\ 
+- Sysmon Event ID 1
+- Sysmon Event ID 3
+description: 'The following analytic is designed to detect anomalous behavior associated
+  with the BlackLotus Campaign, a sophisticated bootkit attack reported by ESET and
+  further investigated in a blog by Microsoft, which provided hunting queries for
+  security analysts. The primary focus of this analytic is to identify instances of
+  Winlogon.exe, a critical Windows process, connecting to public IP space, which is
+  indicative of potential malicious activity.\ The BlackLotus Campaign is a bootkit-based
+  attack that compromises system integrity by infecting the Master Boot Record (MBR)
+  and Volume Boot Record (VBR). This malware variant can bypass traditional security
+  measures, load before the operating system, and maintain persistence on the target
+  system.\
 
-  Winlogon.exe is a critical Windows process responsible for managing user logon and logoff processes. Under normal circumstances, Winlogon.exe should not be connecting to public IP addresses. However, if it does, it may indicate that the process has been compromised as part of the BlackLotus Campaign or another malicious operation.\ 
+  Winlogon.exe is a critical Windows process responsible for managing user logon and
+  logoff processes. Under normal circumstances, Winlogon.exe should not be connecting
+  to public IP addresses. However, if it does, it may indicate that the process has
+  been compromised as part of the BlackLotus Campaign or another malicious operation.\
 
-  This analytic monitors network connections made by Winlogon.exe and triggers an alert if it detects connections to public IP space. By identifying such anomalous behavior, security analysts can investigate further and respond swiftly to potential threats.
+  This analytic monitors network connections made by Winlogon.exe and triggers an
+  alert if it detects connections to public IP space. By identifying such anomalous
+  behavior, security analysts can investigate further and respond swiftly to potential
+  threats.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe)  Processes.process!=unknown
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | join  process_id [| tstats `security_content_summariesonly`
-  count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/12,172.16.0.0/12, 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id
-  All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ]
-  | table dest parent_process_name process_name process_path process process_id dest_port publicIp
-  | `windows_winlogon_with_public_network_connection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and Network_Traffic datamodel under All Traffic. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be present and filtering will be required. Legitimate IPs will be present and need to be filtered.
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join  process_id
+  [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic
+  where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/12,172.16.0.0/12,
+  192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port
+  | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] | table dest parent_process_name
+  process_name process_path process process_id dest_port publicIp | `windows_winlogon_with_public_network_connection_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: False positives will be present and filtering will be required.
+  Legitimate IPs will be present and need to be filtered.
 references:
-  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
+- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
 tags:
   analytic_story:
   - BlackLotus Campaign
@@ -36,27 +58,28 @@ tags:
   atomic_guid: []
   confidence: 50
   impact: 50
-  message: Winlogon.exe has generated a network connection to a remote destination on endpoint $dest$.
+  message: Winlogon.exe has generated a network connection to a remote destination
+    on endpoint $dest$.
   mitre_attack_id:
   - T1542.003
   observable:
-    - name: dest
-      type: Hostname
-      role:
-        - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   risk_score: 25
   required_fields:
-  - dest 
-  - parent_process_name 
-  - process_name 
-  - process_path 
-  - process 
-  - process_id 
-  - dest_port 
+  - dest
+  - parent_process_name
+  - process_name
+  - process_path
+  - process
+  - process_id
+  - dest_port
   - publicIp
   security_domain: endpoint
 tests:
diff --git a/detections/endpoint/windows_wmi_process_and_service_list.yml b/detections/endpoint/windows_wmi_process_and_service_list.yml
index 698b45f1d7..04af50a076 100644
--- a/detections/endpoint/windows_wmi_process_and_service_list.yml
+++ b/detections/endpoint/windows_wmi_process_and_service_list.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_wmi_process_and_service_list_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: netowrk administrator or IT may execute this command for auditing
   processes and services.
 references:
diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml
index f229503b03..82943f9833 100644
--- a/detections/endpoint/windows_wmi_process_call_create.yml
+++ b/detections/endpoint/windows_wmi_process_call_create.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_id Processes.dest Processes.user
   Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_wmi_process_call_create_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
 - https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml
index ce87da6fde..b4fbde386f 100644
--- a/detections/endpoint/winhlp32_spawning_a_process.yml
+++ b/detections/endpoint/winhlp32_spawning_a_process.yml
@@ -23,11 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited as winhlp32.exe is typically
   not used with the latest flavors of Windows OS. However, filter as needed.
 references:
diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml
index 4fa8e1957b..b2ee76b313 100644
--- a/detections/endpoint/winrar_spawning_shell_application.yml
+++ b/detections/endpoint/winrar_spawning_shell_application.yml
@@ -7,15 +7,44 @@ status: production
 type: TTP
 data_source:
 - Sysmon Event ID 1
-description: The following analytic detects the execution of Windows shell processes initiated by WinRAR, specifically looking for instances where WinRAR spawns processes like "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". This behavior is worth identifying for a Security Operations Center (SOC) because it is indicative of a spoofing attack exploit, such as the one associated with WinRAR CVE-2023-38831. Cybercriminals exploited this vulnerability to craft ZIP archives with spoofed extensions, hiding the launch of malicious scripts within an archive. When a victim opened the specially crafted archive, it executed the malware, leading to unauthorized access to their broker accounts and enabling the cybercriminals to perform illicit financial transactions and withdraw funds. If a true positive is found, it suggests that an attacker has successfully exploited the vulnerability to execute malicious scripts, leading to unauthorized access, financial loss, and potentially the delivery of additional malicious payloads. The impact of the attack could be severe, involving financial loss, unauthorized access to sensitive accounts, and the potential for further malicious activity such as data theft or ransomware attacks.
