This can be handy for dumping a list of installed ES correlation searches with disabled status, description, frameworks etc. Be sure your use has the permissions to all knowledge objects if you don't see any you are know are present in an app context.
| rest splunk_server=local count=0 /servicesNS/-/-/saved/searches
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| rename title as search_name, eai:acl.app as app, action.correlationsearch.annotations as frameworks
| table search_name, app, description, frameworks, disabled
| spath input=frameworks
| rename mitre_attack{} as mitre_attack, nist{} as nist, cis20{} as cis20, kill_chain_phases{} as kill_chain_phases
| table app, search_name, description, disabled, cis, kill_chain_phases, nist, mitre_attack
