diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
index a27f29845e..5561542f23 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
@@ -42,3 +42,7 @@ tags:
   - PR.AC
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user
+
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
index 35fd1f2008..c455a7e6ca 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
@@ -42,3 +42,7 @@ tags:
   - PR.AC
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user
+
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index 7859e4af83..ef43e0b55a 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -40,3 +40,6 @@ tags:
   - T1078
   security_domain: endpoint
   asset_type: AWS Instance
+  risk_score: 25
+  risk_object_type: user
+  risk_object: user