diff --git a/bin/generate.py b/bin/generate.py
index 1c91b3ffd7..1a6f1c391a 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -95,7 +95,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
             if len(nes_fields) > 0:
                 detection['nes_fields'] = nes_fields
 
-        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'security_domain', 'asset_type', 'risk_object', 'risk_object_type', 'risk_score']
+        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
         mappings = {}
         for key in keys:
             if key == 'mitre_attack':
diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2
index 01234a9ae4..013a542d92 100644
--- a/bin/jinja2_templates/savedsearches.j2
+++ b/bin/jinja2_templates/savedsearches.j2
@@ -41,7 +41,6 @@ action.escu.providing_technologies = []
 {% endif %}
 {% if detection.tags.analytics_story is defined %}
 action.escu.analytic_story = {{ detection.tags.analytics_story | tojson }}
-
 {% if detection.tags.risk_object is defined %}
 action.risk = 1
 action.risk.param._risk_object = {{ detection.tags.risk_object }}
@@ -49,8 +48,6 @@ action.risk.param._risk_object_type = {{ detection.tags.risk_object_type }}
 action.risk.param._risk_score = {{ detection.tags.risk_score }}
 action.risk.param.verbose = 0
 {% endif %}
-
-
 {% else %}
 action.escu.analytic_story = []
 {% endif %}
diff --git a/detections/abnormally_high_aws_instances_launched_by_user.yml b/detections/abnormally_high_aws_instances_launched_by_user.yml
index 39ed7fb4f8..69d51407d4 100644
--- a/detections/abnormally_high_aws_instances_launched_by_user.yml
+++ b/detections/abnormally_high_aws_instances_launched_by_user.yml
@@ -37,3 +37,6 @@ tags:
   - DE.AE
   security_domain: network
   asset_type: AWS Instance
+  risk_object: userName
+  risk_object_type: user
+  risk_score: 50