aws-sdk-detective 1.45.0 → 1.47.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +10 -0
- data/VERSION +1 -1
- data/lib/aws-sdk-detective/client.rb +106 -71
- data/lib/aws-sdk-detective/types.rb +76 -56
- data/lib/aws-sdk-detective.rb +1 -1
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 2f4a8d3084bfac4fa8c0052ce7fc695a8ba9cfd8397997148c1ca7efbad9949a
|
4
|
+
data.tar.gz: 79b4599d0bacc928754270aaa1877b7e4e5b339c32a266d5954e34d135c31a8f
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 697da7be0983f8832b9cb1c15c52508b18ba98183e2604fa1e2e86f64ed2e23293455469fada0fecb528fd8be74be677db5f67a2f60e816e86f7c5aa86466b12
|
7
|
+
data.tar.gz: f31e315f55f6bafa56efc829f0db833530d8d1809cbdef0beb8779d2ad3286f90458f2f3a733be018c29af72bd1c0577d3a9a3e1e9945f1cb26255edc2debb63
|
data/CHANGELOG.md
CHANGED
@@ -1,6 +1,16 @@
|
|
1
1
|
Unreleased Changes
|
2
2
|
------------------
|
3
3
|
|
4
|
+
1.47.0 (2024-04-25)
|
5
|
+
------------------
|
6
|
+
|
7
|
+
* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
|
8
|
+
|
9
|
+
1.46.0 (2024-02-15)
|
10
|
+
------------------
|
11
|
+
|
12
|
+
* Feature - Doc only updates for content enhancement
|
13
|
+
|
4
14
|
1.45.0 (2024-01-26)
|
5
15
|
------------------
|
6
16
|
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
1.
|
1
|
+
1.47.0
|
@@ -22,6 +22,7 @@ require 'aws-sdk-core/plugins/endpoint_pattern.rb'
|
|
22
22
|
require 'aws-sdk-core/plugins/response_paging.rb'
|
23
23
|
require 'aws-sdk-core/plugins/stub_responses.rb'
|
24
24
|
require 'aws-sdk-core/plugins/idempotency_token.rb'
|
25
|
+
require 'aws-sdk-core/plugins/invocation_id.rb'
|
25
26
|
require 'aws-sdk-core/plugins/jsonvalue_converter.rb'
|
26
27
|
require 'aws-sdk-core/plugins/client_metrics_plugin.rb'
|
27
28
|
require 'aws-sdk-core/plugins/client_metrics_send_plugin.rb'
|
@@ -72,6 +73,7 @@ module Aws::Detective
|
|
72
73
|
add_plugin(Aws::Plugins::ResponsePaging)
|
73
74
|
add_plugin(Aws::Plugins::StubResponses)
|
74
75
|
add_plugin(Aws::Plugins::IdempotencyToken)
|
76
|
+
add_plugin(Aws::Plugins::InvocationId)
|
75
77
|
add_plugin(Aws::Plugins::JsonvalueConverter)
|
76
78
|
add_plugin(Aws::Plugins::ClientMetricsPlugin)
|
77
79
|
add_plugin(Aws::Plugins::ClientMetricsSendPlugin)
|
@@ -196,10 +198,17 @@ module Aws::Detective
|
|
196
198
|
# When set to 'true' the request body will not be compressed
|
197
199
|
# for supported operations.
|
198
200
|
#
|
199
|
-
# @option options [String] :endpoint
|
200
|
-
#
|
201
|
-
#
|
202
|
-
#
|
201
|
+
# @option options [String, URI::HTTPS, URI::HTTP] :endpoint
|
202
|
+
# Normally you should not configure the `:endpoint` option
|
203
|
+
# directly. This is normally constructed from the `:region`
|
204
|
+
# option. Configuring `:endpoint` is normally reserved for
|
205
|
+
# connecting to test or custom endpoints. The endpoint should
|
206
|
+
# be a URI formatted like:
|
207
|
+
#
|
208
|
+
# 'http://example.com'
|
209
|
+
# 'https://example.com'
|
210
|
+
# 'http://example.com:123'
|
211
|
+
#
|
203
212
|
#
|
204
213
|
# @option options [Integer] :endpoint_cache_max_entries (1000)
|
205
214
|
# Used for the maximum size limit of the LRU cache storing endpoints data
|
@@ -337,50 +346,65 @@ module Aws::Detective
|
|
337
346
|
# @option options [Aws::Detective::EndpointProvider] :endpoint_provider
|
338
347
|
# The endpoint provider used to resolve endpoints. Any object that responds to `#resolve_endpoint(parameters)` where `parameters` is a Struct similar to `Aws::Detective::EndpointParameters`
