This query can set up an alert for when ESCU updates a detection, compared to the version you are using from clone. This requires ESCU v4.31.0 with the new metadata
information being used.
| rest splunk_server=local count=0 /servicesNS/-/-/saved/searches | search action.notable.param.rule_title=* action.correlationsearch.metadata=* disabled=0 | rex field=action.correlationsearch.metadata "\"detection_id\": \"(?P<detection_id>.{8}-.{4}-.{4}-.{4}-.{12})" | rex field=action.correlationsearch.metadata "\"detection_version\": \"(?P<detection_version>.+)\"" | rename action.correlationsearch.label AS title, eai:acl.app AS app | table title app detection_version detection_id | eval appVersion = app. ":" .detection_version | stats values(*) AS * by detection_id | search app = "DA-ESS-ContentUpdate" | where mvcount(detection_version) > 1 | eval escuSearch = mvindex(title, mvfind(title, "^ESCU"), mvfind(title, "^ESCU")) | eval customSearch = (mvindex(title, mvfind(title, "[^ESCU]"), mvfind(title, "[^ESCU]"))) | table escuSearch customSearch appVersion | eval _time = now() | stats values(_time) AS _time values(*) AS *
This alert, and other helpful information related to implementing ESCU can be found in the ESCU Companion App : https://splunkbase.splunk.com/app/7356