Currently just enabling them via Enterprise Security Content Management UI, not cloning them out unless we have a very specific logic change that would need to be made for our environment. The searches are still knowledge objects owned by ESCU.
... View more
Is there a way to bulk update enabled ESCU detections when a new version with a lot of metadata changes like the MITRE changes in 5.27 are released? (This is with version detection enabled, ES version 8.3.0)
... View more