AWS CLI Command Reference

[ aws . guardduty ]

list-investigation-records

Description

This API is currently available as a preview. This feature is available in the following Amazon Web Services Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and Asia Pacific (Tokyo).

Returns the records for a specific GuardDuty investigation. Each record is one step in the reasoning that GuardDuty followed to reach the results of the investigation.

An administrator account can list the records of any investigation within the organization. Member accounts can only list the records of investigations that belong to them.

See also: AWS API Documentation

list-investigation-records is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the --no-paginate argument. When using --output text and the --query argument on a paginated response, the --query argument must extract data from the results of the following query expressions: Records

Synopsis

  list-investigation-records
--detector-id <value>
--investigation-id <value>
[--record-types <value>]
[--starting-token <value>]
[--page-size <value>]
[--max-items <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]
[--help]

Options

--detector-id (string) [required]

The unique ID of the GuardDuty detector associated with the investigation.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Constraints:

  • min: 1
  • max: 300

--investigation-id (string) [required]

The unique identifier of the investigation whose records you want to list.

Constraints:

  • min: 1
  • max: 64
  • pattern: [a-fA-F0-9\-]+

--record-types (list)

The types of records to return. Possible values are UPDATE , FETCH , OBSERVATION , ANALYSIS , and METADATA . If you don’t specify this parameter, GuardDuty returns records of all types.

Constraints:

  • min: 1
  • max: 10

(string)

Possible values:

  • OBSERVATION
  • ANALYSIS
  • UPDATE
  • FETCH
  • METADATA

Syntax:

"string" "string" ...

--starting-token (string)

A token to specify where to start paginating. This is the NextToken from a previously truncated response.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--page-size (integer)

The size of each page to get in the AWS service call. This does not affect the number of items returned in the command’s output. Setting a smaller page size results in more calls to the AWS service, retrieving fewer items in each call. This can help prevent the AWS service calls from timing out.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

Constraints:

  • min: 1
  • max: 50

--max-items (integer)

The total number of items to return in the command’s output. If the total number of items available is more than the value specified, a NextToken is provided in the command’s output. To resume pagination, provide the NextToken value in the starting-token argument of a subsequent command. Do not use the NextToken response element directly outside of the AWS CLI.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

  • json
  • text
  • table
  • yaml
  • yaml-stream
  • off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

  • on
  • off
  • auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

  • base64
  • raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

  • legacy
  • json
  • yaml
  • text
  • table
  • enhanced

--help (boolean)

Display help for the command/subcommand.

Output

InvestigationId -> (string)

The unique identifier of the investigation.

Constraints:

  • min: 1
  • max: 64
  • pattern: [a-fA-F0-9\-]+

Status -> (string)

The current status of the investigation. Possible values are RUNNING , COMPLETED , and FAILED . Records are returned only when the status is COMPLETED . If the status is RUNNING or FAILED , the response contains an empty list of records and no NextToken .

Possible values:

  • RUNNING
  • COMPLETED
  • FAILED

Constraints:

  • min: 1
  • max: 300

Records -> (list)

The records for the investigation, in the order that GuardDuty created them, oldest first. This list can contain fewer records than MaxResults , or no records, even when more records are available. To check for more records, use NextToken .

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about one step in the reasoning that GuardDuty followed during an investigation.

RecordId -> (string) [required]

The unique identifier of the record.

Constraints:

  • min: 1
  • max: 64

Type -> (string) [required]

The type of the record. Possible values:

  • UPDATE – A progress milestone, such as the request that started the investigation or a response from GuardDuty.
  • FETCH – Data that GuardDuty retrieved for the investigation, such as a finding, a detector configuration, or a list of your member accounts. The record includes what GuardDuty requested and what it received.
  • OBSERVATION – A fact that GuardDuty noted about your environment, such as the affected resource, the activity on that resource, or your detection coverage.
  • ANALYSIS – An assessment that GuardDuty derived from the data, such as a threat assessment, a comparison against normal behavior, or a process lineage.
  • METADATA – Operational details about the investigation itself, such as how long the investigation took.

Possible values:

  • OBSERVATION
  • ANALYSIS
  • UPDATE
  • FETCH
  • METADATA

Title -> (string) [required]

A short title that describes the step.

Constraints:

  • min: 0
  • max: 1024

Narrative -> (string)

A plain-text explanation of the step. A narrative can span several paragraphs. Not every record includes a narrative.

Constraints:

  • min: 0
  • max: 4096

CreatedAt -> (timestamp) [required]

The timestamp at which GuardDuty created the record.

SupportingData -> (tagged union structure)

The structured details for the step. The member that is set matches the record type. UPDATE records never include supporting data, and records of other types don’t always include it.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: Fetch, Analysis, Observation, Metadata.

Fetch -> (structure)

Details about data that GuardDuty retrieved. Set for FETCH records.

FetchType -> (string) [required]

The kind of data that GuardDuty retrieved. The value determines which members of Query and Result can be set. Possible values:

  • FINDINGS – GuardDuty findings.
  • DETECTOR – The configuration of a GuardDuty detector.
  • REPUTATION – Reputation information about a threat indicator, such as an IP address, a domain, or a file hash.
  • FINDING_TYPE_DOCUMENTATION – The documentation for a finding type.
  • CLOUD_TRAIL_RAW_EVENTS – Amazon Web Services CloudTrail events.
  • RUNTIME_SIGNALS – Runtime signals.
  • MEMBER_ACCOUNTS – A list of member accounts.

Possible values:

  • FINDINGS
  • DETECTOR
  • REPUTATION
  • FINDING_TYPE_DOCUMENTATION
  • CLOUD_TRAIL_RAW_EVENTS
  • RUNTIME_SIGNALS
  • MEMBER_ACCOUNTS

Query -> (structure)

The request that GuardDuty made. Not every record includes a query.

Criteria -> (list)

The filter criteria that GuardDuty applied to the request.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains a filter condition that GuardDuty applied when it retrieved data.

Field -> (string) [required]

The name of the field that the condition applies to.

