List Indicators

detective_list_indicators

R Documentation

Gets the indicators from an investigation

Description

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Usage

detective_list_indicators(GraphArn, InvestigationId, IndicatorType,
  NextToken, MaxResults)

Arguments

GraphArn

[required] The Amazon Resource Name (ARN) of the behavior graph.

InvestigationId

[required] The investigation ID of the investigation report.

IndicatorType

For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations.

NextToken

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

MaxResults

Lists the maximum number of indicators in a page.

Value

A list with the following syntax:

list(
  GraphArn = "string",
  InvestigationId = "string",
  NextToken = "string",
  Indicators = list(
    list(
      IndicatorType = "TTP_OBSERVED"|"IMPOSSIBLE_TRAVEL"|"FLAGGED_IP_ADDRESS"|"NEW_GEOLOCATION"|"NEW_ASO"|"NEW_USER_AGENT"|"RELATED_FINDING"|"RELATED_FINDING_GROUP",
      IndicatorDetail = list(
        TTPsObservedDetail = list(
          Tactic = "string",
          Technique = "string",
          Procedure = "string",
          IpAddress = "string",
          APIName = "string",
          APISuccessCount = 123,
          APIFailureCount = 123
        ),
        ImpossibleTravelDetail = list(
          StartingIpAddress = "string",
          EndingIpAddress = "string",
          StartingLocation = "string",
          EndingLocation = "string",
          HourlyTimeDelta = 123
        ),
        FlaggedIpAddressDetail = list(
          IpAddress = "string",
          Reason = "AWS_THREAT_INTELLIGENCE"
        ),
        NewGeolocationDetail = list(
          Location = "string",
          IpAddress = "string",
          IsNewForEntireAccount = TRUE|FALSE
        ),
        NewAsoDetail = list(
          Aso = "string",
          IsNewForEntireAccount = TRUE|FALSE
        ),
        NewUserAgentDetail = list(
          UserAgent = "string",
          IsNewForEntireAccount = TRUE|FALSE
        ),
        RelatedFindingDetail = list(
          Arn = "string",
          Type = "string",
          IpAddress = "string"
        ),
        RelatedFindingGroupDetail = list(
          Id = "string"
        )
      )
    )
  )
)

Request syntax

svc$list_indicators(
  GraphArn = "string",
  InvestigationId = "string",
  IndicatorType = "TTP_OBSERVED"|"IMPOSSIBLE_TRAVEL"|"FLAGGED_IP_ADDRESS"|"NEW_GEOLOCATION"|"NEW_ASO"|"NEW_USER_AGENT"|"RELATED_FINDING"|"RELATED_FINDING_GROUP",
  NextToken = "string",
  MaxResults = 123
)