View a markdown version of this page

CorrelatedFinding - Amazon GuardDuty
ContentsSee Also

CorrelatedFinding

Contains information about a group of correlated findings that have the same finding type.

Contents

correlationReasons

The reasons why GuardDuty correlated the findings. Possible values are HIGH_SEVERITY, SAME_RESOURCE, and SAME_BEHAVIOR. A value can appear more than once.

Type: Array of strings

Array Members: Minimum number of 0 items. Maximum number of 10 items.

Valid Values: HIGH_SEVERITY | SAME_RESOURCE | SAME_BEHAVIOR

Required: No

count

The number of correlated findings of this type. This value can be greater than the number of IDs in FindingIds.

Type: Long

Valid Range: Minimum value of 0.

Required: No

findingIds

A sample of the IDs of the findings in the group.

Type: Array of strings

Array Members: Minimum number of 0 items. Maximum number of 50 items.

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: No

findingType

The finding type of the group.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 100.

Required: No

severityMax

The highest severity score among the findings in the group, from 0 to 10.

Type: Double

Valid Range: Minimum value of 0. Maximum value of 10.

Required: No

sharedBehaviors

The behaviors that the findings in the group share with the investigated activity.

Type: Array of SharedBehavior objects

Array Members: Minimum number of 0 items. Maximum number of 20 items.

Required: No

sharedResources

The resources that the findings in the group share with the investigated activity.

Type: Array of SharedResource objects

Array Members: Minimum number of 0 items. Maximum number of 20 items.

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: