diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7da3c62c7..2dbaa3923 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,8 @@ Thankyou! -->
     4. Added `forward_addr` as an `email_t`. #1179
     5. Added `related_cves`, `related_cwes` as arrays of `cve`, `cwe` respectively. #1176
     6. Added `exploit_last_seen_time` as a `timestamp_t`. #1176
+    7. Added `is_alert` as a `boolean_t`, #1179
+
 * #### Objects
     1. Added `environment_variable` object. #1172
     2. Added `advisory` object. #1176
@@ -60,6 +62,8 @@ Thankyou! -->
 ### Improved
 * #### Event Classes
     1. Added `evidences` to `compliance_finding` class. #1157
+    2. Added `is_alert` to `detection_finding` and `data_security_finding` classes. #1178
+    3. Added `risk_details` to `data_security_finding` class
 * #### Objects
     1. Added `phone_number` to `user` and `ldap_person` objects. #1155
     2. Added `has_mfa` to `user` object. #1155
@@ -74,6 +78,11 @@ Thankyou! -->
 ### Bugfixes
 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180
 
+* #### Profiles
+    1. Added `is_alert`, `confidence_id`, `confidence`,  `confidence_score` attributes to the `security_control` profile. #1178
+    2. Added `risk_level_id`, `risk_level`, `risk_score`, `risk_details` attributes to the `security_control` profile.  #1178
+    3. Added `policy` attribute to the `security_control` profile. #1178
+    
 ### Deprecated
 1. Deprecated `project_uid` in favor of `account.uid`. #1166
 2. Deprecated `kb_article_list` in favor of `advisory` in the vulnerability object. #1176
diff --git a/dictionary.json b/dictionary.json
index e6e89a4e1..03f7abcdc 100644
--- a/dictionary.json
+++ b/dictionary.json
@@ -2423,6 +2423,11 @@
       "description": "The IP address, in either IPv4 or IPv6 format.",
       "type": "ip_t"
     },
+    "is_alert": {
+      "caption": "Alert",
+      "description": "Indicates that the event is considered to be an alertable signal.",
+      "type": "boolean_t"
+    },
     "is_applied": {
       "caption": "Applied",
       "description": "A determination if a policy, rule, or enforcement action was applied.",
diff --git a/events/findings/data_security_finding.json b/events/findings/data_security_finding.json
index cecebac57..f6e9fb4cc 100644
--- a/events/findings/data_security_finding.json
+++ b/events/findings/data_security_finding.json
@@ -39,6 +39,21 @@
             "group": "context",
             "requirement": "recommended"
         },
+        "confidence": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
+         "confidence_id": {
+            "profile": null,
+            "group": "context",
+            "requirement": "recommended"
+        },
+        "confidence_score": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },      
         "data_security": {
             "group": "context",
             "requirement": "recommended"
@@ -80,21 +95,34 @@
             "group": "context",
             "requirement": "optional"
         },
+        "is_alert": {
+            "profile": null,
+            "group": "primary",
+            "requirement": "recommended"
+        },      
         "resources": {
             "caption": "Affected Resources",
             "description": "Describes details about resources where classified or sensitive data is stored in, or was accessed from.",
             "group": "context",
             "requirement": "recommended"
         },
+        "risk_details": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
         "risk_level": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_level_id": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_score": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
diff --git a/events/findings/detection_finding.json b/events/findings/detection_finding.json
index 2417cd2e7..f58911840 100644
--- a/events/findings/detection_finding.json
+++ b/events/findings/detection_finding.json
@@ -1,13 +1,28 @@
 {
   "uid": 4,
   "caption": "Detection Finding",
-  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information should be duplicated into the <code>finding_info</code> object.",
+  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information, if present, should be duplicated into the <code>finding_info</code> object.",
   "extends": "finding",
   "name": "detection_finding",
   "attributes": {
     "$include": [
       "profiles/security_control.json"
     ],
+    "confidence": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "profile": null,
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
     "evidences": {
       "group": "primary",
       "description": "Describes various evidence artifacts associated to the activity/activities that triggered a security detection.",
@@ -25,6 +40,11 @@
       "group": "context",
       "requirement": "optional"
     },
+    "is_alert": {
+      "profile": null,
+      "group": "primary",
+      "requirement": "recommended"
+    },
     "remediation": {
       "group": "context",
       "requirement": "optional"
@@ -36,18 +56,22 @@
       "requirement": "recommended"
     },
     "risk_details": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level_id": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_score": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
diff --git a/profiles/security_control.json b/profiles/security_control.json
index 463210d60..7ef74e7da 100644
--- a/profiles/security_control.json
+++ b/profiles/security_control.json
@@ -1,5 +1,5 @@
 {
-  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened.",
+  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened. If the control detected a security violation, the <code>is_detection</code> flag should be set to <code>true</code>.",
   "meta": "profile",
   "caption": "Security Control",
   "name": "security_control",
@@ -37,6 +37,18 @@
     "authorizations": {
       "requirement": "optional"
     },
+    "confidence": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "group": "context",
+      "requirement": "optional"
+    },
     "disposition": {
       "requirement": "optional"
     },
@@ -44,10 +56,34 @@
       "requirement": "recommended"
     },
     "firewall_rule": {
-      "requirement": "optional"
+      "requirement": "optional",
+      "description": "The firewall rule that pertains to the control that triggered the event, if applicable."
+    },
+    "is_alert": {
+      "requirement": "recommended"
     },
     "malware": {
       "requirement": "optional"
+    },
+    "policy": {
+      "requirement": "optional",
+      "description": "The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."
+    },
+    "risk_details": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level_id": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_score": {
+      "group": "context",
+      "requirement": "optional"
     }
   }
 }