@cburr yes you would probably want to create a pack with the EC2 queries and then add a discovery query to that pack to detect ec2 instances