types

package
v0.26.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 1, 2020 License: Apache-2.0 Imports: 3 Imported by: 5

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessControlList 

type AccessControlList struct {

	// A value that indicates whether public read access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicReadAccess *bool

	// A value that indicates whether public write access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicWriteAccess *bool
}

Contains information on the current access control policies for the bucket.

type AccessKeyDetails 

type AccessKeyDetails struct {

	// The name of the user.
	UserName *string

	// The type of the user.
	UserType *string

	// The principal ID of the user.
	PrincipalId *string

	// The access key ID of the user.
	AccessKeyId *string
}

Contains information about the access keys.

type AccountDetail 

type AccountDetail struct {

	// The email address of the member account.
	//
	// This member is required.
	Email *string

	// The member account ID.
	//
	// This member is required.
	AccountId *string
}

Contains information about the account.

type AccountLevelPermissions 

type AccountLevelPermissions struct {

	// Describes the S3 Block Public Access settings of the bucket's parent account.
	BlockPublicAccess *BlockPublicAccess
}

Contains information about the account level permissions on the S3 bucket.

type Action 

type Action struct {

	// Information about the AWS_API_CALL action described in this finding.
	AwsApiCallAction *AwsApiCallAction

	// Information about the NETWORK_CONNECTION action described in this finding.
	NetworkConnectionAction *NetworkConnectionAction

	// Information about the PORT_PROBE action described in this finding.
	PortProbeAction *PortProbeAction

	// The GuardDuty finding activity type.
	ActionType *string

	// Information about the DNS_REQUEST action described in this finding.
	DnsRequestAction *DnsRequestAction
}

Contains information about actions.

type AdminAccount 

type AdminAccount struct {

	// Indicates whether the account is enabled as the delegated administrator.
	AdminStatus AdminStatus

	// The AWS account ID for the account.
	AdminAccountId *string
}

The account within the organization specified as the GuardDuty delegated administrator.

type AdminStatus 

type AdminStatus string
const (
	AdminStatusEnabled             AdminStatus = "ENABLED"
	AdminStatusDisable_in_progress AdminStatus = "DISABLE_IN_PROGRESS"
)

Enum values for AdminStatus

type AwsApiCallAction 

type AwsApiCallAction struct {

	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails

	// The AWS service name whose API was invoked.
	ServiceName *string

	// The AWS API caller type.
	CallerType *string

	// The AWS API name.
	Api *string

	// The domain information for the AWS API call.
	DomainDetails *DomainDetails
}

Contains information about the API operation.

type BadRequestException 

type BadRequestException struct {
	Message *string

	Type *string
}

A bad request exception object.

func (*BadRequestException) Error 

func (e *BadRequestException) Error() string

func (*BadRequestException) ErrorCode 

func (e *BadRequestException) ErrorCode() string

func (*BadRequestException) ErrorFault 

func (e *BadRequestException) ErrorFault() smithy.ErrorFault

func (*BadRequestException) ErrorMessage 

func (e *BadRequestException) ErrorMessage() string

type BlockPublicAccess 

type BlockPublicAccess struct {

	// Indicates if S3 Block Public Access is set to BlockPublicPolicy.
	BlockPublicPolicy *bool

	// Indicates if S3 Block Public Access is set to RestrictPublicBuckets.
	RestrictPublicBuckets *bool

	// Indicates if S3 Block Public Access is set to BlockPublicAcls.
	BlockPublicAcls *bool

	// Indicates if S3 Block Public Access is set to IgnorePublicAcls.
	IgnorePublicAcls *bool
}

Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access (https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html) for more information.

type BucketLevelPermissions 

type BucketLevelPermissions struct {

	// Contains information on how Access Control Policies are applied to the bucket.
	AccessControlList *AccessControlList

	// Contains information on the bucket policies for the S3 bucket.
	BucketPolicy *BucketPolicy

	// Contains information on which account level S3 Block Public Access settings are
	// applied to the S3 bucket.
	BlockPublicAccess *BlockPublicAccess
}

Contains information about the bucket level permissions for the S3 bucket.

type BucketPolicy 

type BucketPolicy struct {

	// A value that indicates whether public read access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicReadAccess *bool

	// A value that indicates whether public write access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicWriteAccess *bool
}

Contains information on the current bucket policies for the S3 bucket.

type City 

type City struct {

	// The city name of the remote IP address.
	CityName *string
}

Contains information about the city associated with the IP address.

type CloudTrailConfigurationResult 

type CloudTrailConfigurationResult struct {

	// Describes whether CloudTrail is enabled as a data source for the detector.
	//
	// This member is required.
	Status DataSourceStatus
}

Contains information on the status of CloudTrail as a data source for the detector.

type Condition 

type Condition struct {

	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	Gte *int32

	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	Lt *int32

	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	GreaterThanOrEqual *int64

	// Represents the not equal condition to be applied to a single field when querying
	// for findings.
	Neq []*string

	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	LessThanOrEqual *int64

	// Represents the equal condition to be applied to a single field when querying for
	// findings.
	Eq []*string

	// Represents an equal condition to be applied to a single field when querying for
	// findings.
	Equals []*string

	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	Gt *int32

	// Represents a not equal condition to be applied to a single field when querying
	// for findings.
	NotEquals []*string

	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	Lte *int32

	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	GreaterThan *int64

	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	LessThan *int64
}

Contains information about the condition.

type Country 

type Country struct {

	// The country name of the remote IP address.
	CountryName *string

	// The country code of the remote IP address.
	CountryCode *string
}

Contains information about the country where the remote IP address is located.

type DNSLogsConfigurationResult 

type DNSLogsConfigurationResult struct {

	// Denotes whether DNS logs is enabled as a data source.
	//
	// This member is required.
	Status DataSourceStatus
}

Contains information on the status of DNS logs as a data source.

type DataSource 

type DataSource string
const (
	DataSourceFlow_logs   DataSource = "FLOW_LOGS"
	DataSourceCloud_trail DataSource = "CLOUD_TRAIL"
	DataSourceDns_logs    DataSource = "DNS_LOGS"
	DataSourceS3_logs     DataSource = "S3_LOGS"
)

Enum values for DataSource

type DataSourceConfigurations 

type DataSourceConfigurations struct {

	// Describes whether S3 data event logs are enabled as a data source.
	S3Logs *S3LogsConfiguration
}

Contains information about which data sources are enabled.

type DataSourceConfigurationsResult 

type DataSourceConfigurationsResult struct {

	// An object that contains information on the status of CloudTrail as a data
	// source.
	//
	// This member is required.
	CloudTrail *CloudTrailConfigurationResult

	// An object that contains information on the status of DNS logs as a data source.
	//
	// This member is required.
	DNSLogs *DNSLogsConfigurationResult

	// An object that contains information on the status of VPC flow logs as a data
	// source.
	//
	// This member is required.
	FlowLogs *FlowLogsConfigurationResult

	// An object that contains information on the status of S3 Data event logs as a
	// data source.
	//
	// This member is required.
	S3Logs *S3LogsConfigurationResult
}

Contains information on the status of data sources for the detector.

type DataSourceStatus 

type DataSourceStatus string
const (
	DataSourceStatusEnabled  DataSourceStatus = "ENABLED"
	DataSourceStatusDisabled DataSourceStatus = "DISABLED"
)

Enum values for DataSourceStatus

type DefaultServerSideEncryption 

type DefaultServerSideEncryption struct {

	// The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the
	// bucket EncryptionType is aws:kms.
	KmsMasterKeyArn *string

	// The type of encryption used for objects within the S3 bucket.
	EncryptionType *string
}

Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption (https://docs.aws.amazon.com/AmazonS3/atest/dev/serv-side-encryption.html) for more information.

