@aws-sdk/client-detective 3.513.0 → 3.515.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist-types/Detective.d.ts +1 -1
- package/dist-types/DetectiveClient.d.ts +1 -1
- package/dist-types/commands/CreateGraphCommand.d.ts +4 -15
- package/dist-types/commands/CreateMembersCommand.d.ts +4 -9
- package/dist-types/commands/GetInvestigationCommand.d.ts +1 -1
- package/dist-types/commands/ListIndicatorsCommand.d.ts +1 -1
- package/dist-types/commands/ListInvestigationsCommand.d.ts +6 -1
- package/dist-types/commands/StartInvestigationCommand.d.ts +1 -1
- package/dist-types/commands/StartMonitoringMemberCommand.d.ts +4 -9
- package/dist-types/commands/UpdateDatasourcePackagesCommand.d.ts +4 -9
- package/dist-types/commands/UpdateInvestigationStateCommand.d.ts +1 -1
- package/dist-types/index.d.ts +1 -1
- package/dist-types/models/models_0.d.ts +55 -51
- package/package.json +12 -12
package/README.md
CHANGED
|
@@ -77,7 +77,7 @@ accounts in the organization behavior graph.</p>
|
|
|
77
77
|
</ul>
|
|
78
78
|
<p>All API actions are logged as CloudTrail events. See <a href="https://docs.aws.amazon.com/detective/latest/adminguide/logging-using-cloudtrail.html">Logging Detective API Calls with CloudTrail</a>.</p>
|
|
79
79
|
<note>
|
|
80
|
-
<p>We replaced the term "master account" with the term "administrator account.
|
|
80
|
+
<p>We replaced the term "master account" with the term "administrator account". An
|
|
81
81
|
administrator account is used to centrally manage multiple accounts. In the case of
|
|
82
82
|
Detective, the administrator account manages the accounts in their behavior
|
|
83
83
|
graph.</p>
|
|
@@ -278,7 +278,7 @@ export interface Detective {
|
|
|
278
278
|
* </ul>
|
|
279
279
|
* <p>All API actions are logged as CloudTrail events. See <a href="https://docs.aws.amazon.com/detective/latest/adminguide/logging-using-cloudtrail.html">Logging Detective API Calls with CloudTrail</a>.</p>
|
|
280
280
|
* <note>
|
|
281
|
-
* <p>We replaced the term "master account" with the term "administrator account.
|
|
281
|
+
* <p>We replaced the term "master account" with the term "administrator account". An
|
|
282
282
|
* administrator account is used to centrally manage multiple accounts. In the case of
|
|
283
283
|
* Detective, the administrator account manages the accounts in their behavior
|
|
284
284
|
* graph.</p>
|
|
@@ -252,7 +252,7 @@ export interface DetectiveClientResolvedConfig extends DetectiveClientResolvedCo
|
|
|
252
252
|
* </ul>
|
|
253
253
|
* <p>All API actions are logged as CloudTrail events. See <a href="https://docs.aws.amazon.com/detective/latest/adminguide/logging-using-cloudtrail.html">Logging Detective API Calls with CloudTrail</a>.</p>
|
|
254
254
|
* <note>
|
|
255
|
-
* <p>We replaced the term "master account" with the term "administrator account.
