aws-sdk-detective 1.45.0 → 1.47.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +10 -0
- data/VERSION +1 -1
- data/lib/aws-sdk-detective/client.rb +106 -71
- data/lib/aws-sdk-detective/types.rb +76 -56
- data/lib/aws-sdk-detective.rb +1 -1
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 2f4a8d3084bfac4fa8c0052ce7fc695a8ba9cfd8397997148c1ca7efbad9949a
|
4
|
+
data.tar.gz: 79b4599d0bacc928754270aaa1877b7e4e5b339c32a266d5954e34d135c31a8f
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 697da7be0983f8832b9cb1c15c52508b18ba98183e2604fa1e2e86f64ed2e23293455469fada0fecb528fd8be74be677db5f67a2f60e816e86f7c5aa86466b12
|
7
|
+
data.tar.gz: f31e315f55f6bafa56efc829f0db833530d8d1809cbdef0beb8779d2ad3286f90458f2f3a733be018c29af72bd1c0577d3a9a3e1e9945f1cb26255edc2debb63
|
data/CHANGELOG.md
CHANGED
@@ -1,6 +1,16 @@
|
|
1
1
|
Unreleased Changes
|
2
2
|
------------------
|
3
3
|
|
4
|
+
1.47.0 (2024-04-25)
|
5
|
+
------------------
|
6
|
+
|
7
|
+
* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
|
8
|
+
|
9
|
+
1.46.0 (2024-02-15)
|
10
|
+
------------------
|
11
|
+
|
12
|
+
* Feature - Doc only updates for content enhancement
|
13
|
+
|
4
14
|
1.45.0 (2024-01-26)
|
5
15
|
------------------
|
6
16
|
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
1.
|
1
|
+
1.47.0
|
@@ -22,6 +22,7 @@ require 'aws-sdk-core/plugins/endpoint_pattern.rb'
|
|
22
22
|
require 'aws-sdk-core/plugins/response_paging.rb'
|
23
23
|
require 'aws-sdk-core/plugins/stub_responses.rb'
|
24
24
|
require 'aws-sdk-core/plugins/idempotency_token.rb'
|
25
|
+
require 'aws-sdk-core/plugins/invocation_id.rb'
|
25
26
|
require 'aws-sdk-core/plugins/jsonvalue_converter.rb'
|
26
27
|
require 'aws-sdk-core/plugins/client_metrics_plugin.rb'
|
27
28
|
require 'aws-sdk-core/plugins/client_metrics_send_plugin.rb'
|
@@ -72,6 +73,7 @@ module Aws::Detective
|
|
72
73
|
add_plugin(Aws::Plugins::ResponsePaging)
|
73
74
|
add_plugin(Aws::Plugins::StubResponses)
|
74
75
|
add_plugin(Aws::Plugins::IdempotencyToken)
|
76
|
+
add_plugin(Aws::Plugins::InvocationId)
|
75
77
|
add_plugin(Aws::Plugins::JsonvalueConverter)
|
76
78
|
add_plugin(Aws::Plugins::ClientMetricsPlugin)
|
77
79
|
add_plugin(Aws::Plugins::ClientMetricsSendPlugin)
|
@@ -196,10 +198,17 @@ module Aws::Detective
|
|
196
198
|
# When set to 'true' the request body will not be compressed
|
197
199
|
# for supported operations.
|
198
200
|
#
|
199
|
-
# @option options [String] :endpoint
|
200
|
-
#
|
201
|
-
#
|
202
|
-
#
|
201
|
+
# @option options [String, URI::HTTPS, URI::HTTP] :endpoint
|
202
|
+
# Normally you should not configure the `:endpoint` option
|
203
|
+
# directly. This is normally constructed from the `:region`
|
204
|
+
# option. Configuring `:endpoint` is normally reserved for
|
205
|
+
# connecting to test or custom endpoints. The endpoint should
|
206
|
+
# be a URI formatted like:
|
207
|
+
#
|
208
|
+
# 'http://example.com'
|
209
|
+
# 'https://example.com'
|
210
|
+
# 'http://example.com:123'
|
211
|
+
#
|
203
212
|
#
|
204
213
|
# @option options [Integer] :endpoint_cache_max_entries (1000)
|
205
214
|
# Used for the maximum size limit of the LRU cache storing endpoints data
|
@@ -337,50 +346,65 @@ module Aws::Detective
|
|
337
346
|
# @option options [Aws::Detective::EndpointProvider] :endpoint_provider
|
338
347
|
# The endpoint provider used to resolve endpoints. Any object that responds to `#resolve_endpoint(parameters)` where `parameters` is a Struct similar to `Aws::Detective::EndpointParameters`
