Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

ListIndicators

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Request Syntax


POST /investigations/listIndicators HTTP/1.1
Content-type: application/json

{
   "GraphArn": "string",
   "IndicatorType": "string",
   "InvestigationId": "string",
   "MaxResults": number,
   "NextToken": "string"
}

URI Request Parameters

The request does not use any URI parameters.

Request Body

The request accepts the following data in JSON format.

GraphArn

The Amazon Resource Name (ARN) of the behavior graph.

Type: String

Pattern: ^arn:aws[-\w]{0,10}?:detective:[-\w]{2,20}?:\d{12}?:graph:[abcdef\d]{32}?$

Required: Yes

IndicatorType

For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations.

Type: String

Required: No

InvestigationId

The investigation ID of the investigation report.

Type: String

Length Constraints: Fixed length of 21.

Pattern: ^[0-9]+$

Required: Yes

MaxResults

Lists the maximum number of indicators in a page.

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 100.

Required: No

NextToken

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2048.

Required: No

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "GraphArn": "string",
   "Indicators": [ 
      { 
         "IndicatorDetail": { 
            "FlaggedIpAddressDetail": { 
               "IpAddress": "string",
               "Reason": "string"
            },
            "ImpossibleTravelDetail": { 
               "EndingIpAddress": "string",
               "EndingLocation": "string",
               "HourlyTimeDelta": number,
               "StartingIpAddress": "string",
               "StartingLocation": "string"
            },
            "NewAsoDetail": { 
               "Aso": "string",
               "IsNewForEntireAccount": boolean
            },
            "NewGeolocationDetail": { 
               "IpAddress": "string",
               "IsNewForEntireAccount": boolean,
               "Location": "string"
            },
            "NewUserAgentDetail": { 
               "IsNewForEntireAccount": boolean,
               "UserAgent": "string"
            },
            "RelatedFindingDetail": { 
               "Arn": "string",
               "IpAddress": "string",
               "Type": "string"
            },
            "RelatedFindingGroupDetail": { 
               "Id": "string"
            },
            "TTPsObservedDetail": { 
               "APIFailureCount": number,
               "APIName": "string",
               "APISuccessCount": number,
               "IpAddress": "string",
               "Procedure": "string",
               "Tactic": "string",
               "Technique": "string"
            }
         },
         "IndicatorType": "string"
      }
   ],
   "InvestigationId": "string",
   "NextToken": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

GraphArn

The Amazon Resource Name (ARN) of the behavior graph.

Type: String

Pattern: ^arn:aws[-\w]{0,10}?:detective:[-\w]{2,20}?:\d{12}?:graph:[abcdef\d]{32}?$

Indicators

Lists the indicators of compromise.

Type: Array of Indicator objects

InvestigationId

The investigation ID of the investigation report.

Type: String

Length Constraints: Fixed length of 21.

Pattern: ^[0-9]+$

NextToken

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2048.

Errors

For information about the errors that are common to all actions, see Common Errors.

AccessDeniedException

The request issuer does not have permission to access this resource or perform this operation.

HTTP Status Code: 403

InternalServerException

The request was valid but failed because of a problem with the service.

HTTP Status Code: 500

ResourceNotFoundException

The request refers to a nonexistent resource.

HTTP Status Code: 404

TooManyRequestsException

The request cannot be completed because too many other requests are occurring at the same time.

HTTP Status Code: 429

ValidationException

The request parameters are invalid.

HTTP Status Code: 400