+description: The following analytic detects the execution of Windows shell processes
+  initiated by WinRAR, specifically looking for instances where WinRAR spawns processes
+  like "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe".
+  This behavior is worth identifying for a Security Operations Center (SOC) because
+  it is indicative of a spoofing attack exploit, such as the one associated with WinRAR
+  CVE-2023-38831. Cybercriminals exploited this vulnerability to craft ZIP archives
+  with spoofed extensions, hiding the launch of malicious scripts within an archive.
+  When a victim opened the specially crafted archive, it executed the malware, leading
+  to unauthorized access to their broker accounts and enabling the cybercriminals
+  to perform illicit financial transactions and withdraw funds. If a true positive
+  is found, it suggests that an attacker has successfully exploited the vulnerability
+  to execute malicious scripts, leading to unauthorized access, financial loss, and
+  potentially the delivery of additional malicious payloads. The impact of the attack
+  could be severe, involving financial loss, unauthorized access to sensitive accounts,
+  and the potential for further malicious activity such as data theft or ransomware
+  attacks.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winrar.exe `windows_shells` OR
-  Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrar_spawning_shell_application_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Be aware of potential false positives - legitimate uses of WinRAR and the listed processes in your environment may cause benign activities to be flagged. Upon triage, review the destination, user, parent process, and process name involved in the flagged activity. Capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winrar.exe
+  `windows_shells` OR Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `winrar_spawning_shell_application_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
+known_false_positives: Be aware of potential false positives - legitimate uses of
+  WinRAR and the listed processes in your environment may cause benign activities
+  to be flagged. Upon triage, review the destination, user, parent process, and process
+  name involved in the flagged activity. Capture and inspect any relevant on-disk
+  artifacts, and look for concurrent processes to identify the attack source. This
+  approach helps analysts detect potential threats earlier and mitigate the risks.
 references:
 - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
 - https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc
@@ -29,7 +58,8 @@ tags:
   atomic_guid: []
   confidence: 70
   impact: 100
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to decode a file.
   mitre_attack_id:
   - T1105
   observable:
diff --git a/detections/endpoint/winrm_spawning_a_process.yml b/detections/endpoint/winrm_spawning_a_process.yml
index 83180de2a0..9c107644a6 100644
--- a/detections/endpoint/winrm_spawning_a_process.yml
+++ b/detections/endpoint/winrm_spawning_a_process.yml
@@ -19,9 +19,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrm_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Unknown. Add new processes or filter as needed. It is possible
   system management software may spawn processes from `wsmprovhost.exe`.
 references:
diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml
index afa1488d13..d86d2e5eaa 100644
--- a/detections/endpoint/winword_spawning_cmd.yml
+++ b/detections/endpoint/winword_spawning_cmd.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winword_spawning_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml
index b708884f96..ee69b124be 100644
--- a/detections/endpoint/winword_spawning_powershell.yml
+++ b/detections/endpoint/winword_spawning_powershell.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `winword_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml
index 58d47e6ec2..c4e3b1d2a6 100644
--- a/detections/endpoint/winword_spawning_windows_script_host.yml
+++ b/detections/endpoint/winword_spawning_windows_script_host.yml
@@ -23,9 +23,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: There will be limited false positives and it will be different
   for every environment. Tune by child process or command-line as needed.
 references:
diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml
index 382a085af7..9a8eb6dee3 100644
--- a/detections/endpoint/wmic_group_discovery.yml
+++ b/detections/endpoint/wmic_group_discovery.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1069/001/
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index 515411d34f..2e9c02b4c1 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Third party application may use this approach to uninstall
   applications.
 references:
diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml
index 0d50bd6b59..c4823825c5 100644
--- a/detections/endpoint/wmic_xsl_execution_via_url.yml
+++ b/detections/endpoint/wmic_xsl_execution_via_url.yml
@@ -21,11 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id
   Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: False positives are limited as legitimate applications typically
   do not download files or xsl using WMIC. Filter as needed.
 references:
diff --git a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml
index f747eddacb..30d0533a7c 100644
--- a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml
@@ -30,9 +30,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as
   needed.
 references:
diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
index dab7c518b8..9932f627e1 100644
--- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
@@ -20,10 +20,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wscript_or_cscript_suspicious_child_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Administrators may create vbs or js script that use several
   tool as part of its execution. Filter as needed.
 references:
diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
index f5b713f2d9..79694fc58a 100644
--- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
@@ -30,9 +30,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as
   needed.
 references:
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index 59ddca5c93..c159571148 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -24,10 +24,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
   dest user parent_process_name parent_process process_name process_path process registry_key_name
   registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
-  Sysmon TA. https://splunkbase.splunk.com/app/5709
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://github.com/hfiref0x/UACME
diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml
index 3eb5c6e57b..1fffdcc7c3 100644
--- a/detections/endpoint/xsl_script_execution_with_wmic.yml
+++ b/detections/endpoint/xsl_script_execution_with_wmic.yml
@@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: The detection is based on data that originates from Endpoint Detection
+  and Response (EDR) agents. These agents are designed to provide security-related
+  telemetry from the endpoints where the agent is installed. To implement this search,
+  you must ingest logs that contain the process GUID, process name, and parent process.
+  Additionally, you must ingest complete command-line executions. These logs must
+  be processed using the appropriate Splunk Technology Add-ons that are specific to
+  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+  data model. Use the Splunk Common Information Model (CIM) to normalize the field
+  names and speed up the data modeling process.
 known_false_positives: unknown
 references:
 - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation