diff --git a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
index d5bdab4b81..843d4e139b 100644
--- a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
+++ b/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
@@ -27,7 +27,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_ru
   fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
 tags:
   analytics_story:
-  - Cloud Cryptomining
+  - AWS Cryptomining
   - Suspicious AWS EC2 Activities
   detections:
   - Abnormally High AWS Instances Launched by User - MLTK
diff --git a/baselines/previously_seen_cloud_compute_images_initial.yml b/baselines/previously_seen_cloud_compute_images_initial.yml
index cca998f9bb..bd5af2995f 100644
--- a/baselines/previously_seen_cloud_compute_images_initial.yml
+++ b/baselines/previously_seen_cloud_compute_images_initial.yml
@@ -1,4 +1,4 @@
-name: Previously Seen Cloud Compute Images
+name: Previously Seen Cloud Compute Images - Initial
 id: 7744597f-d07a-4cea-94a7-e0f8aaebc410
 version: 1
 date: '2018-03-12'
diff --git a/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml
index ed7aa5710f..5b19c30442 100644
--- a/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml
+++ b/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml
@@ -20,7 +20,7 @@ known_false_positives: Many service accounts configured within an AWS infrastruc
   human user.
 tags:
   analytics_story:
-  - Cloud Cryptomining
+  - AWS Cryptomining
   - Suspicious AWS EC2 Activities
   kill_chain_phases:
   - Actions on Objectives
diff --git a/detections/abnormally_high_cloud_instances_launched.yml b/detections/abnormally_high_cloud_instances_launched.yml
index 0f4117c331..c111472c45 100644
--- a/detections/abnormally_high_cloud_instances_launched.yml
+++ b/detections/abnormally_high_cloud_instances_launched.yml
@@ -31,7 +31,7 @@ known_false_positives: Many service accounts configured within an AWS infrastruc
 tags:
   analytics_story:
   - Cloud Cryptomining
-  - Suspicious AWS EC2 Activities
+  - Suspicious Cloud Instance Activities
   kill_chain_phases:
   - Actions on Objectives
   mitre_attack_id:
diff --git a/detections/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud_instance_modified_with_previously_unseen_user.yml
index bc22cce418..173cf72408 100644
--- a/detections/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud_instance_modified_with_previously_unseen_user.yml
@@ -29,7 +29,8 @@ known_false_positives: It's possible that a new user will start to modify EC2 in
   modifying instances that this is the intended behavior.
 tags:
   analytics_story:
-  - Suspicious Cloud Change Activity 
+  - Suspicious Cloud Change Activity
+  - Suspicious Cloud Instance Activities
   mitre_attack_id:
   - T1078.004
   cis20: