Class: Aws::SecurityHub::Types::ActorSession

Inherits:
Struct
  • Object
show all
Includes:
Aws::Structure
Defined in:
lib/aws-sdk-securityhub/types.rb

Overview

Contains information about the authenticated session used by the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub, you must have GuardDuty enabled. For more information, see

GuardDuty Extended Threat Detection ][1

in the *Amazon GuardDuty

User Guide*.

[1]: docs.aws.amazon.com/guardduty/latest/ug/guardduty-extended-threat-detection.html

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#created_time ⇒ Integer

The timestamp for when the session was created.

In CloudTrail, you can find this value as ‘userIdentity.sessionContext.attributes.creationDate`.

Returns:

  • (Integer) 


349
350
351
352
353
354
355
356
 
# File 'lib/aws-sdk-securityhub/types.rb', line 349

class ActorSession < Struct.new(
  :uid,
  :mfa_status,
  :created_time,
  :issuer)
  SENSITIVE = []
  include Aws::Structure
end

#issuer ⇒ String

The issuer of the session.

In CloudTrail, you can find this value as ‘userIdentity.sessionContext.sessionIssuer.arn`.

Returns:

  • (String) 


349
350
351
352
353
354
355
356
 
# File 'lib/aws-sdk-securityhub/types.rb', line 349

class ActorSession < Struct.new(
  :uid,
  :mfa_status,
  :created_time,
  :issuer)
  SENSITIVE = []
  include Aws::Structure
end

#mfa_status ⇒ String

Indicates whether multi-factor authentication (MFA) was used for authentication during the session.

In CloudTrail, you can find this value as ‘userIdentity.sessionContext.attributes.mfaAuthenticated`.

Returns:

  • (String) 


349
350
351
352
353
354
355
356
 
# File 'lib/aws-sdk-securityhub/types.rb', line 349

class ActorSession < Struct.new(
  :uid,
  :mfa_status,
  :created_time,
  :issuer)
  SENSITIVE = []
  include Aws::Structure
end

#uid ⇒ String

Unique identifier of the session.

Returns:

  • (String) 


349
350
351
352
353
354
355
356
 
# File 'lib/aws-sdk-securityhub/types.rb', line 349

class ActorSession < Struct.new(
  :uid,
  :mfa_status,
  :created_time,
  :issuer)
  SENSITIVE = []
  include Aws::Structure
end