Start Investigation

detective_start_investigation

R Documentation

Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise¶

Description¶

Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. start_investigation initiates an investigation on an entity in a behavior graph.

Usage¶

detective_start_investigation(GraphArn, EntityArn, ScopeStartTime,
  ScopeEndTime)

Arguments¶

GraphArn: [required] The Amazon Resource Name (ARN) of the behavior graph.
EntityArn: [required] The unique Amazon Resource Name (ARN) of the IAM user and IAM role.
ScopeStartTime: [required] The data and time when the investigation began. The value is an UTC ISO8601 formatted string. For example, ⁠2021-08-18T16:35:56.284Z⁠.
ScopeEndTime: [required] The data and time when the investigation ended. The value is an UTC ISO8601 formatted string. For example, ⁠2021-08-18T16:35:56.284Z⁠.

Value¶

A list with the following syntax:

list(
  InvestigationId = "string"
)

Request syntax¶

svc$start_investigation(
  GraphArn = "string",
  EntityArn = "string",
  ScopeStartTime = as.POSIXct(
    "2015-01-01"
  ),
  ScopeEndTime = as.POSIXct(
    "2015-01-01"
  )
)