|
339
348
|
#
|
340
|
-
# @option options [
|
341
|
-
#
|
342
|
-
#
|
343
|
-
#
|
344
|
-
#
|
345
|
-
#
|
346
|
-
#
|
347
|
-
#
|
348
|
-
#
|
349
|
-
#
|
350
|
-
#
|
351
|
-
# @option options [Float] :
|
352
|
-
#
|
353
|
-
#
|
354
|
-
#
|
355
|
-
#
|
356
|
-
#
|
357
|
-
#
|
358
|
-
#
|
359
|
-
#
|
360
|
-
#
|
361
|
-
#
|
349
|
+
# @option options [Float] :http_continue_timeout (1)
|
350
|
+
# The number of seconds to wait for a 100-continue response before sending the
|
351
|
+
# request body. This option has no effect unless the request has "Expect"
|
352
|
+
# header set to "100-continue". Defaults to `nil` which disables this
|
353
|
+
# behaviour. This value can safely be set per request on the session.
|
354
|
+
#
|
355
|
+
# @option options [Float] :http_idle_timeout (5)
|
356
|
+
# The number of seconds a connection is allowed to sit idle before it
|
357
|
+
# is considered stale. Stale connections are closed and removed from the
|
358
|
+
# pool before making a request.
|
359
|
+
#
|
360
|
+
# @option options [Float] :http_open_timeout (15)
|
361
|
+
# The default number of seconds to wait for response data.
|
362
|
+
# This value can safely be set per-request on the session.
|
363
|
+
#
|
364
|
+
# @option options [URI::HTTP,String] :http_proxy
|
365
|
+
# A proxy to send requests through. Formatted like 'http://proxy.com:123'.
|
366
|
+
#
|
367
|
+
# @option options [Float] :http_read_timeout (60)
|
368
|
+
# The default number of seconds to wait for response data.
|
369
|
+
# This value can safely be set per-request on the session.
|
370
|
+
#
|
371
|
+
# @option options [Boolean] :http_wire_trace (false)
|
372
|
+
# When `true`, HTTP debug output will be sent to the `:logger`.
|
373
|
+
#
|
374
|
+
# @option options [Proc] :on_chunk_received
|
375
|
+
# When a Proc object is provided, it will be used as callback when each chunk
|
376
|
+
# of the response body is received. It provides three arguments: the chunk,
|
377
|
+
# the number of bytes received, and the total number of
|
378
|
+
# bytes in the response (or nil if the server did not send a `content-length`).
|
379
|
+
#
|
380
|
+
# @option options [Proc] :on_chunk_sent
|
381
|
+
# When a Proc object is provided, it will be used as callback when each chunk
|
382
|
+
# of the request body is sent. It provides three arguments: the chunk,
|
383
|
+
# the number of bytes read from the body, and the total number of
|
384
|
+
# bytes in the body.
|
385
|
+
#
|
386
|
+
# @option options [Boolean] :raise_response_errors (true)
|
387
|
+
# When `true`, response errors are raised.
|
388
|
+
#
|
389
|
+
# @option options [String] :ssl_ca_bundle
|
390
|
+
# Full path to the SSL certificate authority bundle file that should be used when
|
391
|
+
# verifying peer certificates. If you do not pass `:ssl_ca_bundle` or
|
392
|
+
# `:ssl_ca_directory` the the system default will be used if available.
|
393
|
+
#
|
394
|
+
# @option options [String] :ssl_ca_directory
|
395
|
+
# Full path of the directory that contains the unbundled SSL certificate
|
396
|
+
# authority files for verifying peer certificates. If you do
|
397
|
+
# not pass `:ssl_ca_bundle` or `:ssl_ca_directory` the the system
|
398
|
+
# default will be used if available.
|
362
399
|
#
|
363
|
-
# @option options [
|
364
|
-
#
|
400
|
+
# @option options [String] :ssl_ca_store
|
401
|
+
# Sets the X509::Store to verify peer certificate.
|
365
402
|
#
|
366
|
-
# @option options [
|
367
|
-
#
|
403
|
+
# @option options [Float] :ssl_timeout
|
404
|
+
# Sets the SSL timeout in seconds
|
368
405
|
#
|
369
|
-
# @option options [Boolean] :ssl_verify_peer (true)
|
370
|
-
# SSL peer certificates are verified when establishing a
|
371
|
-
# connection.
|
372
|
-
#
|
373
|
-
# @option options [String] :ssl_ca_bundle Full path to the SSL
|
374
|
-
# certificate authority bundle file that should be used when
|
375
|
-
# verifying peer certificates. If you do not pass
|
376
|
-
# `:ssl_ca_bundle` or `:ssl_ca_directory` the the system default
|
377
|
-
# will be used if available.
|
378
|
-
#
|
379
|
-
# @option options [String] :ssl_ca_directory Full path of the
|
380
|
-