|
|
255
|
+
* <p>We replaced the term "master account" with the term "administrator account". An
|
|
256
256
|
* administrator account is used to centrally manage multiple accounts. In the case of
|
|
257
257
|
* Detective, the administrator account manages the accounts in their behavior
|
|
258
258
|
* graph.</p>
|
|
@@ -28,12 +28,6 @@ declare const CreateGraphCommand_base: {
|
|
|
28
28
|
* @public
|
|
29
29
|
* <p>Creates a new behavior graph for the calling account, and sets that account as the
|
|
30
30
|
* administrator account. This operation is called by the account that is enabling Detective.</p>
|
|
31
|
-
* <p>Before you try to enable Detective, make sure that your account has been
|
|
32
|
-
* enrolled in Amazon GuardDuty for at least 48 hours. If you do not meet this
|
|
33
|
-
* requirement, you cannot enable Detective. If you do meet the GuardDuty
|
|
34
|
-
* prerequisite, then when you make the request to enable Detective, it checks
|
|
35
|
-
* whether your data volume is within the Detective quota. If it exceeds the quota,
|
|
36
|
-
* then you cannot enable Detective. </p>
|
|
37
31
|
* <p>The operation also enables Detective for the calling account in the currently
|
|
38
32
|
* selected Region. It returns the ARN of the new behavior graph.</p>
|
|
39
33
|
* <p>
|
|
@@ -81,17 +75,12 @@ declare const CreateGraphCommand_base: {
|
|
|
81
75
|
* <p>This request cannot be completed for one of the following reasons.</p>
|
|
82
76
|
* <ul>
|
|
83
77
|
* <li>
|
|
84
|
-
* <p>
|
|
85
|
-
*
|
|
86
|
-
*
|
|
78
|
+
* <p>This request cannot be completed if it would cause the number of member accounts in the
|
|
79
|
+
* behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200
|
|
80
|
+
* member accounts.</p>
|
|
87
81
|
* </li>
|
|
88
82
|
* <li>
|
|
89
|
-
* <p>
|
|
90
|
-
* allowed.</p>
|
|
91
|
-
* </li>
|
|
92
|
-
* <li>
|
|
93
|
-
* <p>Detective is unable to verify the data rate for the member account. This
|
|
94
|
-
* is usually because the member account is not enrolled in Amazon GuardDuty.</p>
|
|
83
|
+
* <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p>
|
|
95
84
|
* </li>
|
|
96
85
|
* </ul>
|
|
97
86
|
*
|
|
@@ -135,17 +135,12 @@ declare const CreateMembersCommand_base: {
|
|
|
135
135
|
* <p>This request cannot be completed for one of the following reasons.</p>
|
|
136
136
|
* <ul>
|
|
137
137
|
* <li>
|
|
138
|
-
* <p>
|
|
139
|
-
*
|
|
140
|
-
*
|
|
138
|
+
* <p>This request cannot be completed if it would cause the number of member accounts in the
|
|
139
|
+
* behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200
|
|
140
|
+
* member accounts.</p>
|
|
141
141
|
* </li>
|
|
142
142
|
* <li>
|
|
143
|
-
* <p>
|
|
144
|
-
* allowed.</p>
|
|
145
|
-
* </li>
|
|
146
|
-
* <li>
|
|
147
|
-
* <p>Detective is unable to verify the data rate for the member account. This
|
|
148
|
-
* is usually because the member account is not enrolled in Amazon GuardDuty.</p>
|
|
143
|
+
* <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p>
|
|
149
144
|
* </li>
|
|
150
145
|
* </ul>
|
|
151
146
|
*
|
|
@@ -26,7 +26,7 @@ declare const GetInvestigationCommand_base: {
|
|
|
26
26
|
};
|
|
27
27
|
/**
|
|
28
28
|
* @public
|
|
29
|
-
* <p>
|
|
29
|
+
* <p>Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. <code>GetInvestigation</code> returns the investigation results of an investigation for a behavior graph. </p>
|
|
30
30
|
* @example
|
|
31
31
|
* Use a bare-bones client and the command you need to make an API call.
|
|
32
32
|
* ```javascript
|
|
@@ -26,7 +26,7 @@ declare const ListIndicatorsCommand_base: {
|
|
|
26
26
|
};
|
|
27
27
|
/**
|
|
28
28
|
* @public
|
|
29
|
-
* <p>
|
|
29
|
+
* <p>Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.</p>
|
|
30
30
|
* @example
|
|
31
31
|
* Use a bare-bones client and the command you need to make an API call.
|
|
32
32
|
* ```javascript
|
|
@@ -26,7 +26,12 @@ declare const ListInvestigationsCommand_base: {
|
|
|
26
26
|
};
|
|
27
27
|
/**
|
|
28
28
|
* @public
|
|
29
|
-
* <p>
|
|
29
|
+
* <p>Detective investigations lets you investigate IAM users and
|
|
30
|
+
* IAM roles using indicators of compromise. An indicator of compromise
|
|
31
|
+
* (IOC) is an artifact observed in or on a network, system, or environment that can (with a
|
|
32
|
+
* high level of confidence) identify malicious activity or a security incident.
|
|
33
|
+
* <code>ListInvestigations</code> lists all active Detective
|
|
34
|
+
* investigations.</p>
|
|
30
35
|
* @example
|
|
31
36
|
* Use a bare-bones client and the command you need to make an API call.
|
|
32
37
|
* ```javascript
|
|
@@ -26,7 +26,7 @@ declare const StartInvestigationCommand_base: {
|
|
|
26
26
|
};
|
|
27
27
|
/**
|
|
28
28
|
* @public
|
|
29
|
-
* <p>
|
|
29
|
+
* <p>Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. <code>StartInvestigation</code> initiates an investigation on an entity in a behavior graph. </p>
|
|
30
30
|
* @example
|
|
31
31
|
* Use a bare-bones client and the command you need to make an API call.
|
|
32
32
|
* ```javascript
|
|
@@ -78,17 +78,12 @@ declare const StartMonitoringMemberCommand_base: {
|
|
|
78
78
|
* <p>This request cannot be completed for one of the following reasons.</p>
|
|
79
79
|
* <ul>
|
|
80
80
|
* <li>
|
|
81
|
-
* <p>
|
|
82
|
-
*
|
|
83
|
-
*
|
|
81
|
+
* <p>This request cannot be completed if it would cause the number of member accounts in the
|
|
82
|
+
* behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200
|
|
83
|
+
* member accounts.</p>
|
|
84
84
|
* </li>
|
|
85
85
|
* <li>
|
|
86
|
-
* <p>
|
|
87
|
-
* allowed.</p>
|
|
88
|
-
* </li>
|
|
89
|
-
* <li>
|
|
90
|
-
* <p>Detective is unable to verify the data rate for the member account. This
|
|
91
|
-
* is usually because the member account is not enrolled in Amazon GuardDuty.</p>
|
|
86
|
+
* <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p>
|
|
92
87
|
* </li>
|
|
93
88
|
* </ul>
|
|
94
89
|
*
|
|
@@ -65,17 +65,12 @@ declare const UpdateDatasourcePackagesCommand_base: {
|
|
|
65
65
|
* <p>This request cannot be completed for one of the following reasons.</p>
|
|
66
66
|
* <ul>
|
|
67
67
|
* <li>
|
|
68
|
-
* <p>
|
|
69
|
-
*
|
|
70
|
-
*
|
|
68
|
+
* <p>This request cannot be completed if it would cause the number of member accounts in the
|
|
69
|
+
* behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200
|
|
70
|
+
* member accounts.</p>
|
|
71
71
|
* </li>
|
|
72
72
|
* <li>
|
|
73
|
-
* <p>
|
|
74
|
-
* allowed.</p>
|
|
75
|
-
* </li>
|
|
76
|
-
* <li>
|
|
77
|
-
* <p>Detective is unable to verify the data rate for the member account. This
|
|
78
|
-
* is usually because the member account is not enrolled in Amazon GuardDuty.</p>
|
|
73
|
+
* <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p>
|
|
79
74
|
* </li>
|
|
80
75
|
* </ul>
|
|
81
76
|
*
|
|
@@ -26,7 +26,7 @@ declare const UpdateInvestigationStateCommand_base: {
|
|
|
26
26
|
};
|
|
27
27
|
/**
|
|
28
28
|
* @public
|
|
29
|
-
* <p>
|
|
29
|
+
* <p>Updates the state of an investigation.</p>
|
|
30
30
|
* @example
|
|
31
31
|
* Use a bare-bones client and the command you need to make an API call.
|
|
32
32
|
* ```javascript
|
package/dist-types/index.d.ts
CHANGED
|
@@ -70,7 +70,7 @@
|
|
|
70
70
|
* </ul>
|
|
71
71
|
* <p>All API actions are logged as CloudTrail events. See <a href="https://docs.aws.amazon.com/detective/latest/adminguide/logging-using-cloudtrail.html">Logging Detective API Calls with CloudTrail</a>.</p>
|
|
72
72
|
* <note>
|
|
73
|
-
* <p>We replaced the term "master account" with the term "administrator account.
|
|
73
|
+
* <p>We replaced the term "master account" with the term "administrator account". An
|
|
74
74
|
* administrator account is used to centrally manage multiple accounts. In the case of
|
|
75
75
|
* Detective, the administrator account manages the accounts in their behavior
|
|
76
76
|
* graph.</p>
|
|
@@ -341,17 +341,12 @@ export interface CreateGraphResponse {
|
|
|
341
341
|
* <p>This request cannot be completed for one of the following reasons.</p>
|
|
342
342
|
* <ul>
|
|
343
343
|
* <li>
|
|
344
|
-
* <p>
|
|
345
|
-
*
|
|
346
|
-
*
|
|
344
|
+
* <p>This request cannot be completed if it would cause the number of member accounts in the
|
|
345
|
+
* behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200
|
|
346
|
+
* member accounts.</p>
|
|
347
347
|
* </li>
|
|
348
348
|
* <li>
|
|
349
|
-
* <p>
|
|
350
|
-
* allowed.</p>
|
|
351
|
-
* </li>
|
|
352
|
-
* <li>
|
|
353
|
-
* <p>Detective is unable to verify the data rate for the member account. This
|
|
354
|
-
* is usually because the member account is not enrolled in Amazon GuardDuty.</p>
|
|
349
|
+
* <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p>
|
|
355
350
|
* </li>
|
|
356
351
|
* </ul>
|
|
357
352
|
*/
|
|
@@ -754,7 +749,7 @@ export interface EnableOrganizationAdminAccountRequest {
|
|
|
754
749
|
export interface GetInvestigationRequest {
|
|
755
750
|
/**
|
|
756
751
|
* @public
|
|
757
|
-
* <p>The ARN of the behavior graph.</p>
|
|
752
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
758
753
|
*/
|
|
759
754
|
GraphArn: string | undefined;
|
|
760
755
|
/**
|
|
@@ -821,7 +816,7 @@ export type Status = (typeof Status)[keyof typeof Status];
|
|
|
821
816
|
export interface GetInvestigationResponse {
|
|
822
817
|
/**
|
|
823
818
|
* @public
|
|
824
|
-
* <p>The ARN of the behavior graph.</p>
|
|
819
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
825
820
|
*/
|
|
826
821
|
GraphArn?: string;
|
|
827
822
|
/**
|
|
@@ -831,42 +826,46 @@ export interface GetInvestigationResponse {
|
|
|
831
826
|
InvestigationId?: string;
|
|
832
827
|
/**
|
|
833
828
|
* @public
|
|
834
|
-
* <p>The unique Amazon Resource Name (ARN)
|
|
829
|
+
* <p>The unique Amazon Resource Name (ARN). Detective supports IAM user ARNs and IAM role ARNs.</p>
|
|
835
830
|
*/
|
|
836
831
|
EntityArn?: string;
|
|
837
832
|
/**
|
|
838
833
|
* @public
|
|
839
|
-
* <p>Type of entity. For example, Amazon Web Services accounts, such as IAM user and role.</p>
|
|
834
|
+
* <p>Type of entity. For example, Amazon Web Services accounts, such as an IAM user and/or IAM role.</p>
|
|
840
835
|
*/
|
|
841
836
|
EntityType?: EntityType;
|
|
842
837
|
/**
|
|
843
838
|
* @public
|
|
844
|
-
* <p>The
|
|
839
|
+
* <p>The creation time of the investigation report in UTC time stamp format.</p>
|
|
845
840
|
*/
|
|
846
841
|
CreatedTime?: Date;
|
|
847
842
|
/**
|
|
848
843
|
* @public
|
|
849
|
-
* <p>The start date and time
|
|
844
|
+
* <p>The start date and time used to set the scope time within which you want to generate the investigation report. The value is an UTC ISO8601 formatted
|
|
845
|
+
* string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>
|
|
850
846
|
*/
|
|
851
847
|
ScopeStartTime?: Date;
|
|
852
848
|
/**
|
|
853
849
|
* @public
|
|
854
|
-
* <p>The data and time when the investigation began. The value is an UTC ISO8601 formatted
|
|
850
|
+
* <p>The data and time when the investigation began. The value is an UTC ISO8601 formatted
|
|
851
|
+
* string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>
|
|
855
852
|
*/
|
|
856
853
|
ScopeEndTime?: Date;
|
|
857
854
|
/**
|
|
858
855
|
* @public
|
|
859
|
-
* <p>
|
|
856
|
+
* <p>The status based on the completion status of the investigation.</p>
|
|
860
857
|
*/
|
|
861
858
|
Status?: Status;
|
|
862
859
|
/**
|
|
863
860
|
* @public
|
|
864
|
-
* <p>
|
|
861
|
+
* <p>The severity assigned is based on the likelihood and impact of the indicators of
|
|
862
|
+
* compromise discovered in the investigation.</p>
|
|
865
863
|
*/
|
|
866
864
|
Severity?: Severity;
|
|
867
865
|
/**
|
|
868
866
|
* @public
|
|
869
|
-
* <p>The current state of the investigation. An archived investigation indicates you
|
|
867
|
+
* <p>The current state of the investigation. An archived investigation indicates that you
|
|
868
|
+
* have completed reviewing the investigation.</p>
|
|
870
869
|
*/
|
|
871
870
|
State?: State;
|
|
872
871
|
}
|
|
@@ -1037,7 +1036,7 @@ export type IndicatorType = (typeof IndicatorType)[keyof typeof IndicatorType];
|
|
|
1037
1036
|
export interface ListIndicatorsRequest {
|
|
1038
1037
|
/**
|
|
1039
1038
|
* @public
|
|
1040
|
-
* <p>The ARN of the behavior graph.</p>
|
|
1039
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
1041
1040
|
*/
|
|
1042
1041
|
GraphArn: string | undefined;
|
|
1043
1042
|
/**
|
|
@@ -1047,18 +1046,18 @@ export interface ListIndicatorsRequest {
|
|
|
1047
1046
|
InvestigationId: string | undefined;
|
|
1048
1047
|
/**
|
|
1049
1048
|
* @public
|
|
1050
|
-
* <p>
|
|
1049
|
+
* <p>For the list of indicators of compromise that are generated by Detective investigations, see <a href="https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html">Detective investigations</a>.</p>
|
|
1051
1050
|
*/
|
|
1052
1051
|
IndicatorType?: IndicatorType;
|
|
1053
1052
|
/**
|
|
1054
1053
|
* @public
|
|
1055
|
-
* <p>
|
|
1054
|
+
* <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p>
|
|
1056
1055
|
* <p>Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.</p>
|
|
1057
1056
|
*/
|
|
1058
1057
|
NextToken?: string;
|
|
1059
1058
|
/**
|
|
1060
1059
|
* @public
|
|
1061
|
-
* <p>
|
|
1060
|
+
* <p>Lists the maximum number of indicators in a page.</p>
|
|
1062
1061
|
*/
|
|
1063
1062
|
MaxResults?: number;
|
|
1064
1063
|
}
|
|
@@ -1096,7 +1095,7 @@ export interface FlaggedIpAddressDetail {
|
|
|
1096
1095
|
export interface ImpossibleTravelDetail {
|
|
1097
1096
|
/**
|
|
1098
1097
|
* @public
|
|
1099
|
-
* <p>IP address where the resource was first used in the impossible travel
|
|
1098
|
+
* <p>IP address where the resource was first used in the impossible travel.</p>
|
|
1100
1099
|
*/
|
|
1101
1100
|
StartingIpAddress?: string;
|
|
1102
1101
|
/**
|
|
@@ -1106,7 +1105,7 @@ export interface ImpossibleTravelDetail {
|
|
|
1106
1105
|
EndingIpAddress?: string;
|
|
1107
1106
|
/**
|
|
1108
1107
|
* @public
|
|
1109
|
-
* <p>Location where the resource was first used in the impossible travel
|
|
1108
|
+
* <p>Location where the resource was first used in the impossible travel.</p>
|
|
1110
1109
|
*/
|
|
1111
1110
|
StartingLocation?: string;
|
|
1112
1111
|
/**
|
|
@@ -1132,7 +1131,7 @@ export interface NewAsoDetail {
|
|
|
1132
1131
|
Aso?: string;
|
|
1133
1132
|
/**
|
|
1134
1133
|
* @public
|
|
1135
|
-
* <p>Checks if the ASO is
|
|
1134
|
+
* <p>Checks if the Autonomous System Organization (ASO) is new for the entire account.</p>
|
|
1136
1135
|
*/
|
|
1137
1136
|
IsNewForEntireAccount?: boolean;
|
|
1138
1137
|
}
|
|
@@ -1153,7 +1152,7 @@ export interface NewGeolocationDetail {
|
|
|
1153
1152
|
IpAddress?: string;
|
|
1154
1153
|
/**
|
|
1155
1154
|
* @public
|
|
1156
|
-
* <p>Checks if the
|
|
1155
|
+
* <p>Checks if the geolocation is new for the entire account.</p>
|
|
1157
1156
|
*/
|
|
1158
1157
|
IsNewForEntireAccount?: boolean;
|
|
1159
1158
|
}
|
|
