diff --git a/README.md b/README.md index d72b2d933e..fc768b5e23 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,14 @@ Can be consumed using: * CLI # Structure -`src/` - splunk content app source files, includes lookups, binaries, and defaul config files +[stories/](stories/) - contains all analytics stories/use cases for ESCU +[detections/](detections/) - splunk, uba and phantom detections that power stories +[investigations/](investigations/) - splunk, and phantom investigation content that are used in stories +[responses/](responses/) - automated splunk and phantom responses that are used in stories +[baselines/](baselines/) - phantom and Splunk baseline needed to support detections in stories +[src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files +[bin/](bin/) - where all binaries to produce, and test content lives +[spec/](spec/) - location of all spec files that describe ESCU content # Developing diff --git a/searches/support_add_prohibited_processes_to_es.json b/baselines/support_add_prohibited_processes_to_es.json similarity index 100% rename from searches/support_add_prohibited_processes_to_es.json rename to baselines/support_add_prohibited_processes_to_es.json diff --git a/searches/support_approved_aws_service_accounts.json b/baselines/support_approved_aws_service_accounts.json similarity index 100% rename from searches/support_approved_aws_service_accounts.json rename to baselines/support_approved_aws_service_accounts.json diff --git a/searches/support_assets_sorted_by_category.json b/baselines/support_assets_sorted_by_category.json similarity index 100% rename from searches/support_assets_sorted_by_category.json rename to baselines/support_assets_sorted_by_category.json diff --git a/searches/support_baseline_api_calls_per_user_arn.json b/baselines/support_baseline_api_calls_per_user_arn.json similarity index 100% rename from searches/support_baseline_api_calls_per_user_arn.json rename to baselines/support_baseline_api_calls_per_user_arn.json diff --git a/searches/support_baseline_aws_regions.json b/baselines/support_baseline_aws_regions.json similarity index 100% rename from searches/support_baseline_aws_regions.json rename to baselines/support_baseline_aws_regions.json diff --git a/searches/support_baseline_blocked_vpc_traffic.json b/baselines/support_baseline_blocked_vpc_traffic.json similarity index 100% rename from searches/support_baseline_blocked_vpc_traffic.json rename to baselines/support_baseline_blocked_vpc_traffic.json diff --git a/searches/support_baseline_network_acl_modifications.json b/baselines/support_baseline_network_acl_modifications.json similarity index 100% rename from searches/support_baseline_network_acl_modifications.json rename to baselines/support_baseline_network_acl_modifications.json diff --git a/searches/support_baseline_s3_deletion_by_arn.json b/baselines/support_baseline_s3_deletion_by_arn.json similarity index 100% rename from searches/support_baseline_s3_deletion_by_arn.json rename to baselines/support_baseline_s3_deletion_by_arn.json diff --git a/searches/support_baseline_security_group_activity_by_arn.json b/baselines/support_baseline_security_group_activity_by_arn.json similarity index 100% rename from searches/support_baseline_security_group_activity_by_arn.json rename to baselines/support_baseline_security_group_activity_by_arn.json diff --git a/searches/support_brand_abuse_dnstwist_domains.json b/baselines/support_brand_abuse_dnstwist_domains.json similarity index 100% rename from searches/support_brand_abuse_dnstwist_domains.json rename to baselines/support_brand_abuse_dnstwist_domains.json diff --git a/searches/support_discover_dns_records.json b/baselines/support_discover_dns_records.json similarity index 100% rename from searches/support_discover_dns_records.json rename to baselines/support_discover_dns_records.json diff --git a/searches/support_identify_ports_on_network.json b/baselines/support_identify_ports_on_network.json similarity index 100% rename from searches/support_identify_ports_on_network.json rename to baselines/support_identify_ports_on_network.json diff --git a/searches/support_identify_systems_creating_rdp_traffic.json b/baselines/support_identify_systems_creating_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_creating_rdp_traffic.json rename to baselines/support_identify_systems_creating_rdp_traffic.json diff --git a/searches/support_identify_systems_receiving_rdp_traffic.json b/baselines/support_identify_systems_receiving_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_receiving_rdp_traffic.json rename to baselines/support_identify_systems_receiving_rdp_traffic.json diff --git a/searches/support_identify_systems_using_remote_desktop.json b/baselines/support_identify_systems_using_remote_desktop.json similarity index 100% rename from searches/support_identify_systems_using_remote_desktop.json rename to baselines/support_identify_systems_using_remote_desktop.json diff --git a/searches/support_monitor_successful_backups.json b/baselines/support_monitor_successful_backups.json similarity index 100% rename from searches/support_monitor_successful_backups.json rename to baselines/support_monitor_successful_backups.json diff --git a/searches/support_monitor_successful_windows_updates.json b/baselines/support_monitor_successful_windows_updates.json similarity index 100% rename from searches/support_monitor_successful_windows_updates.json rename to baselines/support_monitor_successful_windows_updates.json diff --git a/searches/support_monitor_unsuccessful_backups.json b/baselines/support_monitor_unsuccessful_backups.json similarity index 100% rename from searches/support_monitor_unsuccessful_backups.json rename to baselines/support_monitor_unsuccessful_backups.json diff --git a/searches/support_monitor_unsuccessful_windows_updates.json b/baselines/support_monitor_unsuccessful_windows_updates.json similarity index 100% rename from searches/support_monitor_unsuccessful_windows_updates.json rename to baselines/support_monitor_unsuccessful_windows_updates.json diff --git a/searches/support_previously_seen_aws_cross_account_activity.json b/baselines/support_previously_seen_aws_cross_account_activity.json similarity index 100% rename from searches/support_previously_seen_aws_cross_account_activity.json rename to baselines/support_previously_seen_aws_cross_account_activity.json diff --git a/searches/support_previously_seen_cmd_arguments.json b/baselines/support_previously_seen_cmd_arguments.json similarity index 100% rename from searches/support_previously_seen_cmd_arguments.json rename to baselines/support_previously_seen_cmd_arguments.json diff --git a/searches/support_previously_seen_ec2_amis.json b/baselines/support_previously_seen_ec2_amis.json similarity index 100% rename from searches/support_previously_seen_ec2_amis.json rename to baselines/support_previously_seen_ec2_amis.json diff --git a/searches/support_previously_seen_ec2_instance_types.json b/baselines/support_previously_seen_ec2_instance_types.json similarity index 100% rename from searches/support_previously_seen_ec2_instance_types.json rename to baselines/support_previously_seen_ec2_instance_types.json diff --git a/searches/support_previously_seen_ec2_launches_by_user.json b/baselines/support_previously_seen_ec2_launches_by_user.json similarity index 100% rename from searches/support_previously_seen_ec2_launches_by_user.json rename to baselines/support_previously_seen_ec2_launches_by_user.json diff --git a/searches/support_previously_seen_ec2_modifications.json b/baselines/support_previously_seen_ec2_modifications.json similarity index 100% rename from searches/support_previously_seen_ec2_modifications.json rename to baselines/support_previously_seen_ec2_modifications.json diff --git a/searches/support_previously_seen_provisioning_activity_src.json