AnalysisRecord

Contains an assessment that GuardDuty derived from the data during an investigation, such as a threat assessment, a comparison against normal behavior, or a process lineage. The record contains at most one of the payload members, the one that corresponds to AnalysisType. Indicators can accompany any analysis type.

analysisType

The kind of analysis. The value identifies the payload member that can be set: REPUTATION, THREAT_ASSESSMENT, and RDS_THREAT_ASSESSMENT (ThreatAssessment); KUBERNETES_POLICY_VIOLATION (KubernetesPolicyViolation); S3_EXPOSURE, S3_ACTOR_CONTEXT, and S3_PEN_TEST (S3Analysis); PROCESS_LINEAGE (Processes); and TREND and BASELINE (AccountAnalysis).

Type: String

Required: Yes

accountAnalysis

An analysis of the findings in an account over time. Set when AnalysisType is TREND or BASELINE.

Type: InvestigationAccountAnalysis object

Required: No

indicators

The threat indicators associated with the analysis, such as an IP address, a domain, or a file hash.

Type: Array of InvestigationIndicator objects

Array Members: Minimum number of 0 items. Maximum number of 20 items.

Required: No

kubernetesPolicyViolation

An assessment of a Kubernetes policy violation. Set when AnalysisType is KUBERNETES_POLICY_VIOLATION.

Type: KubernetesPolicyViolation object

Required: No

processes

The processes in a process lineage. Set when AnalysisType is PROCESS_LINEAGE.

Type: Array of Process objects

Array Members: Minimum number of 0 items. Maximum number of 100 items.

Required: No

s3Analysis

An analysis of Amazon S3 activity or exposure. Set when AnalysisType is S3_EXPOSURE, S3_ACTOR_CONTEXT, or S3_PEN_TEST.

Type: S3Analysis object

Required: No

threatAssessment

A threat assessment. Set when AnalysisType is REPUTATION, THREAT_ASSESSMENT, or RDS_THREAT_ASSESSMENT.

Type: InvestigationThreatAssessment object

Required: No

AnalysisRecord

Contents

See Also