|
339
348
|
#
|
340
|
-
# @option options [
|
341
|
-
#
|
342
|
-
#
|
343
|
-
#
|
344
|
-
#
|
345
|
-
#
|
346
|
-
#
|
347
|
-
#
|
348
|
-
#
|
349
|
-
#
|
350
|
-
#
|
351
|
-
# @option options [Float] :
|
352
|
-
#
|
353
|
-
#
|
354
|
-
#
|
355
|
-
#
|
356
|
-
#
|
357
|
-
#
|
358
|
-
#
|
359
|
-
#
|
360
|
-
#
|
361
|
-
#
|
349
|
+
# @option options [Float] :http_continue_timeout (1)
|
350
|
+
# The number of seconds to wait for a 100-continue response before sending the
|
351
|
+
# request body. This option has no effect unless the request has "Expect"
|
352
|
+
# header set to "100-continue". Defaults to `nil` which disables this
|
353
|
+
# behaviour. This value can safely be set per request on the session.
|
354
|
+
#
|
355
|
+
# @option options [Float] :http_idle_timeout (5)
|
356
|
+
# The number of seconds a connection is allowed to sit idle before it
|
357
|
+
# is considered stale. Stale connections are closed and removed from the
|
358
|
+
# pool before making a request.
|
359
|
+
#
|
360
|
+
# @option options [Float] :http_open_timeout (15)
|
361
|
+
# The default number of seconds to wait for response data.
|
362
|
+
# This value can safely be set per-request on the session.
|
363
|
+
#
|
364
|
+
# @option options [URI::HTTP,String] :http_proxy
|
365
|
+
# A proxy to send requests through. Formatted like 'http://proxy.com:123'.
|
366
|
+
#
|
367
|
+
# @option options [Float] :http_read_timeout (60)
|
368
|
+
# The default number of seconds to wait for response data.
|
369
|
+
# This value can safely be set per-request on the session.
|
370
|
+
#
|
371
|
+
# @option options [Boolean] :http_wire_trace (false)
|
372
|
+
# When `true`, HTTP debug output will be sent to the `:logger`.
|
373
|
+
#
|
374
|
+
# @option options [Proc] :on_chunk_received
|
375
|
+
# When a Proc object is provided, it will be used as callback when each chunk
|
376
|
+
# of the response body is received. It provides three arguments: the chunk,
|
377
|
+
# the number of bytes received, and the total number of
|
378
|
+
# bytes in the response (or nil if the server did not send a `content-length`).
|
379
|
+
#
|
380
|
+
# @option options [Proc] :on_chunk_sent
|
381
|
+
# When a Proc object is provided, it will be used as callback when each chunk
|
382
|
+
# of the request body is sent. It provides three arguments: the chunk,
|
383
|
+
# the number of bytes read from the body, and the total number of
|
384
|
+
# bytes in the body.
|
385
|
+
#
|
386
|
+
# @option options [Boolean] :raise_response_errors (true)
|
387
|
+
# When `true`, response errors are raised.
|
388
|
+
#
|
389
|
+
# @option options [String] :ssl_ca_bundle
|
390
|
+
# Full path to the SSL certificate authority bundle file that should be used when
|
391
|
+
# verifying peer certificates. If you do not pass `:ssl_ca_bundle` or
|
392
|
+
# `:ssl_ca_directory` the the system default will be used if available.
|
393
|
+
#
|
394
|
+
# @option options [String] :ssl_ca_directory
|
395
|
+
# Full path of the directory that contains the unbundled SSL certificate
|
396
|
+
# authority files for verifying peer certificates. If you do
|
397
|
+
# not pass `:ssl_ca_bundle` or `:ssl_ca_directory` the the system
|
398
|
+
# default will be used if available.
|
362
399
|
#
|
363
|
-
# @option options [
|
364
|
-
#
|
400
|
+
# @option options [String] :ssl_ca_store
|
401
|
+
# Sets the X509::Store to verify peer certificate.
|
365
402
|
#
|
366
|
-
# @option options [
|
367
|
-
#
|
403
|
+
# @option options [Float] :ssl_timeout
|
404
|
+
# Sets the SSL timeout in seconds
|
368
405
|
#
|
369
|
-
# @option options [Boolean] :ssl_verify_peer (true)
|
370
|
-
# SSL peer certificates are verified when establishing a
|
371
|
-
# connection.
|
372
|
-
#
|
373
|
-
# @option options [String] :ssl_ca_bundle Full path to the SSL
|
374
|
-
# certificate authority bundle file that should be used when
|
375
|
-
# verifying peer certificates. If you do not pass
|
376
|
-
# `:ssl_ca_bundle` or `:ssl_ca_directory` the the system default
|
377
|
-
# will be used if available.
|
378
|
-
#
|
379
|
-
# @option options [String] :ssl_ca_directory Full path of the
|
380
|
-
