diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index b786f34675..0630f681c3 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -89,7 +89,7 @@ aws:
 
   # AWS CloudTrail Configuration
   # aws.cloudtrail_threat_detection_privilege_escalation
-  threat_detection_privilege_escalation_entropy: 0.7 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.7 (70%)
+  threat_detection_privilege_escalation_threshold: 0.1 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.1 (10%)
   threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours)
   threat_detection_privilege_escalation_actions: [
     "AddPermission",
@@ -145,7 +145,7 @@ aws:
     "UpdateLoginProfile",
 ]
   # aws.cloudtrail_threat_detection_enumeration
-  threat_detection_enumeration_entropy: 0.7 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.7 (70%)
+  threat_detection_enumeration_threshold: 0.1 # Percentage of actions found to decide if it is an enumeration attack event, by default is 0.1 (10%)
   threat_detection_enumeration_minutes: 1440 # Past minutes to search from now for enumeration attacks, by default is 1440 minutes (24 hours)
   threat_detection_enumeration_actions: [
     "DescribeAccessEntry",
diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py
index 505abdd5aa..d7a7217f88 100644
--- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py
+++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_enumeration/cloudtrail_threat_detection_enumeration.py
@@ -5,8 +5,8 @@ from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
     cloudtrail_client,
 )
 
-ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get(
-    "threat_detection_enumeration_entropy", 0.7
+THRESHOLD = cloudtrail_client.audit_config.get(
+    "threat_detection_enumeration_threshold", 0.1
 )
 THREAT_DETECTION_MINUTES = cloudtrail_client.audit_config.get(
     "threat_detection_enumeration_minutes", 1440
@@ -47,7 +47,8 @@ class cloudtrail_threat_detection_enumeration(Check):
                             event_name
                         )
         for source_ip, actions in potential_enumeration.items():
-            if len(actions) / len(ENUMERATION_ACTIONS) > ENTROPY_THRESHOLD:
+            ip_threshold = round(len(actions) / len(ENUMERATION_ACTIONS), 2)
+            if len(actions) / len(ENUMERATION_ACTIONS) > THRESHOLD:
                 found_potential_enumeration = True
                 report = Check_Report_AWS(self.metadata())
                 report.region = trail.region
@@ -55,7 +56,7 @@ class cloudtrail_threat_detection_enumeration(Check):
                 report.resource_arn = trail.arn
                 report.resource_tags = trail.tags
                 report.status = "FAIL"
-                report.status_extended = f"Potential enumeration attack detected from source IP {source_ip} with an entropy of {ENTROPY_THRESHOLD}."
+                report.status_extended = f"Potential enumeration attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
                 findings.append(report)
         if not found_potential_enumeration:
             report = Check_Report_AWS(self.metadata())
diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py
index 3a631e5124..ca3f10d955 100644
--- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py
+++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detection_privilege_escalation/cloudtrail_threat_detection_privilege_escalation.py
@@ -5,8 +5,8 @@ from prowler.providers.aws.services.cloudtrail.cloudtrail_client import (
     cloudtrail_client,
 )
 
-ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get(
-    "threat_detection_privilege_escalation_entropy", 0.7
+THRESHOLD = cloudtrail_client.audit_config.get(
+    "threat_detection_privilege_escalation_threshold", 0.1
 )
 THREAT_DETECTION_MINUTES = cloudtrail_client.audit_config.get(
     "threat_detection_privilege_escalation_minutes", 1440
@@ -52,7 +52,8 @@ class cloudtrail_threat_detection_privilege_escalation(Check):
                             event_log["sourceIPAddress"]
                         ].add(event_name)
         for source_ip, actions in potential_privilege_escalation.items():
-            if len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS) > ENTROPY_THRESHOLD:
+            ip_threshold = round(len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS), 2)
+            if len(actions) / len(PRIVILEGE_ESCALATION_ACTIONS) > THRESHOLD:
                 found_potential_privilege_escalation = True
                 report = Check_Report_AWS(self.metadata())
                 report.region = trail.region
@@ -60,7 +61,7 @@ class cloudtrail_threat_detection_privilege_escalation(Check):
                 report.resource_arn = trail.arn
                 report.resource_tags = trail.tags
                 report.status = "FAIL"
-                report.status_extended = f"Potential privilege escalation attack detected from source IP {source_ip} with an entropy of {ENTROPY_THRESHOLD}."
+                report.status_extended = f"Potential privilege escalation attack detected from source IP {source_ip} with an threshold of {ip_threshold}."
                 findings.append(report)
         if not found_potential_privilege_escalation:
             report = Check_Report_AWS(self.metadata())