Constraints:

  • min: 1
  • max: 256

Condition -> (string) [required]

The comparison operator of the condition. Possible values are EQUALS , NOT_EQUALS , GREATER_THAN , GREATER_THAN_OR_EQUAL , LESS_THAN , and LESS_THAN_OR_EQUAL .

Possible values:

  • EQUALS
  • NOT_EQUALS
  • GREATER_THAN
  • GREATER_THAN_OR_EQUAL
  • LESS_THAN
  • LESS_THAN_OR_EQUAL

Values -> (list)

The values that the field is compared against. Numeric and Boolean values are represented as strings.

Constraints:

  • min: 0
  • max: 20

(string)

Constraints:

  • min: 0
  • max: 1024

TimeWindow -> (structure)

The time range of the data that GuardDuty requested.

StartedAt -> (timestamp)

The timestamp at which the time range starts.

DurationInMinutes -> (integer)

The length of the time range, in minutes. Valid values are 1 to 120.

Constraints:

  • min: 1
  • max: 120

RowLimit -> (integer)

The maximum number of rows that GuardDuty requested. Valid values are 1 to 1,000.

Constraints:

  • min: 1
  • max: 1000

AccountId -> (string)

The Amazon Web Services account ID that the request was made for.

Indicator -> (string)

The threat indicator that GuardDuty looked up, such as an IP address, a domain, or a file hash.

Constraints:

  • min: 1
  • max: 1024

IndicatorType -> (string)

The type of the threat indicator. Possible values are IP , DOMAIN , and FILE .

Possible values:

  • IP
  • DOMAIN
  • FILE

FindingType -> (string)

The finding type whose documentation GuardDuty retrieved.

Constraints:

  • min: 1
  • max: 100

FindingId -> (string)

The ID of the finding that GuardDuty retrieved.

Constraints:

  • min: 1
  • max: 300

Result -> (structure)

The data that GuardDuty received in response to the request. Not every record includes a result.

ItemIds -> (list)

The identifiers of the items that were returned, such as finding IDs, event IDs, signal IDs, or account IDs, depending on FetchType . The list contains at most 50 identifiers; TotalCount can be larger.

Constraints:

  • min: 0
  • max: 50

(string)

Constraints:

  • min: 1
  • max: 300

TotalCount -> (long)

The total number of items that were returned. This value can be greater than the number of identifiers in ItemIds .

Constraints:

  • min: 0

Features -> (list)

The configuration of the detector features that GuardDuty retrieved.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about the configuration of a detector feature. Each member is optional.

Name -> (string)

The name of the feature. Possible values are CLOUD_TRAIL , DNS_LOGS , FLOW_LOGS , S3_DATA_EVENTS , EKS_AUDIT_LOGS , EBS_MALWARE_PROTECTION , RDS_LOGIN_EVENTS , EKS_RUNTIME_MONITORING , EKS_ADDON_MANAGEMENT , LAMBDA_NETWORK_LOGS , RUNTIME_MONITORING , ECS_FARGATE_AGENT_MANAGEMENT , and EC2_AGENT_MANAGEMENT .

Possible values:

  • CLOUD_TRAIL
  • DNS_LOGS
  • FLOW_LOGS
  • S3_DATA_EVENTS
  • EKS_AUDIT_LOGS
  • EBS_MALWARE_PROTECTION
  • RDS_LOGIN_EVENTS
  • EKS_RUNTIME_MONITORING
  • EKS_ADDON_MANAGEMENT
  • LAMBDA_NETWORK_LOGS
  • RUNTIME_MONITORING
  • ECS_FARGATE_AGENT_MANAGEMENT
  • EC2_AGENT_MANAGEMENT

Status -> (string)

The status of the feature. Possible values are ENABLED and DISABLED .

Possible values:

  • ENABLED
  • DISABLED

UpdatedAt -> (timestamp)

The timestamp at which the feature configuration was last updated.

Verdict -> (string)

The reputation verdict for the threat indicator. Possible values are THREAT , BENIGN , and NEUTRAL . If the lookup returned more than one result, the verdict describes the first result.

Possible values:

  • THREAT
  • BENIGN
  • NEUTRAL

Documentation -> (structure)

The documentation for the finding type that GuardDuty retrieved.

Description -> (string)

A short description of the finding type.

Constraints:

  • min: 0
  • max: 4096

Severity -> (string)

The severity of the finding type, as stated in the documentation.

Feature -> (string)

The label that the documentation uses for the GuardDuty capability associated with the finding type. This value isn’t a detector feature name.

FullDescription -> (string)

The full description of the finding type.

Constraints:

  • min: 0
  • max: 4096

Remediation -> (string)

The recommended steps to remediate the finding type.

Constraints:

  • min: 0
  • max: 4096

LearnMoreLinks -> (list)

Links to more information about the finding type.

Constraints:

  • min: 0
  • max: 10

(string)

Constraints:

  • min: 0
  • max: 2048

Analysis -> (structure)

Details about an assessment that GuardDuty derived from the data. Set for ANALYSIS records.

AnalysisType -> (string) [required]

The kind of analysis. The value identifies the payload member that can be set: REPUTATION , THREAT_ASSESSMENT , and RDS_THREAT_ASSESSMENT (ThreatAssessment ); KUBERNETES_POLICY_VIOLATION (KubernetesPolicyViolation ); S3_EXPOSURE , S3_ACTOR_CONTEXT , and S3_PEN_TEST (S3Analysis ); PROCESS_LINEAGE (Processes ); and TREND and BASELINE (AccountAnalysis ).

Possible values:

  • REPUTATION
  • THREAT_ASSESSMENT
  • RDS_THREAT_ASSESSMENT
  • KUBERNETES_POLICY_VIOLATION
  • S3_EXPOSURE
  • S3_ACTOR_CONTEXT
  • S3_PEN_TEST
  • PROCESS_LINEAGE
  • TREND
  • BASELINE

ThreatAssessment -> (structure)

A threat assessment. Set when AnalysisType is REPUTATION , THREAT_ASSESSMENT , or RDS_THREAT_ASSESSMENT .

Reputation -> (structure)

Reputation information about a threat indicator. Set when AnalysisType is REPUTATION .

FindingTimeDisposition -> (string)

The reputation of the indicator at the time of the finding.