# directory that contains the unbundled SSL certificate
|
381
|
-
# authority files for verifying peer certificates. If you do
|
382
|
-
# not pass `:ssl_ca_bundle` or `:ssl_ca_directory` the the
|
383
|
-
# system default will be used if available.
|
406
|
+
# @option options [Boolean] :ssl_verify_peer (true)
|
407
|
+
# When `true`, SSL peer certificates are verified when establishing a connection.
|
384
408
|
#
|
385
409
|
def initialize(*args)
|
386
410
|
super
|
@@ -502,13 +526,6 @@ module Aws::Detective
|
|
502
526
|
# account as the administrator account. This operation is called by the
|
503
527
|
# account that is enabling Detective.
|
504
528
|
#
|
505
|
-
# Before you try to enable Detective, make sure that your account has
|
506
|
-
# been enrolled in Amazon GuardDuty for at least 48 hours. If you do not
|
507
|
-
# meet this requirement, you cannot enable Detective. If you do meet the
|
508
|
-
# GuardDuty prerequisite, then when you make the request to enable
|
509
|
-
# Detective, it checks whether your data volume is within the Detective
|
510
|
-
# quota. If it exceeds the quota, then you cannot enable Detective.
|
511
|
-
#
|
512
529
|
# The operation also enables Detective for the calling account in the
|
513
530
|
# currently selected Region. It returns the ARN of the new behavior
|
514
531
|
# graph.
|
@@ -877,11 +894,15 @@ module Aws::Detective
|
|
877
894
|
req.send_request(options)
|
878
895
|
end
|
879
896
|
|
880
|
-
#
|
881
|
-
#
|
897
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
898
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
899
|
+
# artifact observed in or on a network, system, or environment that can
|
900
|
+
# (with a high level of confidence) identify malicious activity or a
|
901
|
+
# security incident. `GetInvestigation` returns the investigation
|
902
|
+
# results of an investigation for a behavior graph.
|
882
903
|
#
|
883
904
|
# @option params [required, String] :graph_arn
|
884
|
-
# The ARN of the behavior graph.
|
905
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
885
906
|
#
|
886
907
|
# @option params [required, String] :investigation_id
|
887
908
|
# The investigation ID of the investigation report.
|
@@ -1082,23 +1103,27 @@ module Aws::Detective
|
|
1082
1103
|
req.send_request(options)
|
1083
1104
|
end
|
1084
1105
|
|
1085
|
-
#
|
1106
|
+
# Gets the indicators from an investigation. You can use the information
|
1107
|
+
# from the indicators to determine if an IAM user and/or IAM role is
|
1108
|
+
# involved in an unusual activity that could indicate malicious behavior
|
1109
|
+
# and its impact.
|
1086
1110
|
#
|
1087
1111
|
# @option params [required, String] :graph_arn
|
1088
|
-
# The ARN of the behavior graph.
|
1112
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1089
1113
|
#
|
1090
1114
|
# @option params [required, String] :investigation_id
|
1091
1115
|
# The investigation ID of the investigation report.
|
1092
1116
|
#
|
1093
1117
|
# @option params [String] :indicator_type
|
1094
|
-
#
|
1118
|
+
# For the list of indicators of compromise that are generated by
|
1119
|
+
# Detective investigations, see [Detective investigations][1].
|
1095
1120
|
#
|
1096
1121
|
#
|
1097
1122
|
#
|
1098
1123
|
# [1]: https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html
|
1099
1124
|
#
|
1100
1125
|
# @option params [String] :next_token
|
1101
|
-
#
|
1126
|
+
# Lists if there are more results available. The value of nextToken is a
|
1102
1127
|
# unique pagination token for each page. Repeat the call using the
|
1103
1128
|
# returned token to retrieve the next page. Keep all other arguments
|
1104
1129
|
# unchanged.
|
@@ -1107,7 +1132,7 @@ module Aws::Detective
|
|
1107
1132
|
# pagination token will return a Validation Exception error.
|
1108
1133
|
#
|
1109
1134
|
# @option params [Integer] :max_results
|
1110
|
-
#
|
1135
|
+
# Lists the maximum number of indicators in a page.
|
1111
1136
|
#
|
1112
1137
|
# @return [Types::ListIndicatorsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
|
1113
1138
|
#
|
@@ -1168,13 +1193,18 @@ module Aws::Detective
|
|
1168
1193
|
req.send_request(options)