# directory that contains the unbundled SSL certificate
|
381
|
-
# authority files for verifying peer certificates. If you do
|
382
|
-
# not pass `:ssl_ca_bundle` or `:ssl_ca_directory` the the
|
383
|
-
# system default will be used if available.
|
406
|
+
# @option options [Boolean] :ssl_verify_peer (true)
|
407
|
+
# When `true`, SSL peer certificates are verified when establishing a connection.
|
384
408
|
#
|
385
409
|
def initialize(*args)
|
386
410
|
super
|
@@ -502,13 +526,6 @@ module Aws::Detective
|
|
502
526
|
# account as the administrator account. This operation is called by the
|
503
527
|
# account that is enabling Detective.
|
504
528
|
#
|
505
|
-
# Before you try to enable Detective, make sure that your account has
|
506
|
-
# been enrolled in Amazon GuardDuty for at least 48 hours. If you do not
|
507
|
-
# meet this requirement, you cannot enable Detective. If you do meet the
|
508
|
-
# GuardDuty prerequisite, then when you make the request to enable
|
509
|
-
# Detective, it checks whether your data volume is within the Detective
|
510
|
-
# quota. If it exceeds the quota, then you cannot enable Detective.
|
511
|
-
#
|
512
529
|
# The operation also enables Detective for the calling account in the
|
513
530
|
# currently selected Region. It returns the ARN of the new behavior
|
514
531
|
# graph.
|
@@ -877,11 +894,15 @@ module Aws::Detective
|
|
877
894
|
req.send_request(options)
|
878
895
|
end
|
879
896
|
|
880
|
-
#
|
881
|
-
#
|
897
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
898
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
899
|
+
# artifact observed in or on a network, system, or environment that can
|
900
|
+
# (with a high level of confidence) identify malicious activity or a
|
901
|
+
# security incident. `GetInvestigation` returns the investigation
|
902
|
+
# results of an investigation for a behavior graph.
|
882
903
|
#
|
883
904
|
# @option params [required, String] :graph_arn
|
884
|
-
# The ARN of the behavior graph.
|
905
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
885
906
|
#
|
886
907
|
# @option params [required, String] :investigation_id
|
887
908
|
# The investigation ID of the investigation report.
|
@@ -1082,23 +1103,27 @@ module Aws::Detective
|
|
1082
1103
|
req.send_request(options)
|
1083
1104
|
end
|
1084
1105
|
|
1085
|
-
#
|
1106
|
+
# Gets the indicators from an investigation. You can use the information
|
1107
|
+
# from the indicators to determine if an IAM user and/or IAM role is
|
1108
|
+
# involved in an unusual activity that could indicate malicious behavior
|
1109
|
+
# and its impact.
|
1086
1110
|
#
|
1087
1111
|
# @option params [required, String] :graph_arn
|
1088
|
-
# The ARN of the behavior graph.
|
1112
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1089
1113
|
#
|
1090
1114
|
# @option params [required, String] :investigation_id
|
1091
1115
|
# The investigation ID of the investigation report.
|
1092
1116
|
#
|
1093
1117
|
# @option params [String] :indicator_type
|
1094
|
-
#
|
1118
|
+
# For the list of indicators of compromise that are generated by
|
1119
|
+
# Detective investigations, see [Detective investigations][1].
|
1095
1120
|
#
|
1096
1121
|
#
|
1097
1122
|
#
|
1098
1123
|
# [1]: https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html
|
1099
1124
|
#
|
1100
1125
|
# @option params [String] :next_token
|
1101
|
-
#
|
1126
|
+
# Lists if there are more results available. The value of nextToken is a
|
1102
1127
|
# unique pagination token for each page. Repeat the call using the
|
1103
1128
|
# returned token to retrieve the next page. Keep all other arguments
|
1104
1129
|
# unchanged.
|
@@ -1107,7 +1132,7 @@ module Aws::Detective
|
|
1107
1132
|
# pagination token will return a Validation Exception error.
|
1108
1133
|
#
|
1109
1134
|
# @option params [Integer] :max_results
|
1110
|
-
#
|
1135
|
+
# Lists the maximum number of indicators in a page.
|
1111
1136
|
#
|
1112
1137
|
# @return [Types::ListIndicatorsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
|
1113
1138
|
#
|
@@ -1168,13 +1193,18 @@ module Aws::Detective
|
|
1168
1193
|
req.send_request(options)
|
1169
1194
|
end
|
1170
1195
|
|
1171
|
-
#
|
1196
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
1197
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
1198
|
+
# artifact observed in or on a network, system, or environment that can
|
1199
|
+
# (with a high level of confidence) identify malicious activity or a
|
1200
|
+
# security incident. `ListInvestigations` lists all active Detective
|
1201
|
+
# investigations.
|
1172
1202
|
#
|
1173
1203
|
# @option params [required, String] :graph_arn
|
1174
|
-
# The ARN of the behavior graph.
|
1204
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1175
1205
|
#
|
1176
1206
|
# @option params [String] :next_token
|
1177
|
-
#
|
1207
|
+
# Lists if there are more results available. The value of nextToken is a
|
1178
1208
|
# unique pagination token for each page. Repeat the call using the
|
1179
1209
|
# returned token to retrieve the next page. Keep all other arguments
|
1180
1210
|
# unchanged.
|
@@ -1183,10 +1213,10 @@ module Aws::Detective
|
|
1183
1213
|
# pagination token will return a Validation Exception error.
|
1184
1214
|
#
|
1185
1215
|
# @option params [Integer] :max_results
|
1186
|
-
#
|
1216
|
+
# Lists the maximum number of investigations in a page.
|
1187
1217
|
#
|
1188
1218
|
# @option params [Types::FilterCriteria] :filter_criteria
|
1189
|
-
#
|
1219
|
+
# Filters the investigation results based on a criteria.
|
1190
1220
|
#
|
1191
1221
|
# @option params [Types::SortCriteria] :sort_criteria
|
1192
1222
|
# Sorts the investigation results based on a criteria.
|
@@ -1490,10 +1520,15 @@ module Aws::Detective
|
|
1490
1520
|
req.send_request(options)
|
1491
1521
|
end
|
1492
1522
|
|
1493
|
-
#
|
1523
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
1524
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
1525
|
+
# artifact observed in or on a network, system, or environment that can
|
1526
|
+
# (with a high level of confidence) identify malicious activity or a
|
1527
|
+
# security incident. `StartInvestigation` initiates an investigation on
|
1528
|
+
# an entity in a behavior graph.
|
1494
1529
|
#
|
1495
1530
|
# @option params [required, String] :graph_arn
|
1496
|
-
# The ARN of the behavior graph.
|
1531
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1497
1532
|
#
|
1498
1533
|
# @option params [required, String] :entity_arn
|
1499
1534
|
# The unique Amazon Resource Name (ARN) of the IAM user and IAM role.
|
@@ -1503,7 +1538,7 @@ module Aws::Detective
|
|
1503
1538
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1504
1539
|
#
|
1505
1540
|
# @option params [required, Time,DateTime,Date,Integer,String] :scope_end_time
|
1506
|
-
# The data and time when the investigation
|
1541
|
+
# The data and time when the investigation ended. The value is an UTC
|
1507
1542
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1508
1543
|
#
|
1509
1544
|
# @return [Types::StartInvestigationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
|
@@ -1654,10 +1689,10 @@ module Aws::Detective
|
|
1654
1689
|
req.send_request(options)
|
1655
1690
|
end
|
1656
1691
|
|
1657
|
-
#
|
1692
|
+
# Updates the state of an investigation.
|
1658
1693
|
#
|
1659
1694
|
# @option params [required, String] :graph_arn
|
1660
|
-
# The ARN of the behavior graph.
|
1695
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1661
1696
|
#
|
1662
1697
|
# @option params [required, String] :investigation_id
|
1663
1698
|
# The investigation ID of the investigation report.
|
@@ -1727,7 +1762,7 @@ module Aws::Detective
|
|
1727
1762
|
params: params,
|
1728
1763
|
config: config)
|
1729
1764
|
context[:gem_name] = 'aws-sdk-detective'
|
1730
|
-
context[:gem_version] = '1.
|
1765
|
+
context[:gem_version] = '1.47.0'
|
1731
1766
|
Seahorse::Client::Request.new(handlers, context)
|
1732
1767
|
end
|
1733
1768
|
|
@@ -332,7 +332,7 @@ module Aws::Detective
|
|
332
332
|
#
|
333
333
|
# @!attribute [rw] end_inclusive
|
334
334
|
# A timestamp representing the end date of the time period until when
|
335
|
-
# data is filtered
|
335
|
+
# data is filtered, including the end date.
|
336
336
|
# @return [Time]
|
337
337
|
#
|
338
338
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/DateFilter AWS API Documentation
|
@@ -509,7 +509,7 @@ module Aws::Detective
|
|
509
509
|
end
|
510
510
|
|
511
511
|
# @!attribute [rw] graph_arn
|
512
|
-
# The ARN of the behavior graph.
|
512
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
513
513
|
# @return [String]
|
514
514
|
#
|
515
515
|
# @!attribute [rw] investigation_id
|
@@ -526,7 +526,7 @@ module Aws::Detective
|
|
526
526
|
end
|
527
527
|
|
528
528
|
# @!attribute [rw] graph_arn
|
529
|
-
# The ARN of the behavior graph.
|
529
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
530
530
|
# @return [String]
|
531
531
|
#
|
532
532
|
# @!attribute [rw] investigation_id
|
@@ -534,40 +534,43 @@ module Aws::Detective
|
|
534
534
|
# @return [String]
|
535
535
|
#
|
536
536
|
# @!attribute [rw] entity_arn
|
537
|
-
# The unique Amazon Resource Name (ARN)
|
537
|
+
# The unique Amazon Resource Name (ARN). Detective supports IAM user
|
538
|
+
# ARNs and IAM role ARNs.
|
538
539
|
# @return [String]
|
539
540
|
#
|
540
541
|
# @!attribute [rw] entity_type
|
541
542
|
# Type of entity. For example, Amazon Web Services accounts, such as
|
542
|
-
# IAM user and role.
|
543
|
+
# an IAM user and/or IAM role.
|
543
544
|
# @return [String]
|
544
545
|
#
|
545
546
|
# @!attribute [rw] created_time
|
546
|
-
# The
|
547
|
+
# The creation time of the investigation report in UTC time stamp
|
548
|
+
# format.
|
547
549
|
# @return [Time]
|
548
550
|
#
|
549
551
|
# @!attribute [rw] scope_start_time
|
550
|
-
# The start date and time
|
551
|
-
# investigation report.
|
552
|
+
# The start date and time used to set the scope time within which you
|
553
|
+
# want to generate the investigation report. The value is an UTC
|
554
|
+
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
552
555
|
# @return [Time]
|
553
556
|
#
|
554
557
|
# @!attribute [rw] scope_end_time
|
555
558
|
# The data and time when the investigation began. The value is an UTC
|
556
|
-
# ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z
|
559
|
+
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
557
560
|
# @return [Time]
|
558
561
|
#
|
559
562
|
# @!attribute [rw] status
|
560
|
-
#
|
563
|
+
# The status based on the completion status of the investigation.
|
561
564
|
# @return [String]
|
562
565
|
#
|
563
566
|
# @!attribute [rw] severity
|
564
|
-
#
|
565
|
-
# compromise discovered in the investigation.
|
567
|
+
# The severity assigned is based on the likelihood and impact of the
|
568
|
+
# indicators of compromise discovered in the investigation.
|
566
569
|
# @return [String]
|
567
570
|
#
|
568
571
|
# @!attribute [rw] state
|
569
572
|
# The current state of the investigation. An archived investigation
|
570
|
-
# indicates you have completed reviewing the investigation.
|
573
|
+
# indicates that you have completed reviewing the investigation.
|
571
574
|
# @return [String]
|
572
575
|
#
|
573
576
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/GetInvestigationResponse AWS API Documentation
|
@@ -657,7 +660,7 @@ module Aws::Detective
|
|
657
660
|
#
|
658
661
|
# @!attribute [rw] starting_ip_address
|
659
662
|
# IP address where the resource was first used in the impossible
|
660
|
-
# travel
|
663
|
+
# travel.
|
661
664
|
# @return [String]
|
662
665
|
#
|
663
666
|
# @!attribute [rw] ending_ip_address
|
@@ -666,7 +669,7 @@ module Aws::Detective
|
|
666
669
|
# @return [String]
|
667
670
|
#
|
668
671
|
# @!attribute [rw] starting_location
|
669
|
-
# Location where the resource was first used in the impossible travel
|
672
|
+
# Location where the resource was first used in the impossible travel.
|
670
673
|
# @return [String]
|
671
674
|
#
|
672
675
|
# @!attribute [rw] ending_location
|
@@ -690,16 +693,22 @@ module Aws::Detective
|
|
690
693
|
include Aws::Structure
|
691
694
|
end
|
692
695
|
|
693
|
-
#
|
694
|
-
# surfaces only the most critical and suspicious issues, so
|
695
|
-
# focus on high-level investigations.
|
696
|
+
# Detective investigations triages indicators of compromises such as a
|
697
|
+
# finding and surfaces only the most critical and suspicious issues, so
|
698
|
+
# you can focus on high-level investigations. An `Indicator` lets you
|
699
|
+
# determine if an Amazon Web Services resource is involved in unusual
|
700
|
+
# activity that could indicate malicious behavior and its impact.
|
696
701
|
#
|
697
702
|
# @!attribute [rw] indicator_type
|
698
703
|
# The type of indicator.
|
699
704
|
# @return [String]
|
700
705
|
#
|
701
706
|
# @!attribute [rw] indicator_detail
|
702
|
-
# Details about the
|
707
|
+
# Details about the indicators of compromise that are used to
|
708
|
+
# determine if a resource is involved in a security incident. An
|
709
|
+
# indicator of compromise (IOC) is an artifact observed in or on a
|
710
|
+
# network, system, or environment that can (with a high level of
|
711
|
+
# confidence) identify malicious activity or a security incident.
|
703
712
|
# @return [Types::IndicatorDetail]
|
704
713
|
#
|
705
714
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/Indicator AWS API Documentation
|
@@ -712,7 +721,16 @@ module Aws::Detective
|
|
712
721
|
end
|
713
722
|
|
714
723
|
# Details about the indicators of compromise which are used to determine
|
715
|
-
# if a resource is involved in a security incident.
|
724
|
+
# if a resource is involved in a security incident. An indicator of
|
725
|
+
# compromise (IOC) is an artifact observed in or on a network, system,
|
726
|
+
# or environment that can (with a high level of confidence) identify
|
727
|
+
# malicious activity or a security incident. For the list of indicators
|
728
|
+
# of compromise that are generated by Detective investigations, see
|
729
|
+
# [Detective investigations][1].
|
730
|
+
#
|
731
|
+
#
|
732
|
+
#
|
733
|
+
# [1]: https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html
|
716
734
|
#
|
717
735
|
# @!attribute [rw] tt_ps_observed_detail
|
718
736
|
# Details about the indicator of compromise.
|
@@ -725,7 +743,7 @@ module Aws::Detective
|
|
725
743
|
# @!attribute [rw] flagged_ip_address_detail
|
726
744
|
# Suspicious IP addresses that are flagged, which indicates critical
|
727
745
|
# or severe threats based on threat intelligence by Detective. This
|
728
|
-
# indicator is derived from
|
746
|
+
# indicator is derived from Amazon Web Services threat intelligence.
|
729
747
|
# @return [Types::FlaggedIpAddressDetail]
|
730
748
|
#
|
731
749
|
# @!attribute [rw] new_geolocation_detail
|
@@ -778,7 +796,7 @@ module Aws::Detective
|
|
778
796
|
end
|
779
797
|
|
780
798
|
# Details about the investigation related to a potential security event
|
781
|
-
# identified by Detective
|
799
|
+
# identified by Detective.
|
782
800
|
#
|
783
801
|
# @!attribute [rw] investigation_id
|
784
802
|
# The investigation ID of the investigation report.
|
@@ -799,7 +817,9 @@ module Aws::Detective
|
|
799
817
|
# @return [String]
|
800
818
|
#
|
801
819
|
# @!attribute [rw] created_time
|
802
|
-
# The
|
820
|
+
# The time stamp of the creation time of the investigation report. The
|
821
|
+
# value is an UTC ISO8601 formatted string. For example,
|
822
|
+
# `2021-08-18T16:35:56.284Z`.
|
803
823
|
# @return [Time]
|
804
824
|
#
|
805
825
|
# @!attribute [rw] entity_arn
|
@@ -910,7 +930,7 @@ module Aws::Detective
|
|
910
930
|
end
|
911
931
|
|
912
932
|
# @!attribute [rw] graph_arn
|
913
|
-
# The ARN of the behavior graph.
|
933
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
914
934
|
# @return [String]
|
915
935
|
#
|
916
936
|
# @!attribute [rw] investigation_id
|
@@ -918,7 +938,8 @@ module Aws::Detective
|
|
918
938
|
# @return [String]
|
919
939
|
#
|
920
940
|
# @!attribute [rw] indicator_type
|
921
|
-
#
|
941
|
+
# For the list of indicators of compromise that are generated by
|
942
|
+
# Detective investigations, see [Detective investigations][1].
|
922
943
|
#
|
923
944
|
#
|
924
945
|
#
|
@@ -926,7 +947,7 @@ module Aws::Detective
|
|
926
947
|
# @return [String]
|
927
948
|
#
|
928
949
|
# @!attribute [rw] next_token
|
929
|
-
#
|
950
|
+
# Lists if there are more results available. The value of nextToken is
|
930
951
|
# a unique pagination token for each page. Repeat the call using the
|
931
952
|
# returned token to retrieve the next page. Keep all other arguments
|
932
953
|
# unchanged.
|
@@ -936,7 +957,7 @@ module Aws::Detective
|
|
936
957
|
# @return [String]
|
937
958
|
#
|
938
959
|
# @!attribute [rw] max_results
|
939
|
-
#
|
960
|
+
# Lists the maximum number of indicators in a page.
|
940
961
|
# @return [Integer]
|
941
962
|
#
|
942
963
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListIndicatorsRequest AWS API Documentation