CurrentDisposition -> (string)

The current reputation of the indicator.

ReputationComparison -> (string)

A comparison of the reputation at the time of the finding with the current reputation.

ThreatConfidence -> (string)

The confidence in the threat assessment. Possible values are VERY_HIGH , HIGH , MEDIUM , and LOW .

Possible values:

  • VERY_HIGH
  • HIGH
  • MEDIUM
  • LOW

Classification -> (string)

The classification of the threat.

Constraints:

  • min: 0
  • max: 4096

Assessment -> (string)

The assessment of the threat.

Constraints:

  • min: 0
  • max: 4096

AuthenticationContext -> (string)

Context about how the identity involved in the activity authenticated.

Constraints:

  • min: 0
  • max: 4096

RdsControlPlaneActivity -> (string)

An assessment of Amazon RDS control plane activity that is related to the threat.

Constraints:

  • min: 0
  • max: 4096

IpAccountActivity -> (string)

An assessment of the activity from the IP address in the account.

Constraints:

  • min: 0
  • max: 4096

CredentialCompromise -> (string)

An assessment of whether credentials were compromised.

Constraints:

  • min: 0
  • max: 4096

KubernetesPolicyViolation -> (structure)

An assessment of a Kubernetes policy violation. Set when AnalysisType is KUBERNETES_POLICY_VIOLATION .

ViolationType -> (string)

The type of the violation.

AffectedResource -> (string)

The Kubernetes resource that the violation affects.

Subject -> (string)

The Kubernetes subject, such as a user, a group, or a service account, that the violation involves.

GrantedAccess -> (string)

The access that the violation grants.

ExposureVector -> (string)

How the misconfiguration exposes the resource.

Constraints:

  • min: 0
  • max: 4096

MisconfigurationImpact -> (string)

The potential impact of the misconfiguration.

Constraints:

  • min: 0
  • max: 4096

S3Analysis -> (structure)

An analysis of Amazon S3 activity or exposure. Set when AnalysisType is S3_EXPOSURE , S3_ACTOR_CONTEXT , or S3_PEN_TEST .

FindingSubtype -> (string)

The subtype of the finding.

EffectivePermission -> (string)

The effective permission of the Amazon S3 resource.

BlockPublicAccessSettings -> (string)

A description of the Amazon S3 Block Public Access settings.

Constraints:

  • min: 0
  • max: 4096

Exposure -> (string)

An assessment of the exposure of the Amazon S3 resource.

Constraints:

  • min: 0
  • max: 4096

UserAgent -> (string)

The user agent of the caller.

UserAgentClassification -> (string)

The classification of the user agent.

SourceIp -> (string)

The source address of the activity, or a description of the source.

IpReputation -> (string)

The reputation of the source IP address.

ActorAssessment -> (string)

An assessment of the identity that performed the activity.

Constraints:

  • min: 0
  • max: 4096

S3ApiActivity -> (string)

A description of the Amazon S3 API activity.

Constraints:

  • min: 0
  • max: 4096

SourceContext -> (string)

Context about the source of the activity.

Constraints:

  • min: 0
  • max: 4096

AuthorizationAssessment -> (string)

An assessment of whether the activity was authorized.

Constraints:

  • min: 0
  • max: 4096

Processes -> (list)

The processes in a process lineage. Set when AnalysisType is PROCESS_LINEAGE .

Constraints:

  • min: 0
  • max: 100

(structure)

Contains information about a process in a process lineage. ParentUuid links each process to its parent process.

Uuid -> (string) [required]

The unique identifier of the process.

Name -> (string)

The name of the process.

Path -> (string)

The path of the process executable.

ParentUuid -> (string)

The unique identifier of the parent process. Not set for the root process.

Findings -> (list)

The findings associated with this process.

Constraints:

  • min: 0
  • max: 100

(structure)

Contains a reference to a GuardDuty finding.

FindingType -> (string)

The type of the finding.

Uid -> (string)

The ID of the finding.

Constraints:

  • min: 1
  • max: 300

AccountAnalysis -> (structure)

An analysis of the findings in an account over time. Set when AnalysisType is TREND or BASELINE .

Trend -> (structure)

The trend of findings over time. Set when AnalysisType is TREND .

Granularity -> (string)

The length of each time window in the trend. Possible values are DAY , WEEK , and MONTH .

Possible values:

  • DAY
  • WEEK
  • MONTH

StartedAt -> (timestamp)

The timestamp at which the period of the trend starts.

EndedAt -> (timestamp)

The timestamp at which the period of the trend ends.

TotalFindings -> (long)

The total number of findings in the period.

Constraints:

  • min: 0

ByTimeWindow -> (list)

The number of findings in each time window.

Constraints:

  • min: 0
  • max: 100

(structure)

Contains the number of findings in a time window.

StartTime -> (timestamp)

The timestamp at which the time window starts.

EndTime -> (timestamp)

The timestamp at which the time window ends.

FindingCount -> (integer)

The number of findings in the time window.

Baseline -> (structure)

A comparison of findings against normal behavior. Set when AnalysisType is BASELINE .

TotalFindings -> (long)

The total number of findings.

Constraints:

  • min: 0

BaselineFindings -> (list)

The finding types that are consistent with normal behavior.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about how a finding type compares with normal behavior.

FindingType -> (string)

The finding type.

Constraints:

  • min: 1
  • max: 100

Classification -> (string)

The classification of the finding type.

Constraints:

  • min: 0
  • max: 4096

Count -> (long)

The number of findings of this type.

Constraints:

  • min: 0

Percentage -> (double)

The percentage of findings that are of this type, from 0 to 100.

Constraints:

  • min: 0
  • max: 100

Description -> (string)

A description of the classification.

Constraints:

  • min: 0
  • max: 4096

AnomalousFindings -> (list)

The finding types that deviate from normal behavior.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about how a finding type compares with normal behavior.

FindingType -> (string)

The finding type.

Constraints:

  • min: 1
  • max: 100

Classification -> (string)

The classification of the finding type.

Constraints:

  • min: 0
  • max: 4096

Count -> (long)

The number of findings of this type.

Constraints:

  • min: 0

Percentage -> (double)

The percentage of findings that are of this type, from 0 to 100.

Constraints:

  • min: 0
  • max: 100

Description -> (string)

A description of the classification.

Constraints:

  • min: 0
  • max: 4096

Indicators -> (list)

The threat indicators associated with the analysis, such as an IP address, a domain, or a file hash.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains a threat indicator, such as an IP address, a domain, or a file hash.

Value -> (string) [required]

The value of the indicator.

Constraints:

  • min: 1
  • max: 1024

Type -> (string)

The type of the indicator. Possible values are IP , DOMAIN , and FILE .

Possible values:

  • IP
  • DOMAIN
  • FILE

Observation -> (structure)

Details about a fact that GuardDuty noted about your environment. Set for OBSERVATION records.

ObservationType -> (string) [required]

The kind of observation. The value identifies the payload member that can be set: FINDING_DETAIL (FindingDetail ), RESOURCE (Resource ), NETWORK_ACTIVITY (NetworkActivity ), RDS_LOGIN_ACTIVITY (RdsLoginActivity ), S3_ACTIVITY (S3Activity ), KUBERNETES_ACTIVITY (KubernetesActivity ), MALWARE_SCAN (MalwareScan ), RELATED_FINDINGS (RelatedFindings ), DETECTION_COVERAGE (DetectionCoverage ), ACCOUNT_OVERVIEW (AccountOverview ), RECOMMENDATION (Recommendations ), RUNTIME_SIGNALS (RuntimeSignals ), DISTRIBUTION (Distribution ), and REPRESENTATIVE_RESOURCE (RepresentativeResources ).

Possible values:

  • FINDING_DETAIL
  • RESOURCE
  • NETWORK_ACTIVITY
  • RDS_LOGIN_ACTIVITY
  • S3_ACTIVITY
  • KUBERNETES_ACTIVITY
  • MALWARE_SCAN
  • RELATED_FINDINGS
  • DETECTION_COVERAGE
  • ACCOUNT_OVERVIEW
  • RECOMMENDATION
  • RUNTIME_SIGNALS
  • DISTRIBUTION
  • REPRESENTATIVE_RESOURCE

FindingDetail -> (structure)

Details about a GuardDuty finding. Set when ObservationType is FINDING_DETAIL .

FindingId -> (string)

The ID of the finding.

Constraints:

  • min: 1
  • max: 300

FindingType -> (string)

The type of the finding.

Constraints:

  • min: 1
  • max: 100

Severity -> (string)

The severity of the finding.

AccountId -> (string)

The ID of the Amazon Web Services account in which the finding was generated.

Region -> (string)

The Amazon Web Services Region in which the finding was generated.

ActivityWindow -> (structure)

The time range of the activity that the finding describes.

FirstSeenAt -> (timestamp)

The timestamp at which the activity was first observed.

LastSeenAt -> (timestamp)

The timestamp at which the activity was last observed.

Resource -> (structure)

Details about an affected resource. Set when ObservationType is RESOURCE .

Uid -> (string) [required]

The unique identifier of the resource. This is the Amazon Resource Name (ARN) of the resource when it’s available. Otherwise, it’s the name or ID of the resource.

Name -> (string)

The name of the resource.

ResourceType -> (string) [required]

The type of the resource. Possible values are EC2_INSTANCE , EBS_VOLUME , S3_BUCKET , IAM_ROLE , IAM_USER , IAM_ACCESS_KEY , LAMBDA_FUNCTION , EKS_CLUSTER , ECS_CLUSTER , KUBERNETES_WORKLOAD , RDS_INSTANCE , RDS_DB_USER , and EC2_SECURITY_GROUP .

Possible values:

  • EC2_INSTANCE
  • EBS_VOLUME
  • S3_BUCKET
  • IAM_ROLE
  • IAM_USER
  • IAM_ACCESS_KEY
  • LAMBDA_FUNCTION
  • EKS_CLUSTER
  • ECS_CLUSTER
  • KUBERNETES_WORKLOAD
  • RDS_INSTANCE
  • RDS_DB_USER
  • EC2_SECURITY_GROUP

Data -> (structure)

Details that are specific to the type of the resource.

Ec2Instance -> (structure)

Details about an Amazon EC2 instance.

InstanceId -> (string)

The ID of the instance.

InstanceType -> (string)

The instance type.

InstanceState -> (string)

The state of the instance.

AvailabilityZone -> (string)

The Availability Zone of the instance.

PrivateIpAddress -> (string)

The private IP address of the instance.

PublicIp -> (string)

The public IP address of the instance.

VpcId -> (string)

The ID of the VPC in which the instance runs.

SubnetId -> (string)

The ID of the subnet in which the instance runs.

ImageId -> (string)

The ID of the Amazon Machine Image (AMI) that was used to launch the instance.

LaunchedAt -> (timestamp)

The timestamp at which the instance was launched.

LambdaFunction -> (structure)

Details about an Lambda function.

FunctionName -> (string)

The name of the function.

FunctionArn -> (string)

The Amazon Resource Name (ARN) of the function.

FunctionVersion -> (string)

The version of the function.

Role -> (string)

The execution role of the function.

Description -> (string)

The description of the function.

RevisionId -> (string)

The revision ID of the function version.

UpdatedAt -> (timestamp)

The timestamp at which the function was last updated.

VpcConfigurationSummary -> (string)

A summary of the VPC configuration of the function, as a single string.

RdsDbInstance -> (structure)

Details about an Amazon RDS database instance.

DbInstanceIdentifier -> (string)

The identifier of the database instance.

DbClusterIdentifier -> (string)

The identifier of the database cluster that contains the instance.

DbInstanceArn -> (string)

The Amazon Resource Name (ARN) of the database instance.

DbiResourceId -> (string)

The unique resource ID of the database instance.

Engine -> (string)

The database engine of the instance.

EngineVersion -> (string)

The version of the database engine.

RdsDbUser -> (structure)

Details about the user that logged in to an Amazon RDS database instance.

User -> (string)

The user name that was used to log in.

Application -> (string)

The name of the application that was used to log in.

Database -> (string)

The name of the database that the user logged in to.

AuthMethod -> (string)

The authentication method that the user used.

Ssl -> (string)

The version of Secure Sockets Layer (SSL) that the connection used.

EksCluster -> (structure)

Details about an Amazon EKS cluster.

Name -> (string)

The name of the cluster.

Arn -> (string)

The Amazon Resource Name (ARN) of the cluster.

Status -> (string)

The status of the cluster.

VpcId -> (string)

The ID of the VPC that is associated with the cluster.

EcsCluster -> (structure)

Details about an Amazon ECS cluster.

Name -> (string)

The name of the cluster.

Arn -> (string)

The Amazon Resource Name (ARN) of the cluster.

Status -> (string)

The status of the cluster.

NetworkActivity -> (structure)

Details about network activity. Set when ObservationType is NETWORK_ACTIVITY .

Protocol -> (string)

The network protocol of the activity.

Direction -> (string)

The direction of the network connection, such as inbound or outbound.

Method -> (string)

The method that the network activity used.

Blocked -> (string)

Indicates whether the network connection was blocked.

Platform -> (string)

The platform on which the network activity was observed.

Ports -> (structure)

The ports that the network activity involved.

TargetPort -> (string)

The port on the target of the activity.

RemotePort -> (string)

The port on the remote host.

ResolverPort -> (string)

The port of the DNS resolver.

Ports -> (string)

The ports that the activity involved.

PortsUsed -> (string)

The ports that the activity used.

PortCount -> (long)

The number of ports that the activity involved.

Constraints:

  • min: 0

Traffic -> (structure)

The amount of data that the network activity transferred.

BytesSent -> (long)

The number of bytes sent.

Constraints:

  • min: 0

BytesReceived -> (long)

The number of bytes received.

Constraints:

  • min: 0

Anomaly -> (structure)

Details about how the network activity deviates from normal behavior.

BaselineBytes -> (string)

The amount of data that is typical for the normal behavior.

Deviation -> (string)

How much the activity deviates from normal behavior.

ProfileAgeDays -> (integer)

The number of days of activity that the normal behavior is based on.

RemoteService -> (string)

The remote service that the activity involved.

RemoteRegion -> (string)

The Region of the remote endpoint.

Duration -> (string)

The duration of the activity.

ResetRatio -> (string)

The ratio of connection attempts that were reset.

TargetHostCount -> (long)

The number of target hosts.

Constraints:

  • min: 0

Dns -> (structure)

DNS details about the network activity.

DomainSuffix -> (string)

The suffix of the domain that was queried.

OtherDomains -> (string)

Other domains that were queried.

ResolverHistory -> (string)

The DNS resolution history for the domain.

Counts -> (structure)

Counts that describe the network activity, such as the number of requests or connection attempts.

RequestCount -> (long)

The number of requests.

Constraints:

  • min: 0

TotalAttempts -> (long)

The total number of connection attempts.

Constraints:

  • min: 0

SuspiciousAttempts -> (long)

The number of connection attempts that were suspicious.

Constraints:

  • min: 0

ResetAttempts -> (long)

The number of connection attempts that were reset.

Constraints:

  • min: 0

Enrichment -> (structure)

Additional context about the network activity, such as geolocation and threat intelligence information.

CountryName -> (string)

The name of the country associated with the activity.

AsnOrg -> (string)

The name of the organization that owns the autonomous system number (ASN).

ThreatListName -> (string)

The name of the threat list that contains the indicator.

ThreatName -> (string)

The name of the threat.

RdsLoginActivity -> (structure)

Details about login activity on an Amazon RDS database. Set when ObservationType is RDS_LOGIN_ACTIVITY .

Outcome -> (string)

The outcome of the login attempts.

Rate -> (string)

The rate of the login attempts.

AnomalyContext -> (string)

An explanation of how the login activity deviates from normal behavior.

Constraints:

  • min: 0
  • max: 4096

LoginCount -> (long)

The number of login attempts.

Constraints:

  • min: 0

ActivityWindow -> (structure)

The time range of the login activity.

FirstSeenAt -> (timestamp)

The timestamp at which the activity was first observed.

LastSeenAt -> (timestamp)

The timestamp at which the activity was last observed.

Enrichment -> (structure)

Additional context about the login activity, such as geolocation information.

CountryName -> (string)

The name of the country associated with the activity.

AsnOrg -> (string)

The name of the organization that owns the autonomous system number (ASN).

ThreatListName -> (string)

The name of the threat list that contains the indicator.

ThreatName -> (string)

The name of the threat.

S3Activity -> (structure)

Details about Amazon S3 activity. Set when ObservationType is S3_ACTIVITY .

Api -> (string)

The Amazon S3 API operation that was called.

AffectedBucket -> (string)

The name of the affected bucket, or account-wide if the activity isn’t limited to one bucket.

OtherS3Activity -> (string)

Other Amazon S3 activity that is related to the observation.

NonS3Activity -> (string)

Related activity on Amazon Web Services services other than Amazon S3.

SessionAssessment -> (string)

An assessment of the session in which the activity occurred.

Constraints:

  • min: 0
  • max: 4096

EventCount -> (long)

The number of events.

Constraints:

  • min: 0

Actor -> (structure)

The identity that performed the activity.

AccessKeyId -> (string)

The access key ID that the identity used.

PrincipalId -> (string)

The ID of the principal.

UserName -> (string)

The name of the user.

UserType -> (string)

The type of the identity, such as IAMUser , AssumedRole , or Root .

UserAgent -> (string)

The user agent that the identity used.

SourceIp -> (string)

The source address of the activity, or a description of the source.

Enrichment -> (structure)

Additional context about the activity, such as geolocation information.

CountryName -> (string)

The name of the country associated with the activity.

AsnOrg -> (string)

The name of the organization that owns the autonomous system number (ASN).

ThreatListName -> (string)

The name of the threat list that contains the indicator.

ThreatName -> (string)

The name of the threat.

ActivityWindow -> (structure)

The time range of the activity.

FirstSeenAt -> (timestamp)

The timestamp at which the activity was first observed.

LastSeenAt -> (timestamp)

The timestamp at which the activity was last observed.

KubernetesActivity -> (structure)

Details about Kubernetes activity. Set when ObservationType is KUBERNETES_ACTIVITY .