|
1169
1194
|
end
|
1170
1195
|
|
1171
|
-
#
|
1196
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
1197
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
1198
|
+
# artifact observed in or on a network, system, or environment that can
|
1199
|
+
# (with a high level of confidence) identify malicious activity or a
|
1200
|
+
# security incident. `ListInvestigations` lists all active Detective
|
1201
|
+
# investigations.
|
1172
1202
|
#
|
1173
1203
|
# @option params [required, String] :graph_arn
|
1174
|
-
# The ARN of the behavior graph.
|
1204
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1175
1205
|
#
|
1176
1206
|
# @option params [String] :next_token
|
1177
|
-
#
|
1207
|
+
# Lists if there are more results available. The value of nextToken is a
|
1178
1208
|
# unique pagination token for each page. Repeat the call using the
|
1179
1209
|
# returned token to retrieve the next page. Keep all other arguments
|
1180
1210
|
# unchanged.
|
@@ -1183,10 +1213,10 @@ module Aws::Detective
|
|
1183
1213
|
# pagination token will return a Validation Exception error.
|
1184
1214
|
#
|
1185
1215
|
# @option params [Integer] :max_results
|
1186
|
-
#
|
1216
|
+
# Lists the maximum number of investigations in a page.
|
1187
1217
|
#
|
1188
1218
|
# @option params [Types::FilterCriteria] :filter_criteria
|
1189
|
-
#
|
1219
|
+
# Filters the investigation results based on a criteria.
|
1190
1220
|
#
|
1191
1221
|
# @option params [Types::SortCriteria] :sort_criteria
|
1192
1222
|
# Sorts the investigation results based on a criteria.
|
@@ -1490,10 +1520,15 @@ module Aws::Detective
|
|
1490
1520
|
req.send_request(options)
|
1491
1521
|
end
|
1492
1522
|
|
1493
|
-
#
|
1523
|
+
# Detective investigations lets you investigate IAM users and IAM roles
|
1524
|
+
# using indicators of compromise. An indicator of compromise (IOC) is an
|
1525
|
+
# artifact observed in or on a network, system, or environment that can
|
1526
|
+
# (with a high level of confidence) identify malicious activity or a
|
1527
|
+
# security incident. `StartInvestigation` initiates an investigation on
|
1528
|
+
# an entity in a behavior graph.
|
1494
1529
|
#
|
1495
1530
|
# @option params [required, String] :graph_arn
|
1496
|
-
# The ARN of the behavior graph.
|
1531
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1497
1532
|
#
|
1498
1533
|
# @option params [required, String] :entity_arn
|
1499
1534
|
# The unique Amazon Resource Name (ARN) of the IAM user and IAM role.
|
@@ -1503,7 +1538,7 @@ module Aws::Detective
|
|
1503
1538
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1504
1539
|
#
|
1505
1540
|
# @option params [required, Time,DateTime,Date,Integer,String] :scope_end_time
|
1506
|
-
# The data and time when the investigation
|
1541
|
+
# The data and time when the investigation ended. The value is an UTC
|
1507
1542
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1508
1543
|
#
|
1509
1544
|
# @return [Types::StartInvestigationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
|
@@ -1654,10 +1689,10 @@ module Aws::Detective
|
|
1654
1689
|
req.send_request(options)
|
1655
1690
|
end
|
1656
1691
|
|
1657
|
-
#
|
1692
|
+
# Updates the state of an investigation.
|
1658
1693
|
#
|
1659
1694
|
# @option params [required, String] :graph_arn
|
1660
|
-
# The ARN of the behavior graph.
|
1695
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1661
1696
|
#
|
1662
1697
|
# @option params [required, String] :investigation_id
|
1663
1698
|
# The investigation ID of the investigation report.
|
@@ -1727,7 +1762,7 @@ module Aws::Detective
|
|
1727
1762
|
params: params,
|
1728
1763
|
config: config)
|
1729
1764
|
context[:gem_name] = 'aws-sdk-detective'
|
1730
|
-
context[:gem_version] = '1.
|
1765
|
+
context[:gem_version] = '1.47.0'
|
1731
1766
|
Seahorse::Client::Request.new(handlers, context)
|
1732
1767
|
end
|
1733
1768
|
|
@@ -332,7 +332,7 @@ module Aws::Detective
|
|
332
332
|
#
|
333
333
|
# @!attribute [rw] end_inclusive
|
334
334
|
# A timestamp representing the end date of the time period until when
|
335
|
-
# data is filtered
|
335
|
+
# data is filtered, including the end date.
|
336
336
|
# @return [Time]
|
337
337
|
#
|
338
338
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/DateFilter AWS API Documentation
|
@@ -509,7 +509,7 @@ module Aws::Detective
|
|
509
509
|
end
|
510
510
|
|
511
511
|
# @!attribute [rw] graph_arn
|
512
|
-
# The ARN of the behavior graph.
|
512
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
513
513
|
# @return [String]
|
514
514
|
#
|
515
515
|
# @!attribute [rw] investigation_id
|
@@ -526,7 +526,7 @@ module Aws::Detective
|
|
526
526
|
end
|
527
527
|
|
528
528
|
# @!attribute [rw] graph_arn
|
529
|
-
# The ARN of the behavior graph.
|
529
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
530
530
|
# @return [String]
|
531
531
|
#
|
532
532
|
# @!attribute [rw] investigation_id
|
@@ -534,40 +534,43 @@ module Aws::Detective
|
|
534
534
|
# @return [String]
|
535
535
|
#
|
536
536
|
# @!attribute [rw] entity_arn
|
537
|
-
# The unique Amazon Resource Name (ARN)
|
537
|
+
# The unique Amazon Resource Name (ARN). Detective supports IAM user
|
538
|
+
# ARNs and IAM role ARNs.
|
538
539
|
# @return [String]
|
539
540
|
#
|
540
541
|
# @!attribute [rw] entity_type
|
541
542
|
# Type of entity. For example, Amazon Web Services accounts, such as
|
542
|
-
# IAM user and role.
|
543
|
+
# an IAM user and/or IAM role.
|
543
544
|
# @return [String]
|
544
545
|
#
|
545
546
|
# @!attribute [rw] created_time
|
546
|
-
# The
|
547
|
+
# The creation time of the investigation report in UTC time stamp
|
548
|
+
# format.
|
547
549
|
# @return [Time]
|
548
550
|
#
|
549
551
|
# @!attribute [rw] scope_start_time
|
550
|
-
# The start date and time
|
551
|
-
# investigation report.
|
552
|
+
# The start date and time used to set the scope time within which you
|
553
|
+
# want to generate the investigation report. The value is an UTC
|
554
|
+
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
552
555
|
# @return [Time]
|
553
556
|
#
|
554
557
|
# @!attribute [rw] scope_end_time
|
555
558
|
# The data and time when the investigation began. The value is an UTC
|
556
|
-
# ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z
|
559
|
+
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
557
560
|
# @return [Time]
|
558
561
|
#
|
559
562
|
# @!attribute [rw] status
|
560
|
-
#
|
563
|
+
# The status based on the completion status of the investigation.
|
561
564
|
# @return [String]
|
562
565
|
#
|
563
566
|
# @!attribute [rw] severity
|
564
|
-
#
|
565
|
-
# compromise discovered in the investigation.
|
567
|
+
# The severity assigned is based on the likelihood and impact of the
|
568
|
+
# indicators of compromise discovered in the investigation.
|
566
569
|
# @return [String]
|
567
570
|
#
|
568
571
|
# @!attribute [rw] state
|
569
572
|
# The current state of the investigation. An archived investigation
|
570
|
-
# indicates you have completed reviewing the investigation.
|
573
|
+
# indicates that you have completed reviewing the investigation.
|
571
574
|
# @return [String]
|
572
575
|
#
|
573
576
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/GetInvestigationResponse AWS API Documentation
|
@@ -657,7 +660,7 @@ module Aws::Detective
|
|
657
660
|
#
|
658
661
|
# @!attribute [rw] starting_ip_address
|
659
662
|
# IP address where the resource was first used in the impossible
|
660
|
-
# travel
|
663
|
+
# travel.
|
661
664
|
# @return [String]
|
662
665
|
#
|
663
666
|
# @!attribute [rw] ending_ip_address
|
@@ -666,7 +669,7 @@ module Aws::Detective
|
|
666
669
|
# @return [String]
|
667
670
|
#
|
668
671
|
# @!attribute [rw] starting_location
|
669
|
-
# Location where the resource was first used in the impossible travel
|
672
|
+
# Location where the resource was first used in the impossible travel.
|
670
673
|
# @return [String]
|
671
674
|
#
|
672
675
|
# @!attribute [rw] ending_location
|
@@ -690,16 +693,22 @@ module Aws::Detective
|
|
690
693
|
include Aws::Structure
|
691
694
|
end
|
692
695
|
|
693
|
-
#
|
694
|
-
# surfaces only the most critical and suspicious issues, so
|
695
|
-
# focus on high-level investigations.
|
696
|
+
# Detective investigations triages indicators of compromises such as a
|
697
|
+
# finding and surfaces only the most critical and suspicious issues, so
|
698
|
+
# you can focus on high-level investigations. An `Indicator` lets you
|
699
|
+
# determine if an Amazon Web Services resource is involved in unusual
|
700
|
+
# activity that could indicate malicious behavior and its impact.
|
696
701
|
#
|
697
702
|
# @!attribute [rw] indicator_type
|
698
703
|
# The type of indicator.
|
699
704
|
# @return [String]
|
700
705
|
#
|
701
706
|
# @!attribute [rw] indicator_detail
|
702
|
-
# Details about the
|
707
|
+
# Details about the indicators of compromise that are used to
|
708
|
+
# determine if a resource is involved in a security incident. An
|
709
|
+
# indicator of compromise (IOC) is an artifact observed in or on a
|
710
|
+
# network, system, or environment that can (with a high level of
|
711
|
+
# confidence) identify malicious activity or a security incident.
|
703
712
|
# @return [Types::IndicatorDetail]
|
704
713
|
#
|
705
714
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/Indicator AWS API Documentation
|
@@ -712,7 +721,16 @@ module Aws::Detective
|
|
712
721
|
end
|
713
722
|
|
714
723
|
# Details about the indicators of compromise which are used to determine
|
715
|
-
# if a resource is involved in a security incident.
|
724
|
+
# if a resource is involved in a security incident. An indicator of
|
725
|
+
# compromise (IOC) is an artifact observed in or on a network, system,
|
726
|
+
# or environment that can (with a high level of confidence) identify
|
727
|
+
# malicious activity or a security incident. For the list of indicators
|
728
|
+
# of compromise that are generated by Detective investigations, see
|
729
|
+
# [Detective investigations][1].
|
730
|
+
#
|
731
|
+
#
|
732
|
+
#
|
733
|
+
# [1]: https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html
|
716
734
|
#
|
717
735
|
# @!attribute [rw] tt_ps_observed_detail
|
718
736
|
# Details about the indicator of compromise.
|
@@ -725,7 +743,7 @@ module Aws::Detective
|
|
725
743
|
# @!attribute [rw] flagged_ip_address_detail
|
726
744
|
# Suspicious IP addresses that are flagged, which indicates critical
|
727
745
|
# or severe threats based on threat intelligence by Detective. This
|
728
|
-
# indicator is derived from
|
746
|
+
# indicator is derived from Amazon Web Services threat intelligence.
|
729
747
|
# @return [Types::FlaggedIpAddressDetail]
|
730
748
|
#
|
731
749
|
# @!attribute [rw] new_geolocation_detail
|
@@ -778,7 +796,7 @@ module Aws::Detective
|
|
778
796
|
end
|
779
797
|
|
780
798
|
# Details about the investigation related to a potential security event
|
781
|
-
# identified by Detective
|
799
|
+
# identified by Detective.
|
782
800
|
#
|
783
801
|
# @!attribute [rw] investigation_id
|
784
802
|
# The investigation ID of the investigation report.
|
@@ -799,7 +817,9 @@ module Aws::Detective
|
|
799
817
|
# @return [String]
|
800
818
|
#
|
801
819
|
# @!attribute [rw] created_time
|
802
|
-
# The
|
820
|
+
# The time stamp of the creation time of the investigation report. The
|
821
|
+
# value is an UTC ISO8601 formatted string. For example,
|
822
|
+
# `2021-08-18T16:35:56.284Z`.
|
803
823
|
# @return [Time]
|
804
824
|
#
|
805
825
|
# @!attribute [rw] entity_arn
|
@@ -910,7 +930,7 @@ module Aws::Detective
|
|
910
930
|
end
|
911
931
|
|
912
932
|
# @!attribute [rw] graph_arn
|
913
|
-
# The ARN of the behavior graph.
|
933
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
914
934
|
# @return [String]
|
915
935
|
#
|
916
936
|
# @!attribute [rw] investigation_id
|
@@ -918,7 +938,8 @@ module Aws::Detective
|
|
918
938
|
# @return [String]
|
919
939
|
#
|
920
940
|
# @!attribute [rw] indicator_type
|
921
|
-
#
|
941
|
+
# For the list of indicators of compromise that are generated by
|
942
|
+
# Detective investigations, see [Detective investigations][1].
|
922
943
|
#
|
923
944
|
#
|
924
945
|
#
|
@@ -926,7 +947,7 @@ module Aws::Detective
|
|
926
947
|
# @return [String]
|
927
948
|
#
|
928
949
|
# @!attribute [rw] next_token
|
929
|
-
#
|
950
|
+
# Lists if there are more results available. The value of nextToken is
|
930
951
|
# a unique pagination token for each page. Repeat the call using the
|
931
952
|
# returned token to retrieve the next page. Keep all other arguments
|
932
953
|
# unchanged.
|
@@ -936,7 +957,7 @@ module Aws::Detective
|
|
936
957
|
# @return [String]
|
937
958
|
#
|
938
959
|
# @!attribute [rw] max_results
|
939
|
-
#
|
960
|
+
# Lists the maximum number of indicators in a page.
|
940
961
|
# @return [Integer]
|
941
962
|
#
|
942
963
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListIndicatorsRequest AWS API Documentation
