aws-sdk-guardduty 1.159.0 → 1.160.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f96dac55adae3d5448f88d426d18aa28f6b7b9839ca08ff1bae213a67f6a055
-  data.tar.gz: 8cdfb5b5c6e7f90c79b855182109634a13bf3e85ae803e0e288760539328301b
+  metadata.gz: 90c6a97a0222bacba62b12bd9bd7f1b3634d91b1bcbbda69499bec31dcd1bfad
+  data.tar.gz: bcfb93f12f48224a150d06bd7e4b1d27c3ead876a7d4b12dbcf872ec12dd17b1
 SHA512:
-  metadata.gz: a997b2292401bdf785fca19a810a1b6842e99b7107ff3a66959fbcdb6d225f137583b05e72bd8b3cbcfe67434fc2884276fafa7858f3d7824765e72b27e37f8a
-  data.tar.gz: 7ed2ffb529371b7f6531a037132f27e9d13a59ef0af33ef28ec2071464f084ff54fd10c9caae6dbb6f9bfe0c8c497365d250dba21c7261b263e58c47230e94d7
+  metadata.gz: 67ce5b188116c974f276aa51a8aee732af5650c0117ca9a53c54a0bf2a52951c15b708c327d5b3e768ed7b2166bb2b4a2aac5f5bfe918d433d81f556b6bfd491
+  data.tar.gz: 2652fb7adc23e13d66fea36aa1be409a3e2c6c2a0ada7405dd2d7783b232f8a1ade8b3d4aeadcd2ffb9b5dd9dfc8448867a6dedf943463239d10de9a86b441e8

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.160.0 (2026-09-03)
+------------------
+
+* Feature - Adding support for Sequence Activities in GuardDuty Findings
+
 1.159.0 (2026-09-01)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.159.0
+1.160.0

data/lib/aws-sdk-guardduty/client.rb

@@ -4846,6 +4846,12 @@ module Aws::GuardDuty
     #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].values #=> Array
     #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].values[0] #=> String
     #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].title #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].activities #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].activities[0].type #=> String, one of "API_CALL"
+    #   resp.findings[0].service.detection.sequence.signals[0].activities[0].api.operation #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].activities[0].api.service #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].activities[0].api.error #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].activities[0].api.user_agent #=> String
     #   resp.findings[0].service.detection.sequence.sequence_indicators #=> Array
     #   resp.findings[0].service.detection.sequence.sequence_indicators[0].key #=> String, one of "SUSPICIOUS_USER_AGENT", "SUSPICIOUS_NETWORK", "MALICIOUS_IP", "TOR_IP", "ATTACK_TACTIC", "HIGH_RISK_API", "ATTACK_TECHNIQUE", "UNUSUAL_API_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_USER", "SUSPICIOUS_PROCESS", "MALICIOUS_DOMAIN", "MALICIOUS_PROCESS", "CRYPTOMINING_IP", "CRYPTOMINING_DOMAIN", "CRYPTOMINING_PROCESS", "MALICIOUS_FILE", "VULNERABILITY", "MALICIOUS_PACKAGE", "MISCONFIGURATION", "REACHABILITY", "SENSITIVE_DATA"
     #   resp.findings[0].service.detection.sequence.sequence_indicators[0].values #=> Array
@@ -9726,7 +9732,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.159.0'
+      context[:gem_version] = '1.160.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -32,6 +32,9 @@ module Aws::GuardDuty
     AccountLevelPermissions = Shapes::StructureShape.new(name: 'AccountLevelPermissions')
     AccountStatistics = Shapes::StructureShape.new(name: 'AccountStatistics')
     Action = Shapes::StructureShape.new(name: 'Action')
+    Activities = Shapes::ListShape.new(name: 'Activities')
+    Activity = Shapes::StructureShape.new(name: 'Activity')
+    ActivityType = Shapes::StringShape.new(name: 'ActivityType')
     Actor = Shapes::StructureShape.new(name: 'Actor')
     ActorIds = Shapes::ListShape.new(name: 'ActorIds')
     ActorProcess = Shapes::StructureShape.new(name: 'ActorProcess')
@@ -52,6 +55,11 @@ module Aws::GuardDuty
     AnomalyProfiles = Shapes::MapShape.new(name: 'AnomalyProfiles')
     AnomalyUnusual = Shapes::StructureShape.new(name: 'AnomalyUnusual')
     AnomalyUnusualBehaviorFeature = Shapes::MapShape.new(name: 'AnomalyUnusualBehaviorFeature')
+    ApiCall = Shapes::StructureShape.new(name: 'ApiCall')
+    ApiCallErrorString = Shapes::StringShape.new(name: 'ApiCallErrorString')
+    ApiCallOperationString = Shapes::StringShape.new(name: 'ApiCallOperationString')
+    ApiCallServiceString = Shapes::StringShape.new(name: 'ApiCallServiceString')
+    ApiCallUserAgentString = Shapes::StringShape.new(name: 'ApiCallUserAgentString')
     ArchiveFindingsRequest = Shapes::StructureShape.new(name: 'ArchiveFindingsRequest')
     ArchiveFindingsResponse = Shapes::StructureShape.new(name: 'ArchiveFindingsResponse')
     AssociationDetail = Shapes::StructureShape.new(name: 'AssociationDetail')
@@ -854,6 +862,12 @@ module Aws::GuardDuty
     Action.add_member(:rds_login_attempt_action, Shapes::ShapeRef.new(shape: RdsLoginAttemptAction, location_name: "rdsLoginAttemptAction"))
     Action.struct_class = Types::Action
 