|
@@ -952,7 +973,7 @@ module Aws::Detective
|
|
952
973
|
end
|
953
974
|
|
954
975
|
# @!attribute [rw] graph_arn
|
955
|
-
# The ARN of the behavior graph.
|
976
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
956
977
|
# @return [String]
|
957
978
|
#
|
958
979
|
# @!attribute [rw] investigation_id
|
@@ -960,7 +981,7 @@ module Aws::Detective
|
|
960
981
|
# @return [String]
|
961
982
|
#
|
962
983
|
# @!attribute [rw] next_token
|
963
|
-
#
|
984
|
+
# Lists if there are more results available. The value of nextToken is
|
964
985
|
# a unique pagination token for each page. Repeat the call using the
|
965
986
|
# returned token to retrieve the next page. Keep all other arguments
|
966
987
|
# unchanged.
|
@@ -970,7 +991,7 @@ module Aws::Detective
|
|
970
991
|
# @return [String]
|
971
992
|
#
|
972
993
|
# @!attribute [rw] indicators
|
973
|
-
#
|
994
|
+
# Lists the indicators of compromise.
|
974
995
|
# @return [Array<Types::Indicator>]
|
975
996
|
#
|
976
997
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListIndicatorsResponse AWS API Documentation
|
@@ -985,11 +1006,11 @@ module Aws::Detective
|
|
985
1006
|
end
|
986
1007
|
|
987
1008
|
# @!attribute [rw] graph_arn
|
988
|
-
# The ARN of the behavior graph.
|
1009
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
989
1010
|
# @return [String]
|
990
1011
|
#
|
991
1012
|
# @!attribute [rw] next_token
|
992
|
-
#
|
1013
|
+
# Lists if there are more results available. The value of nextToken is
|
993
1014
|
# a unique pagination token for each page. Repeat the call using the
|
994
1015
|
# returned token to retrieve the next page. Keep all other arguments
|
995
1016
|
# unchanged.
|
@@ -999,11 +1020,11 @@ module Aws::Detective
|
|
999
1020
|
# @return [String]
|
1000
1021
|
#
|
1001
1022
|
# @!attribute [rw] max_results
|
1002
|
-
#
|
1023
|
+
# Lists the maximum number of investigations in a page.
|
1003
1024
|
# @return [Integer]
|
1004
1025
|
#
|
1005
1026
|
# @!attribute [rw] filter_criteria
|
1006
|
-
#
|
1027
|
+
# Filters the investigation results based on a criteria.
|
1007
1028
|
# @return [Types::FilterCriteria]
|
1008
1029
|
#
|
1009
1030
|
# @!attribute [rw] sort_criteria
|
@@ -1023,18 +1044,17 @@ module Aws::Detective
|
|
1023
1044
|
end
|
1024
1045
|
|
1025
1046
|
# @!attribute [rw] investigation_details
|
1026
|
-
#
|
1027
|
-
#
|
1047
|
+
# Lists the summary of uncommon behavior or malicious activity which
|
1048
|
+
# indicates a compromise.
|
1028
1049
|
# @return [Array<Types::InvestigationDetail>]
|
1029
1050
|
#
|
1030
1051
|
# @!attribute [rw] next_token
|
1031
|
-
#
|
1052
|
+
# Lists if there are more results available. The value of nextToken is
|
1032
1053
|
# a unique pagination token for each page. Repeat the call using the
|
1033
1054
|
# returned token to retrieve the next page. Keep all other arguments
|
1034
1055
|
# unchanged.
|
1035
1056
|
#
|
1036
|
-
# Each pagination token expires after 24 hours.
|
1037
|
-
# pagination token will return an HTTP 400 InvalidToken error.
|
1057
|
+
# Each pagination token expires after 24 hours.
|
1038
1058
|
# @return [String]
|
1039
1059
|
#
|
1040
1060
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListInvestigationsResponse AWS API Documentation
|
@@ -1400,7 +1420,8 @@ module Aws::Detective
|
|
1400
1420
|
# @return [String]
|
1401
1421
|
#
|
1402
1422
|
# @!attribute [rw] is_new_for_entire_account
|
1403
|
-
# Checks if the ASO is
|
1423
|
+
# Checks if the Autonomous System Organization (ASO) is new for the
|
1424
|
+
# entire account.
|
1404
1425
|
# @return [Boolean]
|
1405
1426
|
#
|
1406
1427
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/NewAsoDetail AWS API Documentation