b/baselines/support_previously_seen_provisioning_activity_src.json similarity index 100% rename from searches/support_previously_seen_provisioning_activity_src.json rename to baselines/support_previously_seen_provisioning_activity_src.json diff --git a/searches/support_previously_seen_s3_remote_ip.json b/baselines/support_previously_seen_s3_remote_ip.json similarity index 100% rename from searches/support_previously_seen_s3_remote_ip.json rename to baselines/support_previously_seen_s3_remote_ip.json diff --git a/searches/support_previously_seen_user_roles.json b/baselines/support_previously_seen_user_roles.json similarity index 100% rename from searches/support_previously_seen_user_roles.json rename to baselines/support_previously_seen_user_roles.json diff --git a/searches/support_previously_seen_users.json b/baselines/support_previously_seen_users.json similarity index 100% rename from searches/support_previously_seen_users.json rename to baselines/support_previously_seen_users.json diff --git a/searches/support_previously_seen_windows_service_starts.json b/baselines/support_previously_seen_windows_service_starts.json similarity index 100% rename from searches/support_previously_seen_windows_service_starts.json rename to baselines/support_previously_seen_windows_service_starts.json diff --git a/searches/support_systems_ready_for_spectre_meltdown_patch.json b/baselines/support_systems_ready_for_spectre_meltdown_patch.json similarity index 100% rename from searches/support_systems_ready_for_spectre_meltdown_patch.json rename to baselines/support_systems_ready_for_spectre_meltdown_patch.json diff --git a/bin/config.ini b/bin/config.ini deleted file mode 100644 index 894a621d2f..0000000000 --- a/bin/config.ini +++ /dev/null @@ -1,2 +0,0 @@ -[confluence] -url=https://confluence.splunk.com diff --git a/searches/detection_abnormally_high_instance_termination.json b/detections/detection_abnormally_high_instance_termination.json similarity index 100% rename from searches/detection_abnormally_high_instance_termination.json rename to detections/detection_abnormally_high_instance_termination.json diff --git a/searches/detection_abnormally_high_instances_launched.json b/detections/detection_abnormally_high_instances_launched.json similarity index 100% rename from searches/detection_abnormally_high_instances_launched.json rename to detections/detection_abnormally_high_instances_launched.json diff --git a/searches/detection_account_harvesting.json b/detections/detection_account_harvesting.json similarity index 100% rename from searches/detection_account_harvesting.json rename to detections/detection_account_harvesting.json diff --git a/searches/detection_acl_with_open_ports.json b/detections/detection_acl_with_open_ports.json similarity index 100% rename from searches/detection_acl_with_open_ports.json rename to detections/detection_acl_with_open_ports.json diff --git a/searches/detection_activity_related_to_pass_the_hash.json b/detections/detection_activity_related_to_pass_the_hash.json similarity index 100% rename from searches/detection_activity_related_to_pass_the_hash.json rename to detections/detection_activity_related_to_pass_the_hash.json diff --git a/searches/detection_add_to_untrust_cert_store.json b/detections/detection_add_to_untrust_cert_store.json similarity index 100% rename from searches/detection_add_to_untrust_cert_store.json rename to detections/detection_add_to_untrust_cert_store.json diff --git a/searches/detection_anomalous_webclick.json b/detections/detection_anomalous_webclick.json similarity index 100% rename from searches/detection_anomalous_webclick.json rename to detections/detection_anomalous_webclick.json diff --git a/searches/detection_api_acitivity_from_previously_unseen_user_role.json b/detections/detection_api_acitivity_from_previously_unseen_user_role.json similarity index 100% rename from searches/detection_api_acitivity_from_previously_unseen_user_role.json rename to detections/detection_api_acitivity_from_previously_unseen_user_role.json diff --git a/searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json b/detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json similarity index 100% rename from searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json rename to detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json diff --git a/searches/detection_attrib_to_hide_files.json b/detections/detection_attrib_to_hide_files.json similarity index 100% rename from searches/detection_attrib_to_hide_files.json rename to detections/detection_attrib_to_hide_files.json diff --git a/searches/detection_aws_activity_from_non_approved_accounts.json b/detections/detection_aws_activity_from_non_approved_accounts.json similarity index 100% rename from searches/detection_aws_activity_from_non_approved_accounts.json rename to detections/detection_aws_activity_from_non_approved_accounts.json diff --git a/searches/detection_aws_activity_in_new_region.json b/detections/detection_aws_activity_in_new_region.json similarity index 100% rename from searches/detection_aws_activity_in_new_region.json rename to detections/detection_aws_activity_in_new_region.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json diff --git a/searches/detection_aws_cross_account_activity_from_new_account.json b/detections/detection_aws_cross_account_activity_from_new_account.json similarity index 100% rename from searches/detection_aws_cross_account_activity_from_new_account.json rename to detections/detection_aws_cross_account_activity_from_new_account.json diff --git a/searches/detection_aws_spike_acl_activity.json b/detections/detection_aws_spike_acl_activity.json similarity index 100% rename from searches/detection_aws_spike_acl_activity.json rename to detections/detection_aws_spike_acl_activity.json diff --git a/searches/detection_badrabbit_schtasks.json b/detections/detection_badrabbit_schtasks.json similarity index 100% rename from searches/detection_badrabbit_schtasks.json rename to detections/detection_badrabbit_schtasks.json diff --git a/searches/detection_batch_file_write_system32.json b/detections/detection_batch_file_write_system32.json similarity index 100% rename from searches/detection_batch_file_write_system32.json rename to detections/detection_batch_file_write_system32.json diff --git a/searches/detection_brand_abuse_dns.json b/detections/detection_brand_abuse_dns.json similarity index 100% rename from searches/detection_brand_abuse_dns.json rename to detections/detection_brand_abuse_dns.json diff --git a/searches/detection_brand_abuse_email.json b/detections/detection_brand_abuse_email.json similarity index 100% rename from searches/detection_brand_abuse_email.json rename to detections/detection_brand_abuse_email.json diff --git a/searches/detection_brand_abuse_web.json b/detections/detection_brand_abuse_web.json similarity index 100% rename from searches/detection_brand_abuse_web.json rename to detections/detection_brand_abuse_web.json diff --git a/searches/detection_change_file_association.json b/detections/detection_change_file_association.json similarity index 100% rename from searches/detection_change_file_association.json rename to detections/detection_change_file_association.json diff --git a/searches/detection_children_of_spoolsv.json b/detections/detection_children_of_spoolsv.json similarity index 100% rename from searches/detection_children_of_spoolsv.json rename to detections/detection_children_of_spoolsv.json diff --git a/searches/detection_clients_connecting_to_multiple_dns_servers.json b/detections/detection_clients_connecting_to_multiple_dns_servers.json similarity index 100% rename from searches/detection_clients_connecting_to_multiple_dns_servers.json rename to detections/detection_clients_connecting_to_multiple_dns_servers.json