diff --git a/src/test/java/org/opensearch/securityanalytics/TestHelpers.java b/src/test/java/org/opensearch/securityanalytics/TestHelpers.java
index 479bbc243..8073b99e1 100644
--- a/src/test/java/org/opensearch/securityanalytics/TestHelpers.java
+++ b/src/test/java/org/opensearch/securityanalytics/TestHelpers.java
@@ -2975,7 +2975,7 @@ public static SATIFSourceConfig randomSATIFSourceConfig(
                 feedFormat,
                 sourceConfigType,
                 description,
-                new User("wrgrer", List.of("b1"), List.of("r1"), List.of("ca")),
+                new User("wrgrer", List.of("b1"), List.of("r1"), List.of("attrKey=ca")),
                 createdAt,
                 source,
                 enabledTime,
diff --git a/src/test/java/org/opensearch/securityanalytics/model/WriteableTests.java b/src/test/java/org/opensearch/securityanalytics/model/WriteableTests.java
index 40ef55d51..d50317333 100644
--- a/src/test/java/org/opensearch/securityanalytics/model/WriteableTests.java
+++ b/src/test/java/org/opensearch/securityanalytics/model/WriteableTests.java
@@ -35,7 +35,7 @@ public void testDetectorAsAStream() throws IOException {
     public void testDetector() throws IOException { // an edge case of detector serialization that failed testDetectorAsAStream() intermittently
         String detectorString = "{\"type\":\"detector\",\"name\":\"MczAuRCrve\",\"detector_type\":\"test_windows\"," +
                 "\"user\":{\"name\":\"QhKrfthgxw\",\"backend_roles\":[\"uYvGLCPhfX\",\"fOLkcRxMWR\"],\"roles\"" +
-                ":[\"YuucNpVzTm\",\"all_access\"],\"custom_attributes\":{\"test_attr\":\"test\"}," +
+                ":[\"YuucNpVzTm\",\"all_access\"],\"custom_attribute_names\":[\"test_attr=test\"]," +
                 "\"user_requested_tenant\":null},\"threat_intel_enabled\":false,\"enabled\":false,\"enabled_time\"" +
                 ":null,\"schedule\":{\"period\":{\"interval\":5,\"unit\":\"MINUTES\"}},\"inputs\":[{\"detector_input\"" +
                 ":{\"description\":\"\",\"indices\":[],\"custom_rules\":[],\"pre_packaged_rules\":[]}}],\"triggers\"" +
diff --git a/src/test/java/org/opensearch/securityanalytics/model/threatintel/ThreatIntelAlertTests.java b/src/test/java/org/opensearch/securityanalytics/model/threatintel/ThreatIntelAlertTests.java
index 0e945d217..5cdfd4b92 100644
--- a/src/test/java/org/opensearch/securityanalytics/model/threatintel/ThreatIntelAlertTests.java
+++ b/src/test/java/org/opensearch/securityanalytics/model/threatintel/ThreatIntelAlertTests.java
@@ -89,7 +89,7 @@ private static ThreatIntelAlert getRandomAlert() {
                 randomAlphaOfLength(10),
                 randomLong(),
                 randomLong(),
-                new User(randomAlphaOfLength(10), List.of(randomAlphaOfLength(10)), List.of(randomAlphaOfLength(10)), List.of(randomAlphaOfLength(10))),
+                new User(randomAlphaOfLength(10), List.of(randomAlphaOfLength(10)), List.of(randomAlphaOfLength(10)), List.of("attrKey=attrVal")),
                 randomAlphaOfLength(10),
                 randomAlphaOfLength(10),
                 randomAlphaOfLength(10),