diff --git a/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/cloudformation/risk_credentials_exposed.serverless.yaml b/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/cloudformation/risk_credentials_exposed.serverless.yaml
index 821e841..3f658db 100644
--- a/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/cloudformation/risk_credentials_exposed.serverless.yaml
+++ b/automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/cloudformation/risk_credentials_exposed.serverless.yaml
@@ -17,7 +17,11 @@ Resources:
           eventTypeCategory:
             - "issue"
           eventTypeCode:
+            - "AWS_RISK_CREDENTIALS_COMPROMISED"
+            - "AWS_RISK_CREDENTIALS_COMPROMISE_SUSPECTED"
             - "AWS_RISK_CREDENTIALS_EXPOSED"
+            - "AWS_RISK_CREDENTIALS_EXPOSURE_SUSPECTED"
+            - "AWS_RISK_IAM_QUARANTINE"
       State: "ENABLED"
       Targets: 
         -