diff --git a/searches/detection_common_ransomware_extensions.json b/detections/detection_common_ransomware_extensions.json similarity index 100% rename from searches/detection_common_ransomware_extensions.json rename to detections/detection_common_ransomware_extensions.json diff --git a/searches/detection_common_ransomware_notes.json b/detections/detection_common_ransomware_notes.json similarity index 100% rename from searches/detection_common_ransomware_notes.json rename to detections/detection_common_ransomware_notes.json diff --git a/searches/detection_create_hidden_shares.json b/detections/detection_create_hidden_shares.json similarity index 100% rename from searches/detection_create_hidden_shares.json rename to detections/detection_create_hidden_shares.json diff --git a/searches/detection_create_local_admin_via_net.json b/detections/detection_create_local_admin_via_net.json similarity index 100% rename from searches/detection_create_local_admin_via_net.json rename to detections/detection_create_local_admin_via_net.json diff --git a/searches/detection_cred_dump_via_reg.json b/detections/detection_cred_dump_via_reg.json similarity index 100% rename from searches/detection_cred_dump_via_reg.json rename to detections/detection_cred_dump_via_reg.json diff --git a/searches/detection_cscript_via_cmd.json b/detections/detection_cscript_via_cmd.json similarity index 100% rename from searches/detection_cscript_via_cmd.json rename to detections/detection_cscript_via_cmd.json diff --git a/searches/detection_delete_shadow_copies.json b/detections/detection_delete_shadow_copies.json similarity index 100% rename from searches/detection_delete_shadow_copies.json rename to detections/detection_delete_shadow_copies.json diff --git a/searches/detection_deletion_network_acl.json b/detections/detection_deletion_network_acl.json similarity index 100% rename from searches/detection_deletion_network_acl.json rename to detections/detection_deletion_network_acl.json diff --git a/searches/detection_disable_remote_uac.json b/detections/detection_disable_remote_uac.json similarity index 100% rename from searches/detection_disable_remote_uac.json rename to detections/detection_disable_remote_uac.json diff --git a/searches/detection_dns_amplification_any_query.json b/detections/detection_dns_amplification_any_query.json similarity index 100% rename from searches/detection_dns_amplification_any_query.json rename to detections/detection_dns_amplification_any_query.json diff --git a/searches/detection_dns_query_length_with_high_standard_deviation.json b/detections/detection_dns_query_length_with_high_standard_deviation.json similarity index 100% rename from searches/detection_dns_query_length_with_high_standard_deviation.json rename to detections/detection_dns_query_length_with_high_standard_deviation.json diff --git a/searches/detection_dns_record_changed.json b/detections/detection_dns_record_changed.json similarity index 100% rename from searches/detection_dns_record_changed.json rename to detections/detection_dns_record_changed.json diff --git a/searches/detection_dns_tunnelling.json b/detections/detection_dns_tunnelling.json similarity index 100% rename from searches/detection_dns_tunnelling.json rename to detections/detection_dns_tunnelling.json diff --git a/searches/detection_dragonfly_schtasks.json b/detections/detection_dragonfly_schtasks.json similarity index 100% rename from searches/detection_dragonfly_schtasks.json rename to detections/detection_dragonfly_schtasks.json diff --git a/searches/detection_dyn_dns_queries.json b/detections/detection_dyn_dns_queries.json similarity index 100% rename from searches/detection_dyn_dns_queries.json rename to detections/detection_dyn_dns_queries.json diff --git a/searches/detection_dyn_dns_web_traffic.json b/detections/detection_dyn_dns_web_traffic.json similarity index 100% rename from searches/detection_dyn_dns_web_traffic.json rename to detections/detection_dyn_dns_web_traffic.json diff --git a/searches/detection_ec2_instance_created_by_previously_unseen_user.json b/detections/detection_ec2_instance_created_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_created_by_previously_unseen_user.json rename to detections/detection_ec2_instance_created_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_modified_by_previously_unseen_user.json b/detections/detection_ec2_instance_modified_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_modified_by_previously_unseen_user.json rename to detections/detection_ec2_instance_modified_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_ami.json b/detections/detection_ec2_instance_started_with_previously_unseen_ami.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_ami.json rename to detections/detection_ec2_instance_started_with_previously_unseen_ami.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json b/detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json rename to detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json diff --git a/searches/detection_email_attachments_with_spaces.json b/detections/detection_email_attachments_with_spaces.json similarity index 100% rename from searches/detection_email_attachments_with_spaces.json rename to detections/detection_email_attachments_with_spaces.json diff --git a/searches/detection_email_files_not_in_outlook_directory.json b/detections/detection_email_files_not_in_outlook_directory.json similarity index 100% rename from searches/detection_email_files_not_in_outlook_directory.json rename to detections/detection_email_files_not_in_outlook_directory.json diff --git a/searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json b/detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json similarity index 100% rename from searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json rename to detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json diff --git a/searches/detection_excessive_dns_failures.json b/detections/detection_excessive_dns_failures.json similarity index 100% rename from searches/detection_excessive_dns_failures.json rename to detections/detection_excessive_dns_failures.json diff --git a/searches/detection_excessive_lockouts_from_endpoint.json b/detections/detection_excessive_lockouts_from_endpoint.json similarity index 100% rename from searches/detection_excessive_lockouts_from_endpoint.json rename to detections/detection_excessive_lockouts_from_endpoint.json diff --git a/searches/detection_excessive_user_account_lockouts.json b/detections/detection_excessive_user_account_lockouts.json similarity index 100% rename from searches/detection_excessive_user_account_lockouts.json rename to detections/detection_excessive_user_account_lockouts.json diff --git a/searches/detection_execution_of_nirsoft_tools.json b/detections/detection_execution_of_nirsoft_tools.json similarity index 100% rename from searches/detection_execution_of_nirsoft_tools.json rename to detections/detection_execution_of_nirsoft_tools.json diff --git a/searches/detection_file_write_spikes.json b/detections/detection_file_write_spikes.json similarity index 100% rename from searches/detection_file_write_spikes.json rename to detections/detection_file_write_spikes.json diff --git a/searches/detection_first_time_seen_cmd_line.json b/detections/detection_first_time_seen_cmd_line.json similarity index 100% rename from searches/detection_first_time_seen_cmd_line.json rename to detections/detection_first_time_seen_cmd_line.json diff --git a/searches/detection_first_time_seen_running_windows_service.json b/detections/detection_first_time_seen_running_windows_service.json similarity index 100% rename from searches/detection_first_time_seen_running_windows_service.json rename to detections/detection_first_time_seen_running_windows_service.json