InvestigationRecord

Contains information about one step in the reasoning that GuardDuty followed during an investigation.

createdAt

The timestamp at which GuardDuty created the record.

Type: Timestamp

Required: Yes

recordId

The unique identifier of the record.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

Required: Yes

title

A short title that describes the step.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 1024.

Required: Yes

type

The type of the record. Possible values:

UPDATE – A progress milestone, such as the request that started the investigation or a response from GuardDuty.
FETCH – Data that GuardDuty retrieved for the investigation, such as a finding, a detector configuration, or a list of your member accounts. The record includes what GuardDuty requested and what it received.
OBSERVATION – A fact that GuardDuty noted about your environment, such as the affected resource, the activity on that resource, or your detection coverage.
ANALYSIS – An assessment that GuardDuty derived from the data, such as a threat assessment, a comparison against normal behavior, or a process lineage.
METADATA – Operational details about the investigation itself, such as how long the investigation took.

Type: String

Valid Values: OBSERVATION | ANALYSIS | UPDATE | FETCH | METADATA

Required: Yes

narrative

A plain-text explanation of the step. A narrative can span several paragraphs. Not every record includes a narrative.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

supportingData

The structured details for the step. The member that is set matches the record type. UPDATE records never include supporting data, and records of other types don't always include it.

Type: SupportingData object

Note: This object is a Union. Only one member of this object can be specified or returned.

Required: No

InvestigationRecord

Contents

See Also