type Destination 

type Destination struct {

	// The status of the publishing destination.
	//
	// This member is required.
	Status PublishingStatus

	// The type of resource used for the publishing destination. Currently, only Amazon
	// S3 buckets are supported.
	//
	// This member is required.
	DestinationType DestinationType

	// The unique ID of the publishing destination.
	//
	// This member is required.
	DestinationId *string
}

Contains information about the publishing destination, including the ID, type, and status.

type DestinationProperties 

type DestinationProperties struct {

	// The ARN of the resource to publish to.
	DestinationArn *string

	// The ARN of the KMS key to use for encryption.
	KmsKeyArn *string
}

Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.

type DestinationType 

type DestinationType string
const (
	DestinationTypeS3 DestinationType = "S3"
)

Enum values for DestinationType

type DetectorStatus 

type DetectorStatus string
const (
	DetectorStatusEnabled  DetectorStatus = "ENABLED"
	DetectorStatusDisabled DetectorStatus = "DISABLED"
)

Enum values for DetectorStatus

type DnsRequestAction 

type DnsRequestAction struct {

	// The domain information for the API request.
	Domain *string
}

Contains information about the DNS_REQUEST action described in this finding.

type DomainDetails 

type DomainDetails struct {

	// The domain information for the AWS API call.
	Domain *string
}

Contains information about the domain.

type Evidence 

type Evidence struct {

	// A list of threat intelligence details related to the evidence.
	ThreatIntelligenceDetails []*ThreatIntelligenceDetail
}

Contains information about the reason that the finding was generated.

type Feedback 

type Feedback string
const (
	FeedbackUseful     Feedback = "USEFUL"
	FeedbackNot_useful Feedback = "NOT_USEFUL"
)

Enum values for Feedback

type FilterAction 

type FilterAction string
const (
	FilterActionNoop    FilterAction = "NOOP"
	FilterActionArchive FilterAction = "ARCHIVE"
)

Enum values for FilterAction

type Finding 

type Finding struct {

	// The type of finding.
	//
	// This member is required.
	Type *string

	// Contains additional information about the generated finding.
	Service *Service

	// The ID of the account in which the finding was generated.
	//
	// This member is required.
	AccountId *string

	// The confidence score for the finding.
	Confidence *float64

	// The version of the schema used for the finding.
	//
	// This member is required.
	SchemaVersion *string

	// The severity of the finding.
	//
	// This member is required.
	Severity *float64

	// The title of the finding.
	Title *string

	// The Region where the finding was generated.
	//
	// This member is required.
	Region *string

	// The time and date when the finding was last updated.
	//
	// This member is required.
	UpdatedAt *string

	// Contains information about the AWS resource associated with the activity that
	// prompted GuardDuty to generate a finding.
	//
	// This member is required.
	Resource *Resource

	// The partition associated with the finding.
	Partition *string

	// The ARN of the finding.
	//
	// This member is required.
	Arn *string

	// The time and date when the finding was created.
	//
	// This member is required.
	CreatedAt *string

	// The description of the finding.
	Description *string

	// The ID of the finding.
	//
	// This member is required.
	Id *string
}

Contains information about the finding, which is generated when abnormal or suspicious activity is detected.

type FindingCriteria 

type FindingCriteria struct {

	// Represents a map of finding properties that match specified conditions and
	// values when querying findings.
	Criterion map[string]*Condition
}

Contains information about the criteria used for querying findings.

type FindingPublishingFrequency 

type FindingPublishingFrequency string
const (
	FindingPublishingFrequencyFifteen_minutes FindingPublishingFrequency = "FIFTEEN_MINUTES"
	FindingPublishingFrequencyOne_hour        FindingPublishingFrequency = "ONE_HOUR"
	FindingPublishingFrequencySix_hours       FindingPublishingFrequency = "SIX_HOURS"
)