@@ -1180,7 +1179,7 @@ export interface NewUserAgentDetail {
|
|
|
1180
1179
|
export interface RelatedFindingDetail {
|
|
1181
1180
|
/**
|
|
1182
1181
|
* @public
|
|
1183
|
-
* <p>The ARN of the related finding.</p>
|
|
1182
|
+
* <p>The Amazon Resource Name (ARN) of the related finding.</p>
|
|
1184
1183
|
*/
|
|
1185
1184
|
Arn?: string;
|
|
1186
1185
|
/**
|
|
@@ -1228,12 +1227,12 @@ export interface TTPsObservedDetail {
|
|
|
1228
1227
|
Procedure?: string;
|
|
1229
1228
|
/**
|
|
1230
1229
|
* @public
|
|
1231
|
-
* <p>The IP address where the TTP was observed.</p>
|
|
1230
|
+
* <p>The IP address where the tactics, techniques, and procedure (TTP) was observed.</p>
|
|
1232
1231
|
*/
|
|
1233
1232
|
IpAddress?: string;
|
|
1234
1233
|
/**
|
|
1235
1234
|
* @public
|
|
1236
|
-
* <p>The name of the API where the TTP was observed.</p>
|
|
1235
|
+
* <p>The name of the API where the tactics, techniques, and procedure (TTP) was observed.</p>
|
|
1237
1236
|
*/
|
|
1238
1237
|
APIName?: string;
|
|
1239
1238
|
/**
|
|
@@ -1249,7 +1248,7 @@ export interface TTPsObservedDetail {
|
|
|
1249
1248
|
}
|
|
1250
1249
|
/**
|
|
1251
1250
|
* @public
|
|
1252
|
-
* <p>Details about the indicators of compromise which are used to determine if a resource is involved in a security incident. </p>
|
|
1251
|
+
* <p>Details about the indicators of compromise which are used to determine if a resource is involved in a security incident. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. For the list of indicators of compromise that are generated by Detective investigations, see <a href="https://docs.aws.amazon.com/detective/latest/userguide/detective-investigations.html">Detective investigations</a>.</p>
|
|
1253
1252
|
*/
|
|
1254
1253
|
export interface IndicatorDetail {
|
|
1255
1254
|
/**
|
|
@@ -1264,7 +1263,7 @@ export interface IndicatorDetail {
|
|
|
1264
1263
|
ImpossibleTravelDetail?: ImpossibleTravelDetail;
|
|
1265
1264
|
/**
|
|
1266
1265
|
* @public
|
|
1267
|
-
* <p>Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from
|
|
1266
|
+
* <p>Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from Amazon Web Services threat intelligence.</p>
|
|
1268
1267
|
*/
|
|
1269
1268
|
FlaggedIpAddressDetail?: FlaggedIpAddressDetail;
|
|
1270
1269
|
/**
|
|
@@ -1295,17 +1294,21 @@ export interface IndicatorDetail {
|
|
|
1295
1294
|
}
|
|
1296
1295
|
/**
|
|
1297
1296
|
* @public
|
|
1298
|
-
* <p>
|
|
1297
|
+
* <p>Detective investigations triages indicators of compromises such as a finding
|
|
1298
|
+
* and surfaces only the most critical and suspicious issues, so you can focus on high-level
|
|
1299
|
+
* investigations. An <code>Indicator</code> lets you determine if an Amazon Web Services
|
|
1300
|
+
* resource is involved in unusual activity that could indicate malicious behavior and its
|
|
1301
|
+
* impact.</p>
|
|
1299
1302
|
*/
|
|
1300
1303
|
export interface Indicator {
|
|
1301
1304
|
/**
|
|
1302
1305
|
* @public
|
|
1303
|
-
* <p>The type of indicator
|
|
1306
|
+
* <p>The type of indicator. </p>
|
|
1304
1307
|
*/
|
|
1305
1308
|
IndicatorType?: IndicatorType;
|
|
1306
1309
|
/**
|
|
1307
1310
|
* @public
|
|
1308
|
-
* <p>Details about the indicator of compromise.</p>
|
|
1311
|
+
* <p>Details about the indicators of compromise that are used to determine if a resource is involved in a security incident. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident.</p>
|
|
1309
1312
|
*/
|
|
1310
1313
|
IndicatorDetail?: IndicatorDetail;
|
|
1311
1314
|
}
|
|
@@ -1315,7 +1318,7 @@ export interface Indicator {
|
|
|
1315
1318
|
export interface ListIndicatorsResponse {
|
|
1316
1319
|
/**
|
|
1317
1320
|
* @public
|
|
1318
|
-
