fixing observables

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -42,8 +42,8 @@ tags:
     type: Other
     role:
     - Attacker
-  - name: requestedAccountId
-    type: Other
+  - name: user
+    type: User
     role:
     - Victim
   product:

detections/network/multiple_archive_files_http_post_traffic.yml

@@ -51,7 +51,7 @@ tags:
   - name: form_data
     type: Other
     role:
-    - Attacker
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/network/plain_http_post_exfiltrated_data.yml

@@ -41,7 +41,7 @@ tags:
   - name: form_data
     type: Other
     role:
-    - Attacker
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security