|
@@ -952,7 +973,7 @@ module Aws::Detective
|
|
952
973
|
end
|
953
974
|
|
954
975
|
# @!attribute [rw] graph_arn
|
955
|
-
# The ARN of the behavior graph.
|
976
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
956
977
|
# @return [String]
|
957
978
|
#
|
958
979
|
# @!attribute [rw] investigation_id
|
@@ -960,7 +981,7 @@ module Aws::Detective
|
|
960
981
|
# @return [String]
|
961
982
|
#
|
962
983
|
# @!attribute [rw] next_token
|
963
|
-
#
|
984
|
+
# Lists if there are more results available. The value of nextToken is
|
964
985
|
# a unique pagination token for each page. Repeat the call using the
|
965
986
|
# returned token to retrieve the next page. Keep all other arguments
|
966
987
|
# unchanged.
|
@@ -970,7 +991,7 @@ module Aws::Detective
|
|
970
991
|
# @return [String]
|
971
992
|
#
|
972
993
|
# @!attribute [rw] indicators
|
973
|
-
#
|
994
|
+
# Lists the indicators of compromise.
|
974
995
|
# @return [Array<Types::Indicator>]
|
975
996
|
#
|
976
997
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListIndicatorsResponse AWS API Documentation
|
@@ -985,11 +1006,11 @@ module Aws::Detective
|
|
985
1006
|
end
|
986
1007
|
|
987
1008
|
# @!attribute [rw] graph_arn
|
988
|
-
# The ARN of the behavior graph.
|
1009
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
989
1010
|
# @return [String]
|
990
1011
|
#
|
991
1012
|
# @!attribute [rw] next_token
|
992
|
-
#
|
1013
|
+
# Lists if there are more results available. The value of nextToken is
|
993
1014
|
# a unique pagination token for each page. Repeat the call using the
|
994
1015
|
# returned token to retrieve the next page. Keep all other arguments
|
995
1016
|
# unchanged.
|
@@ -999,11 +1020,11 @@ module Aws::Detective
|
|
999
1020
|
# @return [String]
|
1000
1021
|
#
|
1001
1022
|
# @!attribute [rw] max_results
|
1002
|
-
#
|
1023
|
+
# Lists the maximum number of investigations in a page.
|
1003
1024
|
# @return [Integer]
|
1004
1025
|
#
|
1005
1026
|
# @!attribute [rw] filter_criteria
|
1006
|
-
#
|
1027
|
+
# Filters the investigation results based on a criteria.
|
1007
1028
|
# @return [Types::FilterCriteria]
|
1008
1029
|
#
|
1009
1030
|
# @!attribute [rw] sort_criteria
|
@@ -1023,18 +1044,17 @@ module Aws::Detective
|
|
1023
1044
|
end
|
1024
1045
|
|
1025
1046
|
# @!attribute [rw] investigation_details
|
1026
|
-
#
|
1027
|
-
#
|
1047
|
+
# Lists the summary of uncommon behavior or malicious activity which
|
1048
|
+
# indicates a compromise.
|
1028
1049
|
# @return [Array<Types::InvestigationDetail>]
|
1029
1050
|
#
|
1030
1051
|
# @!attribute [rw] next_token
|
1031
|
-
#
|
1052
|
+
# Lists if there are more results available. The value of nextToken is
|
1032
1053
|
# a unique pagination token for each page. Repeat the call using the
|
1033
1054
|
# returned token to retrieve the next page. Keep all other arguments
|
1034
1055
|
# unchanged.
|
1035
1056
|
#
|
1036
|
-
# Each pagination token expires after 24 hours.
|
1037
|
-
# pagination token will return an HTTP 400 InvalidToken error.
|
1057
|
+
# Each pagination token expires after 24 hours.
|
1038
1058
|
# @return [String]
|
1039
1059
|
#
|
1040
1060
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/ListInvestigationsResponse AWS API Documentation
|
@@ -1400,7 +1420,8 @@ module Aws::Detective
|
|
1400
1420
|
# @return [String]
|
1401
1421
|
#
|
1402
1422
|
# @!attribute [rw] is_new_for_entire_account
|
1403
|
-
# Checks if the ASO is
|
1423
|
+
# Checks if the Autonomous System Organization (ASO) is new for the
|
1424
|
+
# entire account.
|
1404
1425
|
# @return [Boolean]
|
1405
1426
|
#
|
1406
1427
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/NewAsoDetail AWS API Documentation