diff --git a/searches/detection_fsutil_deleting_journals.json b/detections/detection_fsutil_deleting_journals.json similarity index 100% rename from searches/detection_fsutil_deleting_journals.json rename to detections/detection_fsutil_deleting_journals.json diff --git a/searches/detection_hosts_file_modification.json b/detections/detection_hosts_file_modification.json similarity index 100% rename from searches/detection_hosts_file_modification.json rename to detections/detection_hosts_file_modification.json diff --git a/searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json b/detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json similarity index 100% rename from searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json rename to detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json diff --git a/searches/detection_large_icmp_outbound.json b/detections/detection_large_icmp_outbound.json similarity index 100% rename from searches/detection_large_icmp_outbound.json rename to detections/detection_large_icmp_outbound.json diff --git a/searches/detection_local_admin_account_creation.json b/detections/detection_local_admin_account_creation.json similarity index 100% rename from searches/detection_local_admin_account_creation.json rename to detections/detection_local_admin_account_creation.json diff --git a/searches/detection_long_dns_text_response.json b/detections/detection_long_dns_text_response.json similarity index 100% rename from searches/detection_long_dns_text_response.json rename to detections/detection_long_dns_text_response.json diff --git a/searches/detection_malicious_application_shimming_via_registry.json b/detections/detection_malicious_application_shimming_via_registry.json similarity index 100% rename from searches/detection_malicious_application_shimming_via_registry.json rename to detections/detection_malicious_application_shimming_via_registry.json diff --git a/searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json b/detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json similarity index 100% rename from searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json rename to detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json diff --git a/searches/detection_malicious_powershell_process_encoded_command.json b/detections/detection_malicious_powershell_process_encoded_command.json similarity index 100% rename from searches/detection_malicious_powershell_process_encoded_command.json rename to detections/detection_malicious_powershell_process_encoded_command.json diff --git a/searches/detection_malicious_powershell_process_execpolicy.json b/detections/detection_malicious_powershell_process_execpolicy.json similarity index 100% rename from searches/detection_malicious_powershell_process_execpolicy.json rename to detections/detection_malicious_powershell_process_execpolicy.json diff --git a/searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json b/detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json similarity index 100% rename from searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json rename to detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json diff --git a/searches/detection_malicious_powershell_process_obfuscation_techniques.json b/detections/detection_malicious_powershell_process_obfuscation_techniques.json similarity index 100% rename from searches/detection_malicious_powershell_process_obfuscation_techniques.json rename to detections/detection_malicious_powershell_process_obfuscation_techniques.json diff --git a/searches/detection_malicious_requests_to_exploit_jboss_servers.json b/detections/detection_malicious_requests_to_exploit_jboss_servers.json similarity index 100% rename from searches/detection_malicious_requests_to_exploit_jboss_servers.json rename to detections/detection_malicious_requests_to_exploit_jboss_servers.json diff --git a/searches/detection_mshta_launching_scripts.json b/detections/detection_mshta_launching_scripts.json similarity index 100% rename from searches/detection_mshta_launching_scripts.json rename to detections/detection_mshta_launching_scripts.json diff --git a/searches/detection_netbackup_failed_backup.json b/detections/detection_netbackup_failed_backup.json similarity index 100% rename from searches/detection_netbackup_failed_backup.json rename to detections/detection_netbackup_failed_backup.json diff --git a/searches/detection_netbackup_no_backups_in_time_period.json b/detections/detection_netbackup_no_backups_in_time_period.json similarity index 100% rename from searches/detection_netbackup_no_backups_in_time_period.json rename to detections/detection_netbackup_no_backups_in_time_period.json diff --git a/searches/detection_netsh_launching_process.json b/detections/detection_netsh_launching_process.json similarity index 100% rename from searches/detection_netsh_launching_process.json rename to detections/detection_netsh_launching_process.json diff --git a/searches/detection_new_aws_console_login_by_user.json b/detections/detection_new_aws_console_login_by_user.json similarity index 100% rename from searches/detection_new_aws_console_login_by_user.json rename to detections/detection_new_aws_console_login_by_user.json diff --git a/searches/detection_new_connections_to_routers.json b/detections/detection_new_connections_to_routers.json similarity index 100% rename from searches/detection_new_connections_to_routers.json rename to detections/detection_new_connections_to_routers.json diff --git a/searches/detection_new_open_s3_buckets.json b/detections/detection_new_open_s3_buckets.json similarity index 100% rename from searches/detection_new_open_s3_buckets.json rename to detections/detection_new_open_s3_buckets.json diff --git a/searches/detection_new_user_accounts.json b/detections/detection_new_user_accounts.json similarity index 100% rename from searches/detection_new_user_accounts.json rename to detections/detection_new_user_accounts.json diff --git a/searches/detection_no_win_updates_in_timeframe.json b/detections/detection_no_win_updates_in_timeframe.json similarity index 100% rename from searches/detection_no_win_updates_in_timeframe.json rename to detections/detection_no_win_updates_in_timeframe.json diff --git a/searches/detection_open_redirect_in_splunk_web.json b/detections/detection_open_redirect_in_splunk_web.json similarity index 100% rename from searches/detection_open_redirect_in_splunk_web.json rename to detections/detection_open_redirect_in_splunk_web.json diff --git a/searches/detection_osx_coldroot_pack.json b/detections/detection_osx_coldroot_pack.json similarity index 100% rename from searches/detection_osx_coldroot_pack.json rename to detections/detection_osx_coldroot_pack.json diff --git a/searches/detection_osx_keyboard_taps.json b/detections/detection_osx_keyboard_taps.json similarity index 100% rename from searches/detection_osx_keyboard_taps.json rename to detections/detection_osx_keyboard_taps.json diff --git a/searches/detection_outbound_smb_connections.json b/detections/detection_outbound_smb_connections.json similarity index 100% rename from searches/detection_outbound_smb_connections.json rename to detections/detection_outbound_smb_connections.json diff --git a/searches/detection_overwrite_accessibility_binaries.json b/detections/detection_overwrite_accessibility_binaries.json similarity index 100% rename from searches/detection_overwrite_accessibility_binaries.json rename to detections/detection_overwrite_accessibility_binaries.json diff --git a/searches/detection_password_sharing.json b/detections/detection_password_sharing.json similarity index 100% rename from searches/detection_password_sharing.json rename to detections/detection_password_sharing.json diff --git a/searches/detection_path_interception_program.exe.json