Enum values for FindingPublishingFrequency

type FindingStatisticType 

type FindingStatisticType string
const (
	FindingStatisticTypeCount_by_severity FindingStatisticType = "COUNT_BY_SEVERITY"
)

Enum values for FindingStatisticType

type FindingStatistics 

type FindingStatistics struct {

	// Represents a map of severity to count statistics for a set of findings.
	CountBySeverity map[string]*int32
}

Contains information about finding statistics.

type FlowLogsConfigurationResult 

type FlowLogsConfigurationResult struct {

	// Denotes whether VPC flow logs is enabled as a data source.
	//
	// This member is required.
	Status DataSourceStatus
}

Contains information on the status of VPC flow logs as a data source.

type GeoLocation 

type GeoLocation struct {

	// The longitude information of the remote IP address.
	Lon *float64

	// The latitude information of the remote IP address.
	Lat *float64
}

Contains information about the location of the remote IP address.

type IamInstanceProfile 

type IamInstanceProfile struct {

	// The profile ID of the EC2 instance.
	Id *string

	// The profile ARN of the EC2 instance.
	Arn *string
}

Contains information about the EC2 instance profile.

type InstanceDetails 

type InstanceDetails struct {

	// The product code of the EC2 instance.
	ProductCodes []*ProductCode

	// The image description of the EC2 instance.
	ImageDescription *string

	// The profile information of the EC2 instance.
	IamInstanceProfile *IamInstanceProfile

	// The Amazon Resource Name (ARN) of the AWS Outpost. Only applicable to AWS
	// Outposts instances.
	OutpostArn *string

	// The Availability Zone of the EC2 instance.
	AvailabilityZone *string

	// The tags of the EC2 instance.
	Tags []*Tag

	// The type of the EC2 instance.
	InstanceType *string

	// The platform of the EC2 instance.
	Platform *string

	// The launch time of the EC2 instance.
	LaunchTime *string

	// The state of the EC2 instance.
	InstanceState *string

	// The image ID of the EC2 instance.
	ImageId *string

	// The elastic network interface information of the EC2 instance.
	NetworkInterfaces []*NetworkInterface

	// The ID of the EC2 instance.
	InstanceId *string
}

Contains information about the details of an instance.

type InternalServerErrorException 

type InternalServerErrorException struct {
	Message *string

	Type *string
}

An internal server error exception object.

func (*InternalServerErrorException) Error 

func (e *InternalServerErrorException) Error() string

func (*InternalServerErrorException) ErrorCode 

func (e *InternalServerErrorException) ErrorCode() string

func (*InternalServerErrorException) ErrorFault 

func (e *InternalServerErrorException) ErrorFault() smithy.ErrorFault

func (*InternalServerErrorException) ErrorMessage 

func (e *InternalServerErrorException) ErrorMessage() string

type Invitation 

type Invitation struct {

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The ID of the account that the invitation was sent from.
	AccountId *string

	// The ID of the invitation. This value is used to validate the inviter account to
	// the member account.
	InvitationId *string

	// The status of the relationship between the inviter and invitee accounts.
	RelationshipStatus *string
}

Contains information about the invitation to become a member account.

type IpSetFormat 

type IpSetFormat string
const (
	IpSetFormatTxt         IpSetFormat = "TXT"
	IpSetFormatStix        IpSetFormat = "STIX"
	IpSetFormatOtx_csv     IpSetFormat = "OTX_CSV"
	IpSetFormatAlien_vault IpSetFormat = "ALIEN_VAULT"
	IpSetFormatProof_point IpSetFormat = "PROOF_POINT"
	IpSetFormatFire_eye    IpSetFormat = "FIRE_EYE"
)

