ObservationRecord

Contains a fact that GuardDuty noted about your environment during an investigation, such as the affected resource, the activity on that resource, or your detection coverage. The record contains at most one of the payload members, the one that matches ObservationType. Indicators can accompany any observation type.

observationType

The kind of observation. The value identifies the payload member that can be set: FINDING_DETAIL (FindingDetail), RESOURCE (Resource), NETWORK_ACTIVITY (NetworkActivity), RDS_LOGIN_ACTIVITY (RdsLoginActivity), S3_ACTIVITY (S3Activity), KUBERNETES_ACTIVITY (KubernetesActivity), MALWARE_SCAN (MalwareScan), RELATED_FINDINGS (RelatedFindings), DETECTION_COVERAGE (DetectionCoverage), ACCOUNT_OVERVIEW (AccountOverview), RECOMMENDATION (Recommendations), RUNTIME_SIGNALS (RuntimeSignals), DISTRIBUTION (Distribution), and REPRESENTATIVE_RESOURCE (RepresentativeResources).

Type: String

Required: Yes

accountOverview

Overview information about an account. Set when ObservationType is ACCOUNT_OVERVIEW.

Type: AccountOverview object

Required: No

detectionCoverage

Details about your detection coverage. Set when ObservationType is DETECTION_COVERAGE.

Type: DetectionCoverage object

Required: No

distribution

A breakdown of findings along one dimension. Set when ObservationType is DISTRIBUTION.

Type: Distribution object

Required: No

findingDetail

Details about a GuardDuty finding. Set when ObservationType is FINDING_DETAIL.

Type: FindingDetail object

Required: No

indicators

The threat indicators associated with the observation, such as an IP address, a domain, or a file hash.

Type: Array of InvestigationIndicator objects

Array Members: Minimum number of 0 items. Maximum number of 20 items.

Required: No

kubernetesActivity

Details about Kubernetes activity. Set when ObservationType is KUBERNETES_ACTIVITY.

Type: KubernetesActivity object

Required: No

malwareScan

Details about a malware scan. Set when ObservationType is MALWARE_SCAN.

Type: InvestigationMalwareScan object

Required: No

networkActivity

Details about network activity. Set when ObservationType is NETWORK_ACTIVITY.

Type: NetworkActivity object

Required: No

rdsLoginActivity

Details about login activity on an Amazon RDS database. Set when ObservationType is RDS_LOGIN_ACTIVITY.

Type: RdsLoginActivity object

Required: No

recommendations

Recommended actions. Set when ObservationType is RECOMMENDATION.

Type: Array of Recommendation objects

Array Members: Minimum number of 0 items. Maximum number of 25 items.

Required: No

relatedFindings

Details about findings that are related to the investigated activity. Set when ObservationType is RELATED_FINDINGS.

Type: RelatedFindings object

Required: No

representativeResources

Representative findings for the affected resources, one finding for each resource. Set when ObservationType is REPRESENTATIVE_RESOURCE.

Type: Array of RepresentativeFinding objects

Array Members: Minimum number of 0 items. Maximum number of 20 items.

Required: No

resource

Details about an affected resource. Set when ObservationType is RESOURCE.

Type: InvestigationResource object

Required: No

runtimeSignals

A summary of runtime signals. Set when ObservationType is RUNTIME_SIGNALS.

Type: RuntimeSignals object

Required: No

s3Activity

Details about Amazon S3 activity. Set when ObservationType is S3_ACTIVITY.

Type: S3Activity object

Required: No

ObservationRecord

Contents

See Also