This query can set up an alert for when ESCU updates a detection, compared to the version you are using from clone. This requires ESCU v4.31.0 with the new metadata information being used.
| rest splunk_server=local count=0 /servicesNS/-/-/saved/searches
| search action.notable.param.rule_title=* action.correlationsearch.metadata=* disabled=0
| rex field=action.correlationsearch.metadata "\"detection_id\": \"(?P<detection_id>.{8}-.{4}-.{4}-.{4}-.{12})"
| rex field=action.correlationsearch.metadata "\"detection_version\": \"(?P<detection_version>.+)\""
| rename action.correlationsearch.label AS title, eai:acl.app AS app
| table title app detection_version detection_id
| eval appVersion = app. ":" .detection_version
| stats values(*) AS * by detection_id
| search app = "DA-ESS-ContentUpdate"
| where mvcount(detection_version) > 1
| eval escuSearch = mvindex(title, mvfind(title, "^ESCU"), mvfind(title, "^ESCU"))
| eval customSearch = (mvindex(title, mvfind(title, "[^ESCU]"), mvfind(title, "[^ESCU]")))
| table escuSearch customSearch appVersion
| eval _time = now()
| stats values(_time) AS _time values(*) AS *
This alert, and other helpful information related to implementing ESCU can be found in the ESCU Companion App : https://splunkbase.splunk.com/app/7356