diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml
index 1eccf3499c..14a3914f04 100644
--- a/detections/cloud/aws_createloginprofile.yml
+++ b/detections/cloud/aws_createloginprofile.yml
@@ -6,11 +6,11 @@ author: Bhavin Patel, Splunk
 type: batch
 datamodel: []
 description: This search looks for CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip
-search: 'index=aws_all eventName = CreateLoginProfile 
+search: '`cloudtrail` eventName = CreateLoginProfile 
 | rename requestParameters.userName as new_login_profile 
 | table src_ip eventName new_login_profile userName
 | join new_login_profile src_ip 
-    [| search index=aws_all eventName = ConsoleLogin 
+    [| search `cloudtrail` eventName = ConsoleLogin 
     | rename userName as new_login_profile | table eventName new_login_profile src_ip ]`aws_createloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with cloudtrail logs.
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index d43c592cc9..cf275ccff1 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -1,5 +1,5 @@
 name: AWS UpdateLoginProfile
-id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
+id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
 version: 1
 date: '2021-03-02'
 author: Bhavin Patel, Splunk
diff --git a/stories/aws_iam_privilege_escalation.yml b/stories/aws_iam_privilege_escalation.yml
index 3ae6aa6695..4ede1d33fe 100644
--- a/stories/aws_iam_privilege_escalation.yml
+++ b/stories/aws_iam_privilege_escalation.yml
@@ -1,5 +1,5 @@
 name: AWS IAM Privilege Escalation
-id: ced74200-8465-4bc3-bd2c-9a782eec6750
+id: ced74200-8465-4bc3-bd2c-22782eec6750
 version: 1
 date: '2021-03-08'
 author: David Dorsey, Splunk