b/detections/detection_path_interception_program.exe.json similarity index 100% rename from searches/detection_path_interception_program.exe.json rename to detections/detection_path_interception_program.exe.json diff --git a/searches/detection_port_monitor_via_registry.json b/detections/detection_port_monitor_via_registry.json similarity index 100% rename from searches/detection_port_monitor_via_registry.json rename to detections/detection_port_monitor_via_registry.json diff --git a/searches/detection_powershell_get_sedebug.json b/detections/detection_powershell_get_sedebug.json similarity index 100% rename from searches/detection_powershell_get_sedebug.json rename to detections/detection_powershell_get_sedebug.json diff --git a/searches/detection_powershell_read_from_lsass.json b/detections/detection_powershell_read_from_lsass.json similarity index 100% rename from searches/detection_powershell_read_from_lsass.json rename to detections/detection_powershell_read_from_lsass.json diff --git a/searches/detection_powershell_reg_key_mod.json b/detections/detection_powershell_reg_key_mod.json similarity index 100% rename from searches/detection_powershell_reg_key_mod.json rename to detections/detection_powershell_reg_key_mod.json diff --git a/searches/detection_process_launching_netsh.json b/detections/detection_process_launching_netsh.json similarity index 100% rename from searches/detection_process_launching_netsh.json rename to detections/detection_process_launching_netsh.json diff --git a/searches/detection_process_with_double_extension.json b/detections/detection_process_with_double_extension.json similarity index 100% rename from searches/detection_process_with_double_extension.json rename to detections/detection_process_with_double_extension.json diff --git a/searches/detection_process_with_spaces_before_extension.json b/detections/detection_process_with_spaces_before_extension.json similarity index 100% rename from searches/detection_process_with_spaces_before_extension.json rename to detections/detection_process_with_spaces_before_extension.json diff --git a/searches/detection_prohibited_allowed_through_fw.json b/detections/detection_prohibited_allowed_through_fw.json similarity index 100% rename from searches/detection_prohibited_allowed_through_fw.json rename to detections/detection_prohibited_allowed_through_fw.json diff --git a/searches/detection_prohibited_apps_spawning_cmdprompt.json b/detections/detection_prohibited_apps_spawning_cmdprompt.json similarity index 100% rename from searches/detection_prohibited_apps_spawning_cmdprompt.json rename to detections/detection_prohibited_apps_spawning_cmdprompt.json diff --git a/searches/detection_prohibited_software_on_endpoint.json b/detections/detection_prohibited_software_on_endpoint.json similarity index 100% rename from searches/detection_prohibited_software_on_endpoint.json rename to detections/detection_prohibited_software_on_endpoint.json diff --git a/searches/detection_protocol_mismatch.json b/detections/detection_protocol_mismatch.json similarity index 100% rename from searches/detection_protocol_mismatch.json rename to detections/detection_protocol_mismatch.json diff --git a/searches/detection_protocols_authenticating_in_cleartext.json b/detections/detection_protocols_authenticating_in_cleartext.json similarity index 100% rename from searches/detection_protocols_authenticating_in_cleartext.json rename to detections/detection_protocols_authenticating_in_cleartext.json diff --git a/searches/detection_psexec_accepteula.json b/detections/detection_psexec_accepteula.json similarity index 100% rename from searches/detection_psexec_accepteula.json rename to detections/detection_psexec_accepteula.json diff --git a/searches/detection_rare_executables_on_endpoint.json b/detections/detection_rare_executables_on_endpoint.json similarity index 100% rename from searches/detection_rare_executables_on_endpoint.json rename to detections/detection_rare_executables_on_endpoint.json diff --git a/searches/detection_reg_manipulating_services.json b/detections/detection_reg_manipulating_services.json similarity index 100% rename from searches/detection_reg_manipulating_services.json rename to detections/detection_reg_manipulating_services.json diff --git a/searches/detection_reg_used_to_hide_files.json b/detections/detection_reg_used_to_hide_files.json similarity index 100% rename from searches/detection_reg_used_to_hide_files.json rename to detections/detection_reg_used_to_hide_files.json diff --git a/searches/detection_registry_persistence.json b/detections/detection_registry_persistence.json similarity index 100% rename from searches/detection_registry_persistence.json rename to detections/detection_registry_persistence.json diff --git a/searches/detection_registry_privilege_escalation.json b/detections/detection_registry_privilege_escalation.json similarity index 100% rename from searches/detection_registry_privilege_escalation.json rename to detections/detection_registry_privilege_escalation.json diff --git a/searches/detection_remote_desktop_bruteforce.json b/detections/detection_remote_desktop_bruteforce.json similarity index 100% rename from searches/detection_remote_desktop_bruteforce.json rename to detections/detection_remote_desktop_bruteforce.json diff --git a/searches/detection_remote_desktop_network_traffic.json b/detections/detection_remote_desktop_network_traffic.json similarity index 100% rename from searches/detection_remote_desktop_network_traffic.json rename to detections/detection_remote_desktop_network_traffic.json diff --git a/searches/detection_remote_desktop_process_running_on_system.json b/detections/detection_remote_desktop_process_running_on_system.json similarity index 100% rename from searches/detection_remote_desktop_process_running_on_system.json rename to detections/detection_remote_desktop_process_running_on_system.json diff --git a/searches/detection_remote_registry_modifications.json b/detections/detection_remote_registry_modifications.json similarity index 100% rename from searches/detection_remote_registry_modifications.json rename to detections/detection_remote_registry_modifications.json diff --git a/searches/detection_remote_wmi_command_attempt.json b/detections/detection_remote_wmi_command_attempt.json similarity index 100% rename from searches/detection_remote_wmi_command_attempt.json rename to detections/detection_remote_wmi_command_attempt.json diff --git a/searches/detection_remote_wmi_process_instantiation.json b/detections/detection_remote_wmi_process_instantiation.json similarity index 100% rename from searches/detection_remote_wmi_process_instantiation.json rename to detections/detection_remote_wmi_process_instantiation.json diff --git a/searches/detection_rundll_loading_dll_by_ordinal.json b/detections/detection_rundll_loading_dll_by_ordinal.json similarity index 100% rename from searches/detection_rundll_loading_dll_by_ordinal.json rename to detections/detection_rundll_loading_dll_by_ordinal.json diff --git a/searches/detection_s3_access_from_new_ip.json b/detections/detection_s3_access_from_new_ip.json similarity index 100% rename from searches/detection_s3_access_from_new_ip.json rename to detections/detection_s3_access_from_new_ip.json diff --git a/searches/detection_samsam_payload_extensions.json b/detections/detection_samsam_payload_extensions.json similarity index 100% rename from searches/detection_samsam_payload_extensions.json rename to detections/detection_samsam_payload_extensions.json diff --git a/searches/detection_samsam_test_file_write.json b/detections/detection_samsam_test_file_write.json similarity index 100% rename from searches/detection_samsam_test_file_write.json rename to detections/detection_samsam_test_file_write.json diff --git a/searches/detection_sc_manipulating_services.json