ApiCall -> (structure)

Details about a Kubernetes API call.

ClusterName -> (string)

The name of the cluster.

Username -> (string)

The Kubernetes user name of the caller.

UserGroups -> (string)

The Kubernetes groups of the caller.

UserId -> (string)

The ID of the caller.

Verb -> (string)

The Kubernetes API verb, such as get or create .

ResourceType -> (string)

The type of the Kubernetes resource.

ResourceName -> (string)

The name of the Kubernetes resource.

Namespace -> (string)

The Kubernetes namespace of the resource.

RequestUri -> (string)

The URI of the request.

StatusCode -> (integer)

The status code of the API call.

SourceIps -> (string)

The source IP addresses of the API call.

UserAgent -> (string)

The user agent of the caller.

EventCount -> (long)

The number of matching API calls.

Constraints:

  • min: 0

Anomaly -> (structure)

Details about anomalous Kubernetes behavior.

UnusualBehavior -> (string)

A description of the unusual behavior.

Constraints:

  • min: 0
  • max: 4096

BaselineContext -> (string)

A description of the normal behavior that the activity was compared against.

Constraints:

  • min: 0
  • max: 4096

AnomalyScore -> (string)

The anomaly score of the behavior.

TrainingPeriod -> (string)

The period over which the normal behavior was established.

Workload -> (structure)

The Kubernetes workload that is associated with the anomaly.

WorkloadType -> (string)

The type of the workload.

WorkloadName -> (string)

The name of the workload.

Containers -> (string)

The containers in the workload.

Volumes -> (string)

The volumes of the workload.

SecurityContext -> (string)

The security context of the workload.

Enrichment -> (structure)

Additional context about the API call, such as geolocation information.

CountryName -> (string)

The name of the country associated with the activity.

AsnOrg -> (string)

The name of the organization that owns the autonomous system number (ASN).

ThreatListName -> (string)

The name of the threat list that contains the indicator.

ThreatName -> (string)

The name of the threat.

MalwareScan -> (structure)

Details about a malware scan. Set when ObservationType is MALWARE_SCAN .

ScanId -> (string)

The ID of the scan.

ScanType -> (string)

The type of the scan. Possible values are BACKUP_INITIATED , ON_DEMAND , and GUARDDUTY_INITIATED .

Possible values:

  • BACKUP_INITIATED
  • ON_DEMAND
  • GUARDDUTY_INITIATED

ScanCategory -> (string)

The category of the scan. Possible values are FULL_SCAN and INCREMENTAL_SCAN .

Possible values:

  • FULL_SCAN
  • INCREMENTAL_SCAN

TriggerFindingId -> (string)

The ID of the finding that initiated the scan.

Constraints:

  • min: 1
  • max: 300

EngineSources -> (string)

The scan engines that the scan used.

ScanStartedAt -> (timestamp)

The timestamp at which the scan started.

ScanCompletedAt -> (timestamp)

The timestamp at which the scan completed.

FilesScanned -> (long)

The number of files that the scan scanned.

Constraints:

  • min: 0

GigabytesScanned -> (double)

The amount of data that the scan scanned, in GB.

VolumesScanned -> (long)

The number of volumes that the scan scanned.

Constraints:

  • min: 0

InfectedFileCount -> (long)

The number of infected files.

Constraints:

  • min: 0

ResourceType -> (string)

The type of the scanned resource.

ResourceIdentifier -> (string)

The identifier of the scanned resource.

HighestSeverity -> (string)

The highest severity among the threats that the scan detected.

HighestSeverityThreatName -> (string)

The name of the threat that has the highest severity.

UniqueThreatCount -> (long)

The number of unique threats that the scan detected.

Constraints:

  • min: 0

TotalInfectedItems -> (long)

The total number of infected items.

Constraints:

  • min: 0

Threats -> (list)

The threats that the scan detected.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about a threat that a malware scan detected.

Name -> (string)

The name of the threat.

Severity -> (string)

The severity of the threat.

InfectedFileCount -> (long)

The number of files that the threat infected.

Constraints:

  • min: 0

SampleFiles -> (string)

Examples of files that the threat infected.

RelatedFindings -> (structure)

Details about findings that are related to the investigated activity. Set when ObservationType is RELATED_FINDINGS .

Correlated -> (list)

The findings that GuardDuty correlated with the investigated activity, grouped by finding type.

Constraints:

  • min: 0
  • max: 8

(structure)

Contains information about a group of correlated findings that have the same finding type.

FindingType -> (string)

The finding type of the group.

Constraints:

  • min: 1
  • max: 100

Count -> (long)

The number of correlated findings of this type. This value can be greater than the number of IDs in FindingIds .

Constraints:

  • min: 0

SeverityMax -> (double)

The highest severity score among the findings in the group, from 0 to 10.

Constraints:

  • min: 0
  • max: 10

CorrelationReasons -> (list)

The reasons why GuardDuty correlated the findings. Possible values are HIGH_SEVERITY , SAME_RESOURCE , and SAME_BEHAVIOR . A value can appear more than once.

Constraints:

  • min: 0
  • max: 10

(string)

Possible values:

  • HIGH_SEVERITY
  • SAME_RESOURCE
  • SAME_BEHAVIOR

FindingIds -> (list)

A sample of the IDs of the findings in the group.

Constraints:

  • min: 0
  • max: 50

(string)

Constraints:

  • min: 1
  • max: 300

SharedResources -> (list)

The resources that the findings in the group share with the investigated activity.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains information about a resource that related findings share.

ResourceType -> (string)

The type of the resource. This value isn’t limited to the resource types of InvestigationResource .

Identifier -> (string)

The identifier of the resource.

SharedBehaviors -> (list)

The behaviors that the findings in the group share with the investigated activity.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains information about a behavior that related findings share.

Path -> (string)

The JSON path of the finding attribute that matched.

Value -> (string)

The value that matched.

Observed -> (list)

Other finding types that GuardDuty observed, with counts. These entries don’t include finding IDs.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about a finding type that GuardDuty observed.

FindingType -> (string)

The finding type.

Constraints:

  • min: 1
  • max: 100

Count -> (long)

The number of findings of this type.