* <p>The ARN of the behavior graph.</p>
|
|
1321
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
1319
1322
|
*/
|
|
1320
1323
|
GraphArn?: string;
|
|
1321
1324
|
/**
|
|
@@ -1325,13 +1328,13 @@ export interface ListIndicatorsResponse {
|
|
|
1325
1328
|
InvestigationId?: string;
|
|
1326
1329
|
/**
|
|
1327
1330
|
* @public
|
|
1328
|
-
* <p>
|
|
1331
|
+
* <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p>
|
|
1329
1332
|
* <p>Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.</p>
|
|
1330
1333
|
*/
|
|
1331
1334
|
NextToken?: string;
|
|
1332
1335
|
/**
|
|
1333
1336
|
* @public
|
|
1334
|
-
* <p>
|
|
1337
|
+
* <p>Lists the indicators of compromise.</p>
|
|
1335
1338
|
*/
|
|
1336
1339
|
Indicators?: Indicator[];
|
|
1337
1340
|
}
|
|
@@ -1347,7 +1350,7 @@ export interface DateFilter {
|
|
|
1347
1350
|
StartInclusive: Date | undefined;
|
|
1348
1351
|
/**
|
|
1349
1352
|
* @public
|
|
1350
|
-
* <p>A timestamp representing the end date of the time period until when data is filtered
|
|
1353
|
+
* <p>A timestamp representing the end date of the time period until when data is filtered, including the end date.</p>
|
|
1351
1354
|
*/
|
|
1352
1355
|
EndInclusive: Date | undefined;
|
|
1353
1356
|
}
|
|
@@ -1440,23 +1443,23 @@ export interface SortCriteria {
|
|
|
1440
1443
|
export interface ListInvestigationsRequest {
|
|
1441
1444
|
/**
|
|
1442
1445
|
* @public
|
|
1443
|
-
* <p>The ARN of the behavior graph.</p>
|
|
1446
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
1444
1447
|
*/
|
|
1445
1448
|
GraphArn: string | undefined;
|
|
1446
1449
|
/**
|
|
1447
1450
|
* @public
|
|
1448
|
-
* <p>
|
|
1451
|
+
* <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p>
|
|
1449
1452
|
* <p>Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.</p>
|
|
1450
1453
|
*/
|
|
1451
1454
|
NextToken?: string;
|
|
1452
1455
|
/**
|
|
1453
1456
|
* @public
|
|
1454
|
-
* <p>
|
|
1457
|
+
* <p>Lists the maximum number of investigations in a page.</p>
|
|
1455
1458
|
*/
|
|
1456
1459
|
MaxResults?: number;
|
|
1457
1460
|
/**
|
|
1458
1461
|
* @public
|
|
1459
|
-
* <p>
|
|
1462
|
+
* <p>Filters the investigation results based on a criteria.</p>
|
|
1460
1463
|
*/
|
|
1461
1464
|
FilterCriteria?: FilterCriteria;
|
|
1462
1465
|
/**
|
|
@@ -1467,7 +1470,7 @@ export interface ListInvestigationsRequest {
|
|
|
1467
1470
|
}
|
|
1468
1471
|
/**
|
|
1469
1472
|
* @public
|
|
1470
|
-
* <p>Details about the investigation related to a potential security event identified by Detective
|
|
1473
|
+
* <p>Details about the investigation related to a potential security event identified by Detective.</p>
|
|
1471
1474
|
*/
|
|
1472
1475
|
export interface InvestigationDetail {
|
|
1473
1476
|
/**
|
|
@@ -1492,7 +1495,8 @@ export interface InvestigationDetail {
|
|
|
1492
1495
|
State?: State;
|
|
1493
1496
|
/**
|
|
1494
1497
|
* @public
|
|
1495
|
-
* <p>The
|
|
1498
|
+
* <p>The time stamp of the creation time of the investigation report. The value is an UTC ISO8601 formatted
|
|
1499
|
+
* string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>
|
|
1496
1500
|
*/
|
|
1497
1501
|
CreatedTime?: Date;
|
|
1498
1502
|
/**
|
|
@@ -1512,13 +1516,13 @@ export interface InvestigationDetail {
|
|
|
1512
1516
|
export interface ListInvestigationsResponse {
|
|
1513
1517
|
/**
|
|
1514
1518
|
* @public
|
|
1515
|
-
* <p>
|
|
1519
|
+
* <p>Lists the summary of uncommon behavior or malicious activity which indicates a compromise.</p>
|
|
1516
1520
|
*/
|
|
1517
1521
|
InvestigationDetails?: InvestigationDetail[];
|
|
1518
1522
|
/**
|
|
1519
1523
|
* @public
|
|
1520
|
-
* <p>
|
|
1521
|
-
* <p>Each pagination token expires after 24 hours.
