Class: Aws::SecurityHub::Types::Indicator

Inherits:
Struct
  • Object
show all
Defined in:
gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb

Overview

Contains information about the indicators observed in an Amazon GuardDuty Extended Threat Detection attack sequence. Indicators include a set of signals, which can be API activities or findings that GuardDuty uses to detect an attack sequence finding. GuardDuty generates an attack sequence finding when multiple signals align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub CSPM, you must have GuardDuty and GuardDuty S3 Protection enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#key ⇒ String

The name of the indicator that’s present in the attack sequence finding.

Returns:

  • (String) 


26639
26640
26641
26642
26643
26644
26645
26646
 
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26639

class Indicator < Struct.new(
  :key,
  :values,
  :title,
  :type)
  SENSITIVE = []
  include Aws::Structure
end

#title ⇒ String

The title describing the indicator.

Returns:

  • (String) 


26639
26640
26641
26642
26643
26644
26645
26646
 
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26639

class Indicator < Struct.new(
  :key,
  :values,
  :title,
  :type)
  SENSITIVE = []
  include Aws::Structure
end

#type ⇒ String

The type of indicator.

Returns:

  • (String) 


26639
26640
26641
26642
26643
26644
26645
26646
 
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26639

class Indicator < Struct.new(
  :key,
  :values,
  :title,
  :type)
  SENSITIVE = []
  include Aws::Structure
end

#values ⇒ Array<String>

Values associated with each indicator key. For example, if the indicator key is SUSPICIOUS_NETWORK, then the value will be the name of the network. If the indicator key is ATTACK_TACTIC, then the value will be one of the MITRE tactics.

Returns:

  • (Array<String>) 


26639
26640
26641
26642
26643
26644
26645
26646
 
# File 'gems/aws-sdk-securityhub/lib/aws-sdk-securityhub/types.rb', line 26639

class Indicator < Struct.new(
  :key,
  :values,
  :title,
  :type)
  SENSITIVE = []
  include Aws::Structure
end