b/detections/detection_sc_manipulating_services.json similarity index 100% rename from searches/detection_sc_manipulating_services.json rename to detections/detection_sc_manipulating_services.json diff --git a/searches/detection_schtasks_forced_reboot.json b/detections/detection_schtasks_forced_reboot.json similarity index 100% rename from searches/detection_schtasks_forced_reboot.json rename to detections/detection_schtasks_forced_reboot.json diff --git a/searches/detection_schtasks_scheduling_job_on_remote_system.json b/detections/detection_schtasks_scheduling_job_on_remote_system.json similarity index 100% rename from searches/detection_schtasks_scheduling_job_on_remote_system.json rename to detections/detection_schtasks_scheduling_job_on_remote_system.json diff --git a/searches/detection_shim_database_file_creation.json b/detections/detection_shim_database_file_creation.json similarity index 100% rename from searches/detection_shim_database_file_creation.json rename to detections/detection_shim_database_file_creation.json diff --git a/searches/detection_shim_database_installation.json b/detections/detection_shim_database_installation.json similarity index 100% rename from searches/detection_shim_database_installation.json rename to detections/detection_shim_database_installation.json diff --git a/searches/detection_short_lived_accounts.json b/detections/detection_short_lived_accounts.json similarity index 100% rename from searches/detection_short_lived_accounts.json rename to detections/detection_short_lived_accounts.json diff --git a/searches/detection_single_letter_executables.json b/detections/detection_single_letter_executables.json similarity index 100% rename from searches/detection_single_letter_executables.json rename to detections/detection_single_letter_executables.json diff --git a/searches/detection_smb_traffic_spike.json b/detections/detection_smb_traffic_spike.json similarity index 100% rename from searches/detection_smb_traffic_spike.json rename to detections/detection_smb_traffic_spike.json diff --git a/searches/detection_sncd_processes.json b/detections/detection_sncd_processes.json similarity index 100% rename from searches/detection_sncd_processes.json rename to detections/detection_sncd_processes.json diff --git a/searches/detection_spectre_meltdown_vulnerabilities.json b/detections/detection_spectre_meltdown_vulnerabilities.json similarity index 100% rename from searches/detection_spectre_meltdown_vulnerabilities.json rename to detections/detection_spectre_meltdown_vulnerabilities.json diff --git a/searches/detection_spike_aws_api_call_per_account.json b/detections/detection_spike_aws_api_call_per_account.json similarity index 100% rename from searches/detection_spike_aws_api_call_per_account.json rename to detections/detection_spike_aws_api_call_per_account.json diff --git a/searches/detection_spike_aws_security_group_activity.json b/detections/detection_spike_aws_security_group_activity.json similarity index 100% rename from searches/detection_spike_aws_security_group_activity.json rename to detections/detection_spike_aws_security_group_activity.json diff --git a/searches/detection_spike_s3_deletion.json b/detections/detection_spike_s3_deletion.json similarity index 100% rename from searches/detection_spike_s3_deletion.json rename to detections/detection_spike_s3_deletion.json diff --git a/searches/detection_spike_vpc_blocked_traffic.json b/detections/detection_spike_vpc_blocked_traffic.json similarity index 100% rename from searches/detection_spike_vpc_blocked_traffic.json rename to detections/detection_spike_vpc_blocked_traffic.json diff --git a/searches/detection_splunk_information_disclosure.json b/detections/detection_splunk_information_disclosure.json similarity index 100% rename from searches/detection_splunk_information_disclosure.json rename to detections/detection_splunk_information_disclosure.json diff --git a/searches/detection_sql_injection_with_long_urls.json b/detections/detection_sql_injection_with_long_urls.json similarity index 100% rename from searches/detection_sql_injection_with_long_urls.json rename to detections/detection_sql_injection_with_long_urls.json diff --git a/searches/detection_stop_security_services.json b/detections/detection_stop_security_services.json similarity index 100% rename from searches/detection_stop_security_services.json rename to detections/detection_stop_security_services.json diff --git a/searches/detection_suspicious_email_attachments.json b/detections/detection_suspicious_email_attachments.json similarity index 100% rename from searches/detection_suspicious_email_attachments.json rename to detections/detection_suspicious_email_attachments.json diff --git a/searches/detection_suspicious_file_writes.json b/detections/detection_suspicious_file_writes.json similarity index 100% rename from searches/detection_suspicious_file_writes.json rename to detections/detection_suspicious_file_writes.json diff --git a/searches/detection_suspicious_java_classes.json b/detections/detection_suspicious_java_classes.json similarity index 100% rename from searches/detection_suspicious_java_classes.json rename to detections/detection_suspicious_java_classes.json diff --git a/searches/detection_suspicious_reg_process.json b/detections/detection_suspicious_reg_process.json similarity index 100% rename from searches/detection_suspicious_reg_process.json rename to detections/detection_suspicious_reg_process.json diff --git a/searches/detection_suspicious_wevtutil_usage.json b/detections/detection_suspicious_wevtutil_usage.json similarity index 100% rename from searches/detection_suspicious_wevtutil_usage.json rename to detections/detection_suspicious_wevtutil_usage.json diff --git a/searches/detection_suspicious_write_to_recycler.json b/detections/detection_suspicious_write_to_recycler.json similarity index 100% rename from searches/detection_suspicious_write_to_recycler.json rename to detections/detection_suspicious_write_to_recycler.json diff --git a/searches/detection_suspicious_write_to_sysvol.json b/detections/detection_suspicious_write_to_sysvol.json similarity index 100% rename from searches/detection_suspicious_write_to_sysvol.json rename to detections/detection_suspicious_write_to_sysvol.json diff --git a/searches/detection_system_processes_run_from_unexpected_locations.json b/detections/detection_system_processes_run_from_unexpected_locations.json similarity index 100% rename from searches/detection_system_processes_run_from_unexpected_locations.json rename to detections/detection_system_processes_run_from_unexpected_locations.json diff --git a/searches/detection_tor_traffic.json b/detections/detection_tor_traffic.json similarity index 100% rename from searches/detection_tor_traffic.json rename to detections/detection_tor_traffic.json diff --git a/searches/detection_unauthorized_assets_via_mac_address.json b/detections/detection_unauthorized_assets_via_mac_address.json similarity index 100% rename from searches/detection_unauthorized_assets_via_mac_address.json rename to detections/detection_unauthorized_assets_via_mac_address.json diff --git a/searches/detection_unauthorized_dns_servers.json b/detections/detection_unauthorized_dns_servers.json similarity index 100% rename from searches/detection_unauthorized_dns_servers.json rename to detections/detection_unauthorized_dns_servers.json diff --git a/searches/detection_uncommon_processes.json b/detections/detection_uncommon_processes.json similarity index 100% rename from searches/detection_uncommon_processes.json rename to detections/detection_uncommon_processes.json diff --git a/searches/detection_unusually_long_commandlines.json b/detections/detection_unusually_long_commandlines.json similarity index 100% rename from