Class: Aws::Detective::Types::IndicatorDetail

Inherits:
Struct
  • Object
show all
Includes:
Structure
Defined in:
lib/aws-sdk-detective/types.rb

Overview

Details about the indicators of compromise which are used to determine if a resource is involved in a security incident. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. For the list of indicators of compromise that are generated by Detective investigations, see [Detective investigations].

[1]: docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#flagged_ip_address_detail ⇒ Types::FlaggedIpAddressDetail

Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from Amazon Web Services threat intelligence.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#impossible_travel_detail ⇒ Types::ImpossibleTravelDetail

Identifies unusual and impossible user activity for an account.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#new_aso_detail ⇒ Types::NewAsoDetail

Contains details about the new Autonomous System Organization (ASO).

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#new_geolocation_detail ⇒ Types::NewGeolocationDetail

Contains details about the new geographic location.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#new_user_agent_detail ⇒ Types::NewUserAgentDetail

Contains details about the new user agent.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#related_finding_detail ⇒ Types::RelatedFindingDetail

Contains details about related findings.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#related_finding_group_detail ⇒ Types::RelatedFindingGroupDetail

Contains details about related finding groups.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end

#tt_ps_observed_detail ⇒ Types::TTPsObservedDetail

Details about the indicator of compromise.

Returns:



771
772
773
774
775
776
777
778
779
780
781
782
 
# File 'lib/aws-sdk-detective/types.rb', line 771

class IndicatorDetail < Struct.new(
  :tt_ps_observed_detail,
  :impossible_travel_detail,
  :flagged_ip_address_detail,
  :new_geolocation_detail,
  :new_aso_detail,
  :new_user_agent_detail,
  :related_finding_detail,
  :related_finding_group_detail)
  SENSITIVE = []
  include Aws::Structure
end