Constraints:

  • min: 0

SeverityMax -> (double)

The highest severity score among the findings of this type, from 0 to 10.

Constraints:

  • min: 0
  • max: 10

SharedResources -> (list)

The resources that the findings of this type share with the investigated activity.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains information about a resource that related findings share.

ResourceType -> (string)

The type of the resource. This value isn’t limited to the resource types of InvestigationResource .

Identifier -> (string)

The identifier of the resource.

DetectionCoverage -> (structure)

Details about your detection coverage. Set when ObservationType is DETECTION_COVERAGE .

ProtectionPlans -> (list)

The protection plans and their status.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains information about the status of a protection plan.

Name -> (string)

The name of the protection plan. Possible values are CLOUD_TRAIL , DNS_LOGS , FLOW_LOGS , S3_DATA_EVENTS , EKS_AUDIT_LOGS , EBS_MALWARE_PROTECTION , RDS_LOGIN_EVENTS , EKS_RUNTIME_MONITORING , EKS_ADDON_MANAGEMENT , LAMBDA_NETWORK_LOGS , RUNTIME_MONITORING , ECS_FARGATE_AGENT_MANAGEMENT , and EC2_AGENT_MANAGEMENT .

Possible values:

  • CLOUD_TRAIL
  • DNS_LOGS
  • FLOW_LOGS
  • S3_DATA_EVENTS
  • EKS_AUDIT_LOGS
  • EBS_MALWARE_PROTECTION
  • RDS_LOGIN_EVENTS
  • EKS_RUNTIME_MONITORING
  • EKS_ADDON_MANAGEMENT
  • LAMBDA_NETWORK_LOGS
  • RUNTIME_MONITORING
  • ECS_FARGATE_AGENT_MANAGEMENT
  • EC2_AGENT_MANAGEMENT

Status -> (string)

The status of the protection plan. Possible values are ENABLED and DISABLED .

Possible values:

  • ENABLED
  • DISABLED

FoundationalDataSources -> (list)

The foundational data sources, such as CLOUD_TRAIL , DNS_LOGS , and FLOW_LOGS .

Constraints:

  • min: 0
  • max: 20

(string)

Possible values:

  • CLOUD_TRAIL
  • DNS_LOGS
  • FLOW_LOGS
  • S3_DATA_EVENTS
  • EKS_AUDIT_LOGS
  • EBS_MALWARE_PROTECTION
  • RDS_LOGIN_EVENTS
  • EKS_RUNTIME_MONITORING
  • EKS_ADDON_MANAGEMENT
  • LAMBDA_NETWORK_LOGS
  • RUNTIME_MONITORING
  • ECS_FARGATE_AGENT_MANAGEMENT
  • EC2_AGENT_MANAGEMENT

CoverageGaps -> (string)

A description of the gaps in detection coverage. A record doesn’t include both CoverageGaps and KeyObservation .

Constraints:

  • min: 0
  • max: 4096

KeyObservation -> (string)

A key observation about detection coverage.

Constraints:

  • min: 0
  • max: 4096

AccountOverview -> (structure)

Overview information about an account. Set when ObservationType is ACCOUNT_OVERVIEW .

AccountId -> (string)

The Amazon Web Services account ID.

AccountStatus -> (string)

The status of the account.

DetectorId -> (string)

The ID of the detector of the account.

Constraints:

  • min: 1
  • max: 300

Region -> (string)

The Amazon Web Services Region of the detector.

DelegatedAdminAccountId -> (string)

The account ID of the GuardDuty delegated administrator account.

TotalMemberAccounts -> (long)

The total number of member accounts.

Constraints:

  • min: 0

TotalFindings -> (long)

The total number of findings.

Constraints:

  • min: 0

AffectedAccountCount -> (long)

The number of accounts that have findings.

Constraints:

  • min: 0

AccountRankings -> (list)

A ranking of member accounts.

Constraints:

  • min: 0
  • max: 10

(structure)

Contains information about the position of a member account in a ranking.

Rank -> (integer)

The position of the account in the ranking.

AccountId -> (string)

The Amazon Web Services account ID of the member account.

FindingCount -> (long)

The number of findings in the account.

Constraints:

  • min: 0

RiskLevel -> (string)

The assessed risk level of the account. Possible values are Info , Low , Medium , High , and Critical .

Possible values:

  • Info
  • Low
  • Medium
  • High
  • Critical

Constraints:

  • min: 1
  • max: 300

RiskRationale -> (string)

The reason for the assessed risk level.

Constraints:

  • min: 0
  • max: 4096

Recommendations -> (list)

Recommended actions. Set when ObservationType is RECOMMENDATION .

Constraints:

  • min: 0
  • max: 25

(structure)

Contains a recommended action.

Title -> (string)

A short title for the recommendation.

Rationale -> (string)

The reason for the recommendation.

Category -> (string)

The category of the recommendation. Possible values are ENABLE_PROTECTION , FURTHER_INVESTIGATION , SUPPRESSION_RULE , HARDENING , and MONITORING .

Possible values:

  • ENABLE_PROTECTION
  • FURTHER_INVESTIGATION
  • SUPPRESSION_RULE
  • HARDENING
  • MONITORING

Priority -> (string)

The priority of the recommendation. Possible values are IMMEDIATE , SHORT_TERM , and STRATEGIC .

Possible values:

  • IMMEDIATE
  • SHORT_TERM
  • STRATEGIC

CliCommands -> (list)

CLI commands that you can run to carry out the recommendation.

Constraints:

  • min: 0
  • max: 20

(string)

RuntimeSignals -> (structure)

A summary of runtime signals. Set when ObservationType is RUNTIME_SIGNALS .

SignalGroups -> (list)

The runtime signals, grouped by finding type.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about a group of runtime signals that have the same finding type.

FindingType -> (string)

The finding type of the group.

Constraints:

  • min: 1
  • max: 100

Severity -> (double)

The severity score of the signals in the group, from 0 to 10.

Constraints:

  • min: 0
  • max: 10

Count -> (long)

The number of signals in the group.

Constraints:

  • min: 0

KeyObservation -> (string)

A key observation about the runtime signals.