+    Activities.member = Shapes::ShapeRef.new(shape: Activity)
+
+    Activity.add_member(:type, Shapes::ShapeRef.new(shape: ActivityType, required: true, location_name: "type"))
+    Activity.add_member(:api, Shapes::ShapeRef.new(shape: ApiCall, location_name: "api"))
+    Activity.struct_class = Types::Activity
+
     Actor.add_member(:id, Shapes::ShapeRef.new(shape: String, required: true, location_name: "id"))
     Actor.add_member(:user, Shapes::ShapeRef.new(shape: User, location_name: "user"))
     Actor.add_member(:session, Shapes::ShapeRef.new(shape: Session, location_name: "session"))
@@ -920,6 +934,12 @@ module Aws::GuardDuty
     AnomalyUnusualBehaviorFeature.key = Shapes::ShapeRef.new(shape: String)
     AnomalyUnusualBehaviorFeature.value = Shapes::ShapeRef.new(shape: AnomalyObject)
 
+    ApiCall.add_member(:operation, Shapes::ShapeRef.new(shape: ApiCallOperationString, location_name: "operation"))
+    ApiCall.add_member(:service, Shapes::ShapeRef.new(shape: ApiCallServiceString, location_name: "service"))
+    ApiCall.add_member(:error, Shapes::ShapeRef.new(shape: ApiCallErrorString, location_name: "error"))
+    ApiCall.add_member(:user_agent, Shapes::ShapeRef.new(shape: ApiCallUserAgentString, location_name: "userAgent"))
+    ApiCall.struct_class = Types::ApiCall
+
     ArchiveFindingsRequest.add_member(:detector_id, Shapes::ShapeRef.new(shape: DetectorId, required: true, location: "uri", location_name: "DetectorId"))
     ArchiveFindingsRequest.add_member(:finding_ids, Shapes::ShapeRef.new(shape: FindingIds, required: true, location_name: "findingIds"))
     ArchiveFindingsRequest.struct_class = Types::ArchiveFindingsRequest
@@ -3180,6 +3200,7 @@ module Aws::GuardDuty
     Signal.add_member(:actor_ids, Shapes::ShapeRef.new(shape: ActorIds, location_name: "actorIds"))
     Signal.add_member(:endpoint_ids, Shapes::ShapeRef.new(shape: EndpointIds, location_name: "endpointIds"))
     Signal.add_member(:signal_indicators, Shapes::ShapeRef.new(shape: Indicators, location_name: "signalIndicators"))
+    Signal.add_member(:activities, Shapes::ShapeRef.new(shape: Activities, location_name: "activities"))
     Signal.struct_class = Types::Signal
 
     Signals.member = Shapes::ShapeRef.new(shape: Signal)

data/lib/aws-sdk-guardduty/types.rb

@@ -361,6 +361,27 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about an activity, such as an API call, that was
+    # observed for a signal.
+    #
+    # @!attribute [rw] type
+    #   The type of the observed activity.
+    #   @return [String]
+    #
+    # @!attribute [rw] api
+    #   Contains information about the API call that was observed, when the
+    #   activity type is `API_CALL`.
+    #   @return [Types::ApiCall]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Activity AWS API Documentation
+    #
+    class Activity < Struct.new(
+      :type,
+      :api)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Information about the actors involved in an attack sequence.
     #
     # @!attribute [rw] id
@@ -585,6 +606,36 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains information about an API call that was observed as part of an
+    # activity.
+    #
+    # @!attribute [rw] operation
+    #   The name of the API operation that was invoked.
+    #   @return [String]
+    #
+    # @!attribute [rw] service
+    #   The service that the API operation was invoked against.
+    #   @return [String]
+    #
+    # @!attribute [rw] error
+    #   The error code that was returned, if the API call failed.
+    #   @return [String]
+    #
+    # @!attribute [rw] user_agent
+    #   User agent in the request to the API operation
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/ApiCall AWS API Documentation
+    #
+    class ApiCall < Struct.new(
+      :operation,
+      :service,
+      :error,
+      :user_agent)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] detector_id
     #   The ID of the detector that specifies the GuardDuty service whose
     #   findings you want to archive.
@@ -13089,6 +13140,11 @@ module Aws::GuardDuty
     #   signals.
     #   @return [Array<Types::Indicator>]
     #
+    # @!attribute [rw] activities
+    #   Contains information about the activities, such as API calls, that
+    #   were observed for this signal.
+    #   @return [Array<Types::Activity>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Signal AWS API Documentation
     #
     class Signal < Struct.new(
@@ -13105,7 +13161,8 @@ module Aws::GuardDuty
       :resource_uids,
       :actor_ids,
       :endpoint_ids,
-      :signal_indicators)
+      :signal_indicators,
+      :activities)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.159.0'
+  GEM_VERSION = '1.160.0'
 
 end
 

data/sig/types.rbs

@@ -100,6 +100,12 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class Activity
+      attr_accessor type: ("API_CALL")
+      attr_accessor api: Types::ApiCall
+      SENSITIVE: []
+    end
+
     class Actor
       attr_accessor id: ::String
       attr_accessor user: Types::User
@@ -164,6 +170,14 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class ApiCall
+      attr_accessor operation: ::String
+      attr_accessor service: ::String
+      attr_accessor error: ::String
+      attr_accessor user_agent: ::String
+      SENSITIVE: []
+    end
+
     class ArchiveFindingsRequest
       attr_accessor detector_id: ::String
       attr_accessor finding_ids: ::Array[::String]
@@ -2971,6 +2985,7 @@ module Aws::GuardDuty
       attr_accessor actor_ids: ::Array[::String]
       attr_accessor endpoint_ids: ::Array[::String]
       attr_accessor signal_indicators: ::Array[Types::Indicator]
+      attr_accessor activities: ::Array[Types::Activity]
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.159.0
+  version: 1.160.0
 platform: ruby
 authors:
 - Amazon Web Services