diff --git a/spec/v2/baselines.json.spec b/spec/v2/baselines.json.spec
index ceaff21e9d..184a5ce7d2 100644
--- a/spec/v2/baselines.json.spec
+++ b/spec/v2/baselines.json.spec
@@ -131,7 +131,32 @@
       "description": "A list of entities(important fields) that are in baseline output, which will be used by detections and are relevant to the story flow",
       "type": "array",
       "items": {
-        "enum": []
+        "enum": [
+                 "accessKeyId",
+                  "arn",
+                  "awsRegion",
+                  "bucketName",
+                  "City",
+                  "Country",
+                  "dest_port",
+                  "dest",
+                  "event_id",
+                  "instanceId",
+                  "message_id",
+                  "networkAclId",
+                  "process_name",
+                  "process",
+                  "recipient",
+                  "Region",
+                  "resourceId",
+                  "session_id",
+                  "src_ip",
+                  "src_ip",
+                  "src_mac",
+                  "src_user",
+                  "src",
+                  "user"
+                  ]
       },
       "minItems": 0,
       "uniqueItems": true
diff --git a/spec/v2/detections.json.spec b/spec/v2/detections.json.spec
index d61fd3c054..b808b26862 100644
--- a/spec/v2/detections.json.spec
+++ b/spec/v2/detections.json.spec
@@ -381,7 +381,33 @@
       "description": "A list of entities that is outputed by the search...",
       "type": "array",
       "items": {
-        "enum": []
+
+        "enum": [
+                 "accessKeyId",
+                  "arn",
+                  "awsRegion",
+                  "bucketName",
+                  "City",
+                  "Country",
+                  "dest_port",
+                  "dest",
+                  "event_id",
+                  "instanceId",
+                  "message_id",
+                  "networkAclId",
+                  "process_name",
+                  "process",
+                  "recipient",
+                  "Region",
+                  "resourceId",
+                  "session_id",
+                  "src_ip",
+                  "src_ip",
+                  "src_mac",
+                  "src_user",
+                  "src",
+                  "user"
+                  ]
       },
       "minItems": 0,
       "uniqueItems": true
diff --git a/spec/v2/investigations.json.spec b/spec/v2/investigations.json.spec
index 9281d33db9..5fc8dc8a81 100644
--- a/spec/v2/investigations.json.spec
+++ b/spec/v2/investigations.json.spec
@@ -193,7 +193,32 @@ ent
         "description": "A list of entities that will used in the story flow or are relevant to the security investigation. ",
         "type": "array",
         "items": {
-          "enum": []
+          "enum": [
+          ]       "accessKeyId",
+                  "arn",
+                  "awsRegion",
+                  "bucketName",
+                  "City",
+                  "Country",
+                  "dest_port",
+                  "dest",
+                  "event_id",
+                  "instanceId",
+                  "message_id",
+                  "networkAclId",
+                  "process_name",
+                  "process",
+                  "recipient",
+                  "Region",
+                  "resourceId",
+                  "session_id",
+                  "src_ip",
+                  "src_ip",
+                  "src_mac",
+                  "src_user",
+                  "src",
+                  "user"
+                  ]
         },
         "minItems": 0,
         "uniqueItems": true
diff --git a/spec/v2/responses.json.spec b/spec/v2/responses.json.spec
index 92b9205248..28114eb6b7 100644
--- a/spec/v2/responses.json.spec
+++ b/spec/v2/responses.json.spec
@@ -183,13 +183,38 @@
         "description": "A list of entities that is either an input or an output for the security workflow.",
         "type": "array",
         "items": {
-          "enum": []
+          "enum": [
+                 "accessKeyId",
+                  "arn",
+                  "awsRegion",
+                  "bucketName",
+                  "City",
+                  "Country",
+                  "dest_port",
+                  "dest",
+                  "event_id",
+                  "instanceId",
+                  "message_id",
+                  "networkAclId",
+                  "process_name",
+                  "process",
+                  "recipient",
+                  "Region",
+                  "resourceId",
+                  "session_id",
+                  "src_ip",
+                  "src_ip",
+                  "src_mac",
+                  "src_user",
+                  "src",
+                  "user"
+                  ]
         },
         "minItems": 0,
         "uniqueItems": true
       },
       "product_type": {
-        "description": "The type of detection",
+        "description": "The type of product that does the reponse",
         "enum": [
           "splunk",
           "phantom"