|
|
1524
|
+
* <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p>
|
|
1525
|
+
* <p>Each pagination token expires after 24 hours. </p>
|
|
1522
1526
|
*/
|
|
1523
1527
|
NextToken?: string;
|
|
1524
1528
|
}
|
|
@@ -1675,7 +1679,7 @@ export interface RejectInvitationRequest {
|
|
|
1675
1679
|
export interface StartInvestigationRequest {
|
|
1676
1680
|
/**
|
|
1677
1681
|
* @public
|
|
1678
|
-
* <p>The ARN of the behavior graph.</p>
|
|
1682
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
1679
1683
|
*/
|
|
1680
1684
|
GraphArn: string | undefined;
|
|
1681
1685
|
/**
|
|
@@ -1690,7 +1694,7 @@ export interface StartInvestigationRequest {
|
|
|
1690
1694
|
ScopeStartTime: Date | undefined;
|
|
1691
1695
|
/**
|
|
1692
1696
|
* @public
|
|
1693
|
-
* <p>The data and time when the investigation
|
|
1697
|
+
* <p>The data and time when the investigation ended. The value is an UTC ISO8601 formatted
|
|
1694
1698
|
* string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>
|
|
1695
1699
|
*/
|
|
1696
1700
|
ScopeEndTime: Date | undefined;
|
|
@@ -1786,7 +1790,7 @@ export interface UpdateDatasourcePackagesRequest {
|
|
|
1786
1790
|
export interface UpdateInvestigationStateRequest {
|
|
1787
1791
|
/**
|
|
1788
1792
|
* @public
|
|
1789
|
-
* <p>The ARN of the behavior graph.</p>
|
|
1793
|
+
* <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
|
|
1790
1794
|
*/
|
|
1791
1795
|
GraphArn: string | undefined;
|
|
1792
1796
|
/**
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@aws-sdk/client-detective",
|
|
3
3
|
"description": "AWS SDK for JavaScript Detective Client for Node.js, Browser and React Native",
|
|
4
|
-
"version": "3.
|
|
4
|
+
"version": "3.515.0",
|
|
5
5
|
"scripts": {
|
|
6
6
|
"build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
|
|
7
7
|
"build:cjs": "node ../../scripts/compilation/inline client-detective",
|
|
@@ -20,18 +20,18 @@
|
|
|
20
20
|
"dependencies": {
|
|
21
21
|
"@aws-crypto/sha256-browser": "3.0.0",
|
|
22
22
|
"@aws-crypto/sha256-js": "3.0.0",
|
|
23
|
-
"@aws-sdk/client-sts": "3.
|
|
23
|
+
"@aws-sdk/client-sts": "3.515.0",
|
|
24
24
|
"@aws-sdk/core": "3.513.0",
|
|
25
|
-
"@aws-sdk/credential-provider-node": "3.
|
|
26
|
-
"@aws-sdk/middleware-host-header": "3.
|
|
27
|
-
"@aws-sdk/middleware-logger": "3.
|
|
28
|
-
"@aws-sdk/middleware-recursion-detection": "3.
|
|
29
|
-
"@aws-sdk/middleware-user-agent": "3.
|
|
30
|
-
"@aws-sdk/region-config-resolver": "3.
|
|
31
|
-
"@aws-sdk/types": "3.
|
|
32
|
-
"@aws-sdk/util-endpoints": "3.
|
|
33
|
-
"@aws-sdk/util-user-agent-browser": "3.
|
|
34
|
-
"@aws-sdk/util-user-agent-node": "3.
|
|
25
|
+
"@aws-sdk/credential-provider-node": "3.515.0",
|
|
26
|
+
"@aws-sdk/middleware-host-header": "3.515.0",
|
|
27
|
+
"@aws-sdk/middleware-logger": "3.515.0",
|
|
28
|
+
"@aws-sdk/middleware-recursion-detection": "3.515.0",
|
|
29
|
+
"@aws-sdk/middleware-user-agent": "3.515.0",
|
|
30
|
+
"@aws-sdk/region-config-resolver": "3.515.0",
|
|
31
|
+
"@aws-sdk/types": "3.515.0",
|
|
32
|
+
"@aws-sdk/util-endpoints": "3.515.0",
|
|
33
|
+
"@aws-sdk/util-user-agent-browser": "3.515.0",
|
|
34
|
+
"@aws-sdk/util-user-agent-node": "3.515.0",
|
|
35
35
|
"@smithy/config-resolver": "^2.1.1",
|
|
36
36
|
"@smithy/core": "^1.3.2",
|
|
37
37
|
"@smithy/fetch-http-handler": "^2.4.1",
|