Constraints:

  • min: 0
  • max: 4096

Distribution -> (structure)

A breakdown of findings along one dimension. Set when ObservationType is DISTRIBUTION .

Dimension -> (string) [required]

The dimension of the breakdown. The value identifies the breakdown that the record describes: SEVERITY (SeverityBreakdown ), TYPE (FindingTypes or TopFindingTypes ), RESOURCE (Resources ), ATTACK_VECTOR (AttackVectors ), and ARCHIVE (Archive ).

Possible values:

  • SEVERITY
  • TYPE
  • RESOURCE
  • ATTACK_VECTOR
  • ARCHIVE

TotalFindings -> (long)

The total number of findings in the breakdown.

Constraints:

  • min: 0

SeverityBreakdown -> (structure)

The number of findings at each severity level.

Critical -> (integer)

The number of findings that have Critical severity.

High -> (integer)

The number of findings that have High severity.

Medium -> (integer)

The number of findings that have Medium severity.

Low -> (integer)

The number of findings that have Low severity.

Info -> (integer)

The number of findings that have Info severity.

FindingTypes -> (list)

The findings broken down by finding type, with counts and percentages.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains the number and percentage of findings of a finding type.

FindingType -> (string)

The finding type.

Constraints:

  • min: 1
  • max: 100

Count -> (long)

The number of findings of this type.

Constraints:

  • min: 0

Percentage -> (double)

The percentage of findings that are of this type, from 0 to 100.

Constraints:

  • min: 0
  • max: 100

DominantSeverity -> (string)

The most common severity among findings of this type.

TopFindingTypes -> (list)

The finding types that have the most findings, with counts.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains the number of findings of a finding type.

FindingType -> (string)

The finding type.

Count -> (integer)

The number of findings of this type.

Resources -> (list)

The findings broken down by affected resource.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains the number of findings for a resource.

ResourceType -> (string)

The display name of the resource type, such as Instance .

Identifier -> (string)

The identifier of the resource.

Count -> (long)

The number of findings for the resource.

Constraints:

  • min: 0

AttackVectors -> (list)

The findings broken down by MITRE ATT&CK tactic.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains information about the findings associated with a MITRE ATT&CK tactic.

Phase -> (string)

The name of the tactic. Possible values are Reconnaissance , Resource Development , Initial Access , Execution , Persistence , Privilege Escalation , Defense Evasion , Credential Access , Discovery , Lateral Movement , Collection , Command and Control , Exfiltration , and Impact .

Possible values:

  • Reconnaissance
  • Resource Development
  • Initial Access
  • Execution
  • Persistence
  • Privilege Escalation
  • Defense Evasion
  • Credential Access
  • Discovery
  • Lateral Movement
  • Collection
  • Command and Control
  • Exfiltration
  • Impact

FindingCount -> (integer)

The number of findings associated with the tactic.

FindingTypes -> (list)

The finding types associated with the tactic.

Constraints:

  • min: 0
  • max: 50

(string)

Techniques -> (list)

The MITRE ATT&CK techniques within the tactic that are associated with findings.

Constraints:

  • min: 0
  • max: 50

(structure)

Contains information about the findings associated with a MITRE ATT&CK technique.

Technique -> (structure)

The technique.

Name -> (string)

The name of the tactic or technique.

Uid -> (string)

The MITRE ATT&CK identifier of the tactic or technique, such as TA0002 or T1059.004 .

Constraints:

  • pattern: (TA|T)\d{4}(\.\d{3})?

FindingCount -> (integer)

The number of findings associated with the technique.

FindingTypes -> (list)

The finding types associated with the technique.

Constraints:

  • min: 0
  • max: 50

(string)

Archive -> (structure)

The number and percentage of archived and unarchived findings.

ArchivedCount -> (long)

The number of archived findings.

Constraints:

  • min: 0

UnarchivedCount -> (long)

The number of unarchived findings.

Constraints:

  • min: 0

ArchivedPercentage -> (double)

The percentage of findings that are archived, from 0 to 100.

Constraints:

  • min: 0
  • max: 100

UnarchivedPercentage -> (double)

The percentage of findings that are unarchived, from 0 to 100.

Constraints:

  • min: 0
  • max: 100

RepresentativeResources -> (list)

Representative findings for the affected resources, one finding for each resource. Set when ObservationType is REPRESENTATIVE_RESOURCE .

Constraints:

  • min: 0
  • max: 20

(structure)

Contains a representative finding for an affected resource. GuardDuty selects one finding for each affected resource, based on severity.

ResourceType -> (string)

The type of the affected resource.

Identifier -> (string)

The identifier of the affected resource.

FindingId -> (string)

The ID of the representative finding.

Constraints:

  • min: 1
  • max: 300

FindingCount -> (long)

The number of findings for the resource.

Constraints:

  • min: 0

RiskLevel -> (string)

The assessed risk level of the resource. Possible values are Info , Low , Medium , High , and Critical .

Possible values:

  • Info
  • Low
  • Medium
  • High
  • Critical

Constraints:

  • min: 1
  • max: 300

RiskRationale -> (string)

The reason for the assessed risk level.

Constraints:

  • min: 0
  • max: 4096

Indicators -> (list)

The threat indicators associated with the observation, such as an IP address, a domain, or a file hash.

Constraints:

  • min: 0
  • max: 20

(structure)

Contains a threat indicator, such as an IP address, a domain, or a file hash.

Value -> (string) [required]

The value of the indicator.

Constraints:

  • min: 1
  • max: 1024

Type -> (string)

The type of the indicator. Possible values are IP , DOMAIN , and FILE .

Possible values:

  • IP
  • DOMAIN
  • FILE

Metadata -> (structure)

Operational details about the investigation. Set for METADATA records.

TotalTimeMilliseconds -> (long)

The total time that the investigation took, in milliseconds.

Constraints:

  • min: 0

NextToken -> (string)

The pagination parameter to be used on the next list operation to retrieve more items. If this value is absent, there are no more records to retrieve.

Constraints:

  • min: 1
  • max: 2048
  • pattern: [a-zA-Z0-9+/=_\-]+
© Copyright 2026, Amazon Web Services. Created using Sphinx.