Enum values for IpSetFormat

type IpSetStatus 

type IpSetStatus string
const (
	IpSetStatusInactive       IpSetStatus = "INACTIVE"
	IpSetStatusActivating     IpSetStatus = "ACTIVATING"
	IpSetStatusActive         IpSetStatus = "ACTIVE"
	IpSetStatusDeactivating   IpSetStatus = "DEACTIVATING"
	IpSetStatusError          IpSetStatus = "ERROR"
	IpSetStatusDelete_pending IpSetStatus = "DELETE_PENDING"
	IpSetStatusDeleted        IpSetStatus = "DELETED"
)

Enum values for IpSetStatus

type LocalIpDetails 

type LocalIpDetails struct {

	// The IPv4 local address of the connection.
	IpAddressV4 *string
}

Contains information about the local IP address of the connection.

type LocalPortDetails 

type LocalPortDetails struct {

	// The port number of the local connection.
	Port *int32

	// The port name of the local connection.
	PortName *string
}

Contains information about the port for the local connection.

type Master 

type Master struct {

	// The ID of the account used as the master account.
	AccountId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The status of the relationship between the master and member accounts.
	RelationshipStatus *string

	// The value used to validate the master account to the member account.
	InvitationId *string
}

Contains information about the master account and invitation.

type Member 

type Member struct {

	// The status of the relationship between the member and the master.
	//
	// This member is required.
	RelationshipStatus *string

	// The master account ID.
	//
	// This member is required.
	MasterId *string

	// The ID of the member account.
	//
	// This member is required.
	AccountId *string

	// The last-updated timestamp of the member.
	//
	// This member is required.
	UpdatedAt *string

	// The detector ID of the member account.
	DetectorId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The email address of the member account.
	//
	// This member is required.
	Email *string
}

Contains information about the member account.

type MemberDataSourceConfiguration 

type MemberDataSourceConfiguration struct {

	// Contains information on the status of data sources for the account.
	//
	// This member is required.
	DataSources *DataSourceConfigurationsResult

	// The account ID for the member account.
	//
	// This member is required.
	AccountId *string
}

Contains information on which data sources are enabled for a member account.

type NetworkConnectionAction 

type NetworkConnectionAction struct {

	// Indicates whether EC2 blocked the network connection to your instance.
	Blocked *bool

	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails

	// The network connection protocol.
	Protocol *string

	// The network connection direction.
	ConnectionDirection *string

	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails

	// The remote port information of the connection.
	RemotePortDetails *RemotePortDetails

	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
}

Contains information about the NETWORK_CONNECTION action described in the finding.

type NetworkInterface 

type NetworkInterface struct {

	// The subnet ID of the EC2 instance.
	SubnetId *string

	// The public DNS name of the EC2 instance.
	PublicDnsName *string

	// The VPC ID of the EC2 instance.
	VpcId *string

	// The private IP address of the EC2 instance.
	PrivateIpAddress *string

	// The ID of the network interface.
	NetworkInterfaceId *string

	// A list of IPv6 addresses for the EC2 instance.
	Ipv6Addresses []*string

	// The private DNS name of the EC2 instance.
	PrivateDnsName *string

	// The public IP address of the EC2 instance.
	PublicIp *string

	// Other private IP address information of the EC2 instance.
	PrivateIpAddresses []*PrivateIpAddressDetails

	// The security groups associated with the EC2 instance.
	SecurityGroups []*SecurityGroup
}

Contains information about the elastic network interface of the EC2 instance.

type OrderBy 

type OrderBy string
const (
	OrderByAsc  OrderBy = "ASC"
	OrderByDesc OrderBy = "DESC"
)

Enum values for OrderBy

type Organization 

type Organization struct {

	// The name of the internet provider.
	Org *string

	// The ISP information for the internet provider.
	Isp *string

	// The organization that registered this ASN.
	AsnOrg *string

	// The Autonomous System Number (ASN) of the internet provider of the remote IP
	// address.
	Asn *string
}

Contains information about the ISP organization of the remote IP address.

type OrganizationDataSourceConfigurations 

type OrganizationDataSourceConfigurations struct {

	// Describes whether S3 data event logs are enabled for new members of the
	// organization.
	S3Logs *OrganizationS3LogsConfiguration
}

An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.

type OrganizationDataSourceConfigurationsResult 

type OrganizationDataSourceConfigurationsResult struct {

	// Describes whether S3 data event logs are enabled as a data source.
	//
	// This member is required.
	S3Logs *OrganizationS3LogsConfigurationResult
}

An object that contains information on which data sources are automatically enabled for new members within the organization.

type OrganizationS3LogsConfiguration 

type OrganizationS3LogsConfiguration struct {

	// A value that contains information on whether S3 data event logs will be enabled
	// automatically as a data source for the organization.
	//
	// This member is required.
	AutoEnable *bool
}

Describes whether S3 data event logs will be automatically enabled for new members of the organization.

type OrganizationS3LogsConfigurationResult 

type OrganizationS3LogsConfigurationResult struct {

	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	//
	// This member is required.
	AutoEnable *bool
}

The current configuration of S3 data event logs as a data source for the organization.

type Owner 

type Owner struct {

	// The canonical user ID of the bucket owner. For information about locating your
	// canonical user ID see Finding Your Account Canonical User ID.
	// (https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId)
	Id *string
}

Contains information on the owner of the bucket.

type PermissionConfiguration 

type PermissionConfiguration struct {

	// Contains information about the account level permissions on the S3 bucket.
	AccountLevelPermissions *AccountLevelPermissions

	// Contains information about the bucket level permissions for the S3 bucket.
	BucketLevelPermissions *BucketLevelPermissions
}

Contains information about how permissions are configured for the S3 bucket.

type PortProbeAction 

type PortProbeAction struct {

	// A list of objects related to port probe details.
	PortProbeDetails []*PortProbeDetail

	// Indicates whether EC2 blocked the port probe to the instance, such as with an
	// ACL.
	Blocked *bool
}

Contains information about the PORT_PROBE action described in the finding.

type PortProbeDetail 

type PortProbeDetail struct {

	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails

	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails

	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
}

Contains information about the port probe details.

type PrivateIpAddressDetails 

type PrivateIpAddressDetails struct {

	// The private DNS name of the EC2 instance.
	PrivateDnsName *string

	// The private IP address of the EC2 instance.
	PrivateIpAddress *string
}

Contains other private IP address information of the EC2 instance.

type ProductCode 

type ProductCode struct {

	// The product code information.
	Code *string

	// The product code type.
	ProductType *string
}

Contains information about the product code for the EC2 instance.

type PublicAccess 

type PublicAccess struct {

	// Contains information about how permissions are configured for the S3 bucket.
	PermissionConfiguration *PermissionConfiguration

	// Describes the effective permission on this bucket after factoring all attached
	// policies.
	EffectivePermission *string
}

Describes the public access policies that apply to the S3 bucket.

type PublishingStatus 

type PublishingStatus string
const (
	PublishingStatusPending_verification                       PublishingStatus = "PENDING_VERIFICATION"
	PublishingStatusPublishing                                 PublishingStatus = "PUBLISHING"
	PublishingStatusUnable_to_publish_fix_destination_property PublishingStatus = "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY"
	PublishingStatusStopped                                    PublishingStatus = "STOPPED"
)

Enum values for PublishingStatus

type RemoteIpDetails 

type RemoteIpDetails struct {

	// The location information of the remote IP address.
	GeoLocation *GeoLocation

	// The IPv4 remote address of the connection.
	IpAddressV4 *string

	// The ISP organization information of the remote IP address.
	Organization *Organization

	// The country code of the remote IP address.
	Country *Country

	// The city information of the remote IP address.
	City *City
}

Contains information about the remote IP address of the connection.

type RemotePortDetails 

type RemotePortDetails struct {

	// The port name of the remote connection.
	PortName *string

	// The port number of the remote connection.
	Port *int32
}

Contains information about the remote port.

