InvestigationThreatAssessment

Contains a threat assessment. The members that are set depend on the AnalysisType of the record.

assessment

The assessment of the threat.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

authenticationContext

Context about how the identity involved in the activity authenticated.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

classification

The classification of the threat.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

credentialCompromise

An assessment of whether credentials were compromised.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

ipAccountActivity

An assessment of the activity from the IP address in the account.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

rdsControlPlaneActivity

An assessment of Amazon RDS control plane activity that is related to the threat.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 4096.

Required: No

reputation

Reputation information about a threat indicator. Set when AnalysisType is REPUTATION.

Type: Reputation object

Required: No

threatConfidence

The confidence in the threat assessment. Possible values are VERY_HIGH, HIGH, MEDIUM, and LOW.

Type: String

Valid Values: VERY_HIGH | HIGH | MEDIUM | LOW

Required: No

Contents