diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index aa5a5446c2..61ccb00223 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -1,8 +1,8 @@
 name: AWS ECR Container Scanning Findings High
 id: 30a0e9f8-f1dd-4f9d-8fc2-c622461d781c
-version: 13
+version: 14
 creation_date: '2021-08-18'
-modification_date: '2026-05-13'
+modification_date: '2026-07-27'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
@@ -16,7 +16,8 @@ search: |-
       | spath input=findings
       | search severity=HIGH
       | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
-      | rename user_name as user
+      | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
+      | eval vendor_product="Amazon Web Services"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY signature dest user
            user_agent src vendor_account
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index efdc8f0112..703f0747e7 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -1,8 +1,8 @@
 name: AWS ECR Container Scanning Findings Low Informational Unknown
 id: cbc95e44-7c22-443f-88fd-0424478f5589
-version: 13
+version: 14
 creation_date: '2021-08-18'
-modification_date: '2026-05-13'
+modification_date: '2026-07-27'
 author: Patrick Bareiss, Eric McGinnis Splunk
 status: production
 type: Anomaly
@@ -16,7 +16,8 @@ search: |-
       | spath input=findings
       | search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
       | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
-      | rename user_name as user
+      | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
+      | eval vendor_product="Amazon Web Services"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY signature dest user
            user_agent src vendor_account
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index 3cc23e9574..1906b93080 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -1,8 +1,8 @@
 name: AWS ECR Container Scanning Findings Medium
 id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
-version: 13
+version: 14
 creation_date: '2021-08-18'
-modification_date: '2026-05-13'
+modification_date: '2026-07-27'
 author: Patrick Bareiss, Splunk
 status: production
 type: Anomaly
@@ -16,7 +16,8 @@ search: |-
       | spath input=findings
       | search severity=MEDIUM
       | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
-      | rename user_name as user
+      | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
+      | eval vendor_product="Amazon Web Services"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY signature dest user
            user_agent src vendor_account