|
@@ -1425,7 +1446,7 @@ module Aws::Detective
|
|
1425
1446
|
# @return [String]
|
1426
1447
|
#
|
1427
1448
|
# @!attribute [rw] is_new_for_entire_account
|
1428
|
-
# Checks if the
|
1449
|
+
# Checks if the geolocation is new for the entire account.
|
1429
1450
|
# @return [Boolean]
|
1430
1451
|
#
|
1431
1452
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/NewGeolocationDetail AWS API Documentation
|
@@ -1477,7 +1498,7 @@ module Aws::Detective
|
|
1477
1498
|
# resource or the finding group.
|
1478
1499
|
#
|
1479
1500
|
# @!attribute [rw] arn
|
1480
|
-
# The ARN of the related finding.
|
1501
|
+
# The Amazon Resource Name (ARN) of the related finding.
|
1481
1502
|
# @return [String]
|
1482
1503
|
#
|
1483
1504
|
# @!attribute [rw] type
|
@@ -1530,16 +1551,13 @@ module Aws::Detective
|
|
1530
1551
|
|
1531
1552
|
# This request cannot be completed for one of the following reasons.
|
1532
1553
|
#
|
1533
|
-
# *
|
1534
|
-
# behavior graph to exceed the maximum allowed.
|
1535
|
-
# cannot have more than
|
1536
|
-
#
|
1537
|
-
# * The request would cause the data rate for the behavior graph to
|
1538
|
-
# exceed the maximum allowed.
|
1554
|
+
# * This request cannot be completed if it would cause the number of
|
1555
|
+
# member accounts in the behavior graph to exceed the maximum allowed.
|
1556
|
+
# A behavior graph cannot have more than 1,200 member accounts.
|
1539
1557
|
#
|
1540
|
-
# *
|
1541
|
-
#
|
1542
|
-
#
|
1558
|
+
# * This request cannot be completed if the current volume ingested is
|
1559
|
+
# above the limit of 10 TB per day. Detective will not allow you to
|
1560
|
+
# add additional member accounts.
|
1543
1561
|
#
|
1544
1562
|
# @!attribute [rw] message
|
1545
1563
|
# @return [String]
|
@@ -1577,7 +1595,7 @@ module Aws::Detective
|
|
1577
1595
|
end
|
1578
1596
|
|
1579
1597
|
# @!attribute [rw] graph_arn
|
1580
|
-
# The ARN of the behavior graph.
|
1598
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1581
1599
|
# @return [String]
|
1582
1600
|
#
|
1583
1601
|
# @!attribute [rw] entity_arn
|
@@ -1590,7 +1608,7 @@ module Aws::Detective
|
|
1590
1608
|
# @return [Time]
|
1591
1609
|
#
|
1592
1610
|
# @!attribute [rw] scope_end_time
|
1593
|
-
# The data and time when the investigation
|
1611
|
+
# The data and time when the investigation ended. The value is an UTC
|
1594
1612
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1595
1613
|
# @return [Time]
|
1596
1614
|
#
|
@@ -1672,11 +1690,13 @@ module Aws::Detective
|
|
1672
1690
|
# @return [String]
|
1673
1691
|
#
|
1674
1692
|
# @!attribute [rw] ip_address
|
1675
|
-
# The IP address where the
|
1693
|
+
# The IP address where the tactics, techniques, and procedure (TTP)
|
1694
|
+
# was observed.
|
1676
1695
|
# @return [String]
|
1677
1696
|
#
|
1678
1697
|
# @!attribute [rw] api_name
|
1679
|
-
# The name of the API where the
|
1698
|
+
# The name of the API where the tactics, techniques, and procedure
|
1699
|
+
# (TTP) was observed.
|
1680
1700
|
# @return [String]
|
1681
1701
|
#
|
1682
1702
|
# @!attribute [rw] api_success_count
|
@@ -1836,7 +1856,7 @@ module Aws::Detective
|
|
1836
1856
|
end
|
1837
1857
|
|
1838
1858
|
# @!attribute [rw] graph_arn
|
1839
|
-
# The ARN of the behavior graph.
|
1859
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1840
1860
|
# @return [String]
|
1841
1861
|
#
|
1842
1862
|
# @!attribute [rw] investigation_id
|
data/lib/aws-sdk-detective.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: aws-sdk-detective
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.47.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Amazon Web Services
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-04-25 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: aws-sdk-core
|
@@ -19,7 +19,7 @@ dependencies:
|
|
19
19
|
version: '3'
|
20
20
|
- - ">="
|
21
21
|
- !ruby/object:Gem::Version
|
22
|
-
version: 3.
|
22
|
+
version: 3.193.0
|
23
23
|
type: :runtime
|
24
24
|
prerelease: false
|
25
25
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -29,7 +29,7 @@ dependencies:
|
|
29
29
|
version: '3'
|
30
30
|
- - ">="
|
31
31
|
- !ruby/object:Gem::Version
|
32
|
-
version: 3.
|
32
|
+
version: 3.193.0
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
34
|
name: aws-sigv4
|
35
35
|
requirement: !ruby/object:Gem::Requirement
|