type Resource 

type Resource struct {

	// The type of AWS resource.
	ResourceType *string

	// Contains information on the S3 bucket.
	S3BucketDetails []*S3BucketDetail

	// The IAM access key details (IAM user information) of a user that engaged in the
	// activity that prompted GuardDuty to generate a finding.
	AccessKeyDetails *AccessKeyDetails

	// The information about the EC2 instance associated with the activity that
	// prompted GuardDuty to generate a finding.
	InstanceDetails *InstanceDetails
}

Contains information about the AWS resource associated with the activity that prompted GuardDuty to generate a finding.

type S3BucketDetail 

type S3BucketDetail struct {

	// The Amazon Resource Name (ARN) of the S3 bucket.
	Arn *string

	// The date and time the bucket was created at.
	CreatedAt *time.Time

	// Describes the public access policies that apply to the S3 bucket.
	PublicAccess *PublicAccess

	// The owner of the S3 bucket.
	Owner *Owner

	// Describes the server side encryption method used in the S3 bucket.
	DefaultServerSideEncryption *DefaultServerSideEncryption

	// The name of the S3 bucket.
	Name *string

	// Describes whether the bucket is a source or destination bucket.
	Type *string

	// All tags attached to the S3 bucket
	Tags []*Tag
}

Contains information on the S3 bucket.

type S3LogsConfiguration 

type S3LogsConfiguration struct {

	// The status of S3 data event logs as a data source.
	//
	// This member is required.
	Enable *bool
}

Describes whether S3 data event logs will be enabled as a data source.

type S3LogsConfigurationResult 

type S3LogsConfigurationResult struct {

	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	//
	// This member is required.
	Status DataSourceStatus
}

Describes whether S3 data event logs will be enabled as a data source.

type SecurityGroup 

type SecurityGroup struct {

	// The security group name of the EC2 instance.
	GroupName *string

	// The security group ID of the EC2 instance.
	GroupId *string
}

Contains information about the security groups associated with the EC2 instance.

type Service 

type Service struct {

	// The detector ID for the GuardDuty service.
	DetectorId *string

	// The name of the AWS service (GuardDuty) that generated a finding.
	ServiceName *string

	// The total count of the occurrences of this finding type.
	Count *int32

	// An evidence object associated with the service.
	Evidence *Evidence

	// The last-seen timestamp of the activity that prompted GuardDuty to generate this
	// finding.
	EventLastSeen *string

	// The resource role information for this finding.
	ResourceRole *string

	// Feedback that was submitted about the finding.
	UserFeedback *string

	// Information about the activity that is described in a finding.
	Action *Action

	// Indicates whether this finding is archived.
	Archived *bool

	// The first-seen timestamp of the activity that prompted GuardDuty to generate
	// this finding.
	EventFirstSeen *string
}

Contains additional information about the generated finding.

type SortCriteria 

type SortCriteria struct {

	// Represents the finding attribute (for example, accountId) to sort findings by.
	AttributeName *string

	// The order by which the sorted findings are to be displayed.
	OrderBy OrderBy
}

Contains information about the criteria used for sorting findings.

type Tag 

type Tag struct {

	// The EC2 instance tag value.
	Value *string

	// The EC2 instance tag key.
	Key *string
}

Contains information about a tag associated with the EC2 instance.

type ThreatIntelSetFormat 

type ThreatIntelSetFormat string
const (
	ThreatIntelSetFormatTxt         ThreatIntelSetFormat = "TXT"
	ThreatIntelSetFormatStix        ThreatIntelSetFormat = "STIX"
	ThreatIntelSetFormatOtx_csv     ThreatIntelSetFormat = "OTX_CSV"
	ThreatIntelSetFormatAlien_vault ThreatIntelSetFormat = "ALIEN_VAULT"
	ThreatIntelSetFormatProof_point ThreatIntelSetFormat = "PROOF_POINT"
	ThreatIntelSetFormatFire_eye    ThreatIntelSetFormat = "FIRE_EYE"
)