searches/detection_unusually_long_commandlines.json rename to detections/detection_unusually_long_commandlines.json diff --git a/searches/detection_unusually_long_content-type_length.json b/detections/detection_unusually_long_content-type_length.json similarity index 100% rename from searches/detection_unusually_long_content-type_length.json rename to detections/detection_unusually_long_content-type_length.json diff --git a/searches/detection_usb_insertion.json b/detections/detection_usb_insertion.json similarity index 100% rename from searches/detection_usb_insertion.json rename to detections/detection_usb_insertion.json diff --git a/searches/detection_users_without_mfa.json b/detections/detection_users_without_mfa.json similarity index 100% rename from searches/detection_users_without_mfa.json rename to detections/detection_users_without_mfa.json diff --git a/searches/detection_web_servers_executing_suspicious_processes.json b/detections/detection_web_servers_executing_suspicious_processes.json similarity index 100% rename from searches/detection_web_servers_executing_suspicious_processes.json rename to detections/detection_web_servers_executing_suspicious_processes.json diff --git a/searches/detection_windows_event_log_cleared.json b/detections/detection_windows_event_log_cleared.json similarity index 100% rename from searches/detection_windows_event_log_cleared.json rename to detections/detection_windows_event_log_cleared.json diff --git a/searches/detection_wmi_perm_event_subscription.json b/detections/detection_wmi_perm_event_subscription.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription.json rename to detections/detection_wmi_perm_event_subscription.json diff --git a/searches/detection_wmi_perm_event_subscription_sysmon.json b/detections/detection_wmi_perm_event_subscription_sysmon.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription_sysmon.json rename to detections/detection_wmi_perm_event_subscription_sysmon.json diff --git a/searches/detection_wmi_process_launch.json b/detections/detection_wmi_process_launch.json similarity index 100% rename from searches/detection_wmi_process_launch.json rename to detections/detection_wmi_process_launch.json diff --git a/searches/detection_wmi_script_execution.json b/detections/detection_wmi_script_execution.json similarity index 100% rename from searches/detection_wmi_script_execution.json rename to detections/detection_wmi_script_execution.json diff --git a/searches/detection_wmi_temp_event_subscription.json b/detections/detection_wmi_temp_event_subscription.json similarity index 100% rename from searches/detection_wmi_temp_event_subscription.json rename to detections/detection_wmi_temp_event_subscription.json diff --git a/searches/contextual_aws_network_interface_details.json b/investigations/contextual_aws_network_interface_details.json similarity index 100% rename from searches/contextual_aws_network_interface_details.json rename to investigations/contextual_aws_network_interface_details.json diff --git a/searches/contextual_aws_s3_bucket_details.json b/investigations/contextual_aws_s3_bucket_details.json similarity index 100% rename from searches/contextual_aws_s3_bucket_details.json rename to investigations/contextual_aws_s3_bucket_details.json diff --git a/searches/contextual_first_occurrence_mac_address.json b/investigations/contextual_first_occurrence_mac_address.json similarity index 100% rename from searches/contextual_first_occurrence_mac_address.json rename to investigations/contextual_first_occurrence_mac_address.json diff --git a/searches/contextual_get_acl_details.json b/investigations/contextual_get_acl_details.json similarity index 100% rename from searches/contextual_get_acl_details.json rename to investigations/contextual_get_acl_details.json diff --git a/searches/contextual_get_authentication_logs_for_endpoint.json b/investigations/contextual_get_authentication_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_authentication_logs_for_endpoint.json rename to investigations/contextual_get_authentication_logs_for_endpoint.json diff --git a/searches/contextual_get_backup_logs_for_endpoint.json b/investigations/contextual_get_backup_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_backup_logs_for_endpoint.json rename to investigations/contextual_get_backup_logs_for_endpoint.json diff --git a/searches/contextual_get_ec2_details_by_instance_id.json b/investigations/contextual_get_ec2_details_by_instance_id.json similarity index 100% rename from searches/contextual_get_ec2_details_by_instance_id.json rename to investigations/contextual_get_ec2_details_by_instance_id.json diff --git a/searches/contextual_get_ec2_launch_details.json b/investigations/contextual_get_ec2_launch_details.json similarity index 100% rename from searches/contextual_get_ec2_launch_details.json rename to investigations/contextual_get_ec2_launch_details.json diff --git a/searches/contextual_get_notable_history_for_endpoint.json b/investigations/contextual_get_notable_history_for_endpoint.json similarity index 100% rename from searches/contextual_get_notable_history_for_endpoint.json rename to investigations/contextual_get_notable_history_for_endpoint.json diff --git a/searches/contextual_get_notable_info.json b/investigations/contextual_get_notable_info.json similarity index 100% rename from searches/contextual_get_notable_info.json rename to investigations/contextual_get_notable_info.json diff --git a/searches/contextual_get_risk_for_endpoint.json b/investigations/contextual_get_risk_for_endpoint.json similarity index 100% rename from searches/contextual_get_risk_for_endpoint.json rename to investigations/contextual_get_risk_for_endpoint.json diff --git a/searches/contextual_get_risk_for_user.json b/investigations/contextual_get_risk_for_user.json similarity index 100% rename from searches/contextual_get_risk_for_user.json rename to investigations/contextual_get_risk_for_user.json diff --git a/searches/contextual_get_update_logs_for_endpoint.json b/investigations/contextual_get_update_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_update_logs_for_endpoint.json rename to investigations/contextual_get_update_logs_for_endpoint.json diff --git a/searches/contextual_get_user_info_from_identity_table.json b/investigations/contextual_get_user_info_from_identity_table.json similarity index 100% rename from searches/contextual_get_user_info_from_identity_table.json rename to investigations/contextual_get_user_info_from_identity_table.json diff --git a/searches/contextual_get_vulnerability_logs_for_endpoint.json b/investigations/contextual_get_vulnerability_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_vulnerability_logs_for_endpoint.json rename to investigations/contextual_get_vulnerability_logs_for_endpoint.json diff --git a/searches/investigative_aws_activity_via_region.json b/investigations/investigative_aws_activity_via_region.json similarity index 100% rename from searches/investigative_aws_activity_via_region.json rename to investigations/investigative_aws_activity_via_region.json diff --git a/searches/investigative_aws_user_activities_by_user_field.json b/investigations/investigative_aws_user_activities_by_user_field.json similarity index 100% rename from searches/investigative_aws_user_activities_by_user_field.json rename to investigations/investigative_aws_user_activities_by_user_field.json diff --git a/searches/investigative_aws_user_activity_by_accesskeyid.json b/investigations/investigative_aws_user_activity_by_accesskeyid.json similarity index 100% rename from searches/investigative_aws_user_activity_by_accesskeyid.json rename to investigations/investigative_aws_user_activity_by_accesskeyid.json diff --git a/searches/investigative_aws_user_activity_by_src_user.json b/investigations/investigative_aws_user_activity_by_src_user.json similarity index 100% rename from searches/investigative_aws_user_activity_by_src_user.json rename to investigations/investigative_aws_user_activity_by_src_user.json diff --git a/searches/investigative_dns_server_history.json b/investigations/investigative_dns_server_history.json similarity index 100% rename from searches/investigative_dns_server_history.json rename to investigations/investigative_dns_server_history.json diff --git a/searches/investigative_dns_traffic_stats.json b/investigations/investigative_dns_traffic_stats.json similarity index 100% rename from searches/investigative_dns_traffic_stats.json rename to investigations/investigative_dns_traffic_stats.json diff --git a/searches/investigative_email_sent_to_hidden_cobra_actors.json b/investigations/investigative_email_sent_to_hidden_cobra_actors.json similarity index 100% rename from searches/investigative_email_sent_to_hidden_cobra_actors.json rename to investigations/investigative_email_sent_to_hidden_cobra_actors.json diff --git a/searches/investigative_get_all_aws_activitiy_from_city.json b/investigations/investigative_get_all_aws_activitiy_from_city.