|
@@ -1425,7 +1446,7 @@ module Aws::Detective
|
|
1425
1446
|
# @return [String]
|
1426
1447
|
#
|
1427
1448
|
# @!attribute [rw] is_new_for_entire_account
|
1428
|
-
# Checks if the
|
1449
|
+
# Checks if the geolocation is new for the entire account.
|
1429
1450
|
# @return [Boolean]
|
1430
1451
|
#
|
1431
1452
|
# @see http://docs.aws.amazon.com/goto/WebAPI/detective-2018-10-26/NewGeolocationDetail AWS API Documentation
|
@@ -1477,7 +1498,7 @@ module Aws::Detective
|
|
1477
1498
|
# resource or the finding group.
|
1478
1499
|
#
|
1479
1500
|
# @!attribute [rw] arn
|
1480
|
-
# The ARN of the related finding.
|
1501
|
+
# The Amazon Resource Name (ARN) of the related finding.
|
1481
1502
|
# @return [String]
|
1482
1503
|
#
|
1483
1504
|
# @!attribute [rw] type
|
@@ -1530,16 +1551,13 @@ module Aws::Detective
|
|
1530
1551
|
|
1531
1552
|
# This request cannot be completed for one of the following reasons.
|
1532
1553
|
#
|
1533
|
-
# *
|
1534
|
-
# behavior graph to exceed the maximum allowed.
|
1535
|
-
# cannot have more than
|
1536
|
-
#
|
1537
|
-
# * The request would cause the data rate for the behavior graph to
|
1538
|
-
# exceed the maximum allowed.
|
1554
|
+
# * This request cannot be completed if it would cause the number of
|
1555
|
+
# member accounts in the behavior graph to exceed the maximum allowed.
|
1556
|
+
# A behavior graph cannot have more than 1,200 member accounts.
|
1539
1557
|
#
|
1540
|
-
# *
|
1541
|
-
#
|
1542
|
-
#
|
1558
|
+
# * This request cannot be completed if the current volume ingested is
|
1559
|
+
# above the limit of 10 TB per day. Detective will not allow you to
|
1560
|
+
# add additional member accounts.
|
1543
1561
|
#
|
1544
1562
|
# @!attribute [rw] message
|
1545
1563
|
# @return [String]
|
@@ -1577,7 +1595,7 @@ module Aws::Detective
|
|
1577
1595
|
end
|
1578
1596
|
|
1579
1597
|
# @!attribute [rw] graph_arn
|
1580
|
-
# The ARN of the behavior graph.
|
1598
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1581
1599
|
# @return [String]
|
1582
1600
|
#
|
1583
1601
|
# @!attribute [rw] entity_arn
|
@@ -1590,7 +1608,7 @@ module Aws::Detective
|
|
1590
1608
|
# @return [Time]
|
1591
1609
|
#
|
1592
1610
|
# @!attribute [rw] scope_end_time
|
1593
|
-
# The data and time when the investigation
|
1611
|
+
# The data and time when the investigation ended. The value is an UTC
|
1594
1612
|
# ISO8601 formatted string. For example, `2021-08-18T16:35:56.284Z`.
|
1595
1613
|
# @return [Time]
|
1596
1614
|
#
|
@@ -1672,11 +1690,13 @@ module Aws::Detective
|
|
1672
1690
|
# @return [String]
|
1673
1691
|
#
|
1674
1692
|
# @!attribute [rw] ip_address
|
1675
|
-
# The IP address where the
|
1693
|
+
# The IP address where the tactics, techniques, and procedure (TTP)
|
1694
|
+
# was observed.
|
1676
1695
|
# @return [String]
|
1677
1696
|
#
|
1678
1697
|
# @!attribute [rw] api_name
|
1679
|
-
# The name of the API where the
|
1698
|
+
# The name of the API where the tactics, techniques, and procedure
|
1699
|
+
# (TTP) was observed.
|
1680
1700
|
# @return [String]
|
1681
1701
|
#
|
1682
1702
|
# @!attribute [rw] api_success_count
|
@@ -1836,7 +1856,7 @@ module Aws::Detective
|
|
1836
1856
|
end
|
1837
1857
|
|
1838
1858
|
# @!attribute [rw] graph_arn
|
1839
|
-
# The ARN of the behavior graph.
|
1859
|
+
# The Amazon Resource Name (ARN) of the behavior graph.
|
1840
1860
|
# @return [String]
|
1841
1861
|
#
|
1842
1862
|
# @!attribute [rw] investigation_id
|
data/lib/aws-sdk-detective.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: aws-sdk-detective
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.47.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Amazon Web Services
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-04-25 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: aws-sdk-core
|
@@ -19,7 +19,7 @@ dependencies:
|
|
19
19
|
version: '3'
|
20
20
|
- - ">="
|
21
21
|
- !ruby/object:Gem::Version
|
22
|
-
version: 3.
|
22
|
+
version: 3.193.0
|
23
23
|
type: :runtime
|
24
24
|
prerelease: false
|
25
25
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -29,7 +29,7 @@ dependencies:
|
|
29
29
|
version: '3'
|
30
30
|
- - ">="
|
31
31
|
- !ruby/object:Gem::Version
|
32
|
-
version: 3.
|
32
|
+
version: 3.193.0
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
34
|
name: aws-sigv4
|
35
35
|
requirement: !ruby/object:Gem::Requirement
|