Enum values for ThreatIntelSetFormat

type ThreatIntelSetStatus 

type ThreatIntelSetStatus string
const (
	ThreatIntelSetStatusInactive       ThreatIntelSetStatus = "INACTIVE"
	ThreatIntelSetStatusActivating     ThreatIntelSetStatus = "ACTIVATING"
	ThreatIntelSetStatusActive         ThreatIntelSetStatus = "ACTIVE"
	ThreatIntelSetStatusDeactivating   ThreatIntelSetStatus = "DEACTIVATING"
	ThreatIntelSetStatusError          ThreatIntelSetStatus = "ERROR"
	ThreatIntelSetStatusDelete_pending ThreatIntelSetStatus = "DELETE_PENDING"
	ThreatIntelSetStatusDeleted        ThreatIntelSetStatus = "DELETED"
)

Enum values for ThreatIntelSetStatus

type ThreatIntelligenceDetail 

type ThreatIntelligenceDetail struct {

	// A list of names of the threats in the threat intelligence list that triggered
	// the finding.
	ThreatNames []*string

	// The name of the threat intelligence list that triggered the finding.
	ThreatListName *string
}

An instance of a threat intelligence detail that constitutes evidence for the finding.

type Total 

type Total struct {

	// The currency unit that the amount is given in.
	Unit *string

	// The total usage.
	Amount *string
}

Contains the total usage with the corresponding currency unit for that value.

type UnprocessedAccount 

type UnprocessedAccount struct {

	// A reason why the account hasn't been processed.
	//
	// This member is required.
	Result *string

	// The AWS account ID.
	//
	// This member is required.
	AccountId *string
}

Contains information about the accounts that weren't processed.

type UsageAccountResult 

type UsageAccountResult struct {

	// The Account ID that generated usage.
	AccountId *string

	// Represents the total of usage for the Account ID.
	Total *Total
}

Contains information on the total of usage based on account IDs.

type UsageCriteria 

type UsageCriteria struct {

	// The data sources to aggregate usage statistics from.
	//
	// This member is required.
	DataSources []DataSource

	// The account IDs to aggregate usage statistics from.
	AccountIds []*string

	// The resources to aggregate usage statistics from. Only accepts exact resource
	// names.
	Resources []*string
}

Contains information about the criteria used to query usage statistics.

type UsageDataSourceResult 

type UsageDataSourceResult struct {

	// Represents the total of usage for the specified data source.
	Total *Total

	// The data source type that generated usage.
	DataSource DataSource
}

Contains information on the result of usage based on data source type.

type UsageResourceResult 

type UsageResourceResult struct {

	// Represents the sum total of usage for the specified resource type.
	Total *Total

	// The AWS resource that generated usage.
	Resource *string
}

Contains information on the sum of usage based on an AWS resource.

type UsageStatisticType 

type UsageStatisticType string
const (
	UsageStatisticTypeSum_by_account     UsageStatisticType = "SUM_BY_ACCOUNT"
	UsageStatisticTypeSum_by_data_source UsageStatisticType = "SUM_BY_DATA_SOURCE"
	UsageStatisticTypeSum_by_resource    UsageStatisticType = "SUM_BY_RESOURCE"
	UsageStatisticTypeTop_resources      UsageStatisticType = "TOP_RESOURCES"
)

Enum values for UsageStatisticType

type UsageStatistics 

type UsageStatistics struct {

	// Lists the top 50 resources that have generated the most GuardDuty usage, in
	// order from most to least expensive.
	TopResources []*UsageResourceResult

	// The usage statistic sum organized by on data source.
	SumByDataSource []*UsageDataSourceResult

	// The usage statistic sum organized by resource.
	SumByResource []*UsageResourceResult

	// The usage statistic sum organized by account ID.
	SumByAccount []*UsageAccountResult
}

Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.