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_city.json rename to investigations/investigative_get_all_aws_activitiy_from_city.json diff --git a/searches/investigative_get_all_aws_activitiy_from_country.json b/investigations/investigative_get_all_aws_activitiy_from_country.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_country.json rename to investigations/investigative_get_all_aws_activitiy_from_country.json diff --git a/searches/investigative_get_all_aws_activitiy_from_region.json b/investigations/investigative_get_all_aws_activitiy_from_region.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_region.json rename to investigations/investigative_get_all_aws_activitiy_from_region.json diff --git a/searches/investigative_get_all_aws_activitiy_from_src_ip.json b/investigations/investigative_get_all_aws_activitiy_from_src_ip.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_src_ip.json rename to investigations/investigative_get_all_aws_activitiy_from_src_ip.json diff --git a/searches/investigative_get_all_backup_data_for_host.json b/investigations/investigative_get_all_backup_data_for_host.json similarity index 100% rename from searches/investigative_get_all_backup_data_for_host.json rename to investigations/investigative_get_all_backup_data_for_host.json diff --git a/searches/investigative_get_email_info.json b/investigations/investigative_get_email_info.json similarity index 100% rename from searches/investigative_get_email_info.json rename to investigations/investigative_get_email_info.json diff --git a/searches/investigative_get_emails_from_sender.json b/investigations/investigative_get_emails_from_sender.json similarity index 100% rename from searches/investigative_get_emails_from_sender.json rename to investigations/investigative_get_emails_from_sender.json diff --git a/searches/investigative_get_emails_from_source.json b/investigations/investigative_get_emails_from_source.json similarity index 100% rename from searches/investigative_get_emails_from_source.json rename to investigations/investigative_get_emails_from_source.json diff --git a/searches/investigative_get_logon_rights_modifications_for_endpoint.json b/investigations/investigative_get_logon_rights_modifications_for_endpoint.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_endpoint.json rename to investigations/investigative_get_logon_rights_modifications_for_endpoint.json diff --git a/searches/investigative_get_logon_rights_modifications_for_user.json b/investigations/investigative_get_logon_rights_modifications_for_user.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_user.json rename to investigations/investigative_get_logon_rights_modifications_for_user.json diff --git a/searches/investigative_get_network_traffic_from_src_ip.json b/investigations/investigative_get_network_traffic_from_src_ip.json similarity index 100% rename from searches/investigative_get_network_traffic_from_src_ip.json rename to investigations/investigative_get_network_traffic_from_src_ip.json diff --git a/searches/investigative_get_parent_process_info.json b/investigations/investigative_get_parent_process_info.json similarity index 100% rename from searches/investigative_get_parent_process_info.json rename to investigations/investigative_get_parent_process_info.json diff --git a/searches/investigative_get_process_creating_dns_traffic.json b/investigations/investigative_get_process_creating_dns_traffic.json similarity index 100% rename from searches/investigative_get_process_creating_dns_traffic.json rename to investigations/investigative_get_process_creating_dns_traffic.json diff --git a/searches/investigative_get_process_info.json b/investigations/investigative_get_process_info.json similarity index 100% rename from searches/investigative_get_process_info.json rename to investigations/investigative_get_process_info.json diff --git a/searches/investigative_get_process_info_for_port.json b/investigations/investigative_get_process_info_for_port.json similarity index 100% rename from searches/investigative_get_process_info_for_port.json rename to investigations/investigative_get_process_info_for_port.json diff --git a/searches/investigative_get_rdp_authentications.json b/investigations/investigative_get_rdp_authentications.json similarity index 100% rename from searches/investigative_get_rdp_authentications.json rename to investigations/investigative_get_rdp_authentications.json diff --git a/searches/investigative_get_registry_activities.json b/investigations/investigative_get_registry_activities.json similarity index 100% rename from searches/investigative_get_registry_activities.json rename to investigations/investigative_get_registry_activities.json diff --git a/searches/investigative_get_web_activity.json b/investigations/investigative_get_web_activity.json similarity index 100% rename from searches/investigative_get_web_activity.json rename to investigations/investigative_get_web_activity.json diff --git a/searches/investigative_get_web_activity_by_src_ip.json b/investigations/investigative_get_web_activity_by_src_ip.json similarity index 100% rename from searches/investigative_get_web_activity_by_src_ip.json rename to investigations/investigative_get_web_activity_by_src_ip.json diff --git a/searches/investigative_get_web_posts_by_src.json b/investigations/investigative_get_web_posts_by_src.json similarity index 100% rename from searches/investigative_get_web_posts_by_src.json rename to investigations/investigative_get_web_posts_by_src.json diff --git a/searches/investigative_get_web_session_info.json b/investigations/investigative_get_web_session_info.json similarity index 100% rename from searches/investigative_get_web_session_info.json rename to investigations/investigative_get_web_session_info.json diff --git a/searches/investigative_get_wmi_sysmon_events.json b/investigations/investigative_get_wmi_sysmon_events.json similarity index 100% rename from searches/investigative_get_wmi_sysmon_events.json rename to investigations/investigative_get_wmi_sysmon_events.json diff --git a/searches/investigative_suspicious_strings_in_HTTP_header.json b/investigations/investigative_suspicious_strings_in_HTTP_header.json similarity index 100% rename from searches/investigative_suspicious_strings_in_HTTP_header.json rename to investigations/investigative_suspicious_strings_in_HTTP_header.json diff --git a/searches/investigative_user_activity_via_cloudtrail.json b/investigations/investigative_user_activity_via_cloudtrail.json similarity index 100% rename from searches/investigative_user_activity_via_cloudtrail.json rename to investigations/investigative_user_activity_via_cloudtrail.json