types

package
v1.15.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 20, 2022 License: Apache-2.0 Imports: 4 Imported by: 5

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessControlList 

type AccessControlList struct {

	// A value that indicates whether public read access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicReadAccess bool

	// A value that indicates whether public write access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicWriteAccess bool
	// contains filtered or unexported fields
}

Contains information on the current access control policies for the bucket.

type AccessKeyDetails 

type AccessKeyDetails struct {

	// The access key ID of the user.
	AccessKeyId *string

	// The principal ID of the user.
	PrincipalId *string

	// The name of the user.
	UserName *string

	// The type of the user.
	UserType *string
	// contains filtered or unexported fields
}

Contains information about the access keys.

type AccountDetail 

type AccountDetail struct {

	// The member account ID.
	//
	// This member is required.
	AccountId *string

	// The email address of the member account.
	//
	// This member is required.
	Email *string
	// contains filtered or unexported fields
}

Contains information about the account.

type AccountFreeTrialInfo added in v1.14.0 

type AccountFreeTrialInfo struct {

	// The account identifier of the GuardDuty member account.
	AccountId *string

	// Describes the data source enabled for the GuardDuty member account.
	DataSources *DataSourcesFreeTrial
	// contains filtered or unexported fields
}

Provides details of the GuardDuty member account that uses a free trial service.

type AccountLevelPermissions 

type AccountLevelPermissions struct {

	// Describes the S3 Block Public Access settings of the bucket's parent account.
	BlockPublicAccess *BlockPublicAccess
	// contains filtered or unexported fields
}

Contains information about the account level permissions on the S3 bucket.

type Action 

type Action struct {

	// The GuardDuty finding activity type.
	ActionType *string

	// Information about the AWS_API_CALL action described in this finding.
	AwsApiCallAction *AwsApiCallAction

	// Information about the DNS_REQUEST action described in this finding.
	DnsRequestAction *DnsRequestAction

	// Information about the Kubernetes API call action described in this finding.
	KubernetesApiCallAction *KubernetesApiCallAction

	// Information about the NETWORK_CONNECTION action described in this finding.
	NetworkConnectionAction *NetworkConnectionAction

	// Information about the PORT_PROBE action described in this finding.
	PortProbeAction *PortProbeAction
	// contains filtered or unexported fields
}

Contains information about actions.

type AdminAccount 

type AdminAccount struct {

	// The Amazon Web Services account ID for the account.
	AdminAccountId *string

	// Indicates whether the account is enabled as the delegated administrator.
	AdminStatus AdminStatus
	// contains filtered or unexported fields
}

The account within the organization specified as the GuardDuty delegated administrator.

type AdminStatus 

type AdminStatus string
const (
	AdminStatusEnabled           AdminStatus = "ENABLED"
	AdminStatusDisableInProgress AdminStatus = "DISABLE_IN_PROGRESS"
)

Enum values for AdminStatus

func (AdminStatus) Values added in v0.29.0 

func (AdminStatus) Values() []AdminStatus

Values returns all known values for AdminStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type Administrator added in v1.14.0 

type Administrator struct {

	// The ID of the account used as the administrator account.
	AccountId *string

	// The value that is used to validate the administrator account to the member
	// account.
	InvitationId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The status of the relationship between the administrator and member accounts.
	RelationshipStatus *string
	// contains filtered or unexported fields
}

Contains information about the administrator account and invitation.

type AwsApiCallAction 

type AwsApiCallAction struct {

	// The details of the Amazon Web Services account that made the API call. This
	// field identifies the resources that were affected by this API call.
	AffectedResources map[string]string

	// The Amazon Web Services API name.
	Api *string

	// The Amazon Web Services API caller type.
	CallerType *string

	// The domain information for the Amazon Web Services API call.
	DomainDetails *DomainDetails

	// The error code of the failed Amazon Web Services API action.
	ErrorCode *string

	// The details of the Amazon Web Services account that made the API call. This
	// field appears if the call was made from outside your account.
	RemoteAccountDetails *RemoteAccountDetails

	// The remote IP information of the connection that initiated the Amazon Web
	// Services API call.
	RemoteIpDetails *RemoteIpDetails

	// The Amazon Web Services service name whose API was invoked.
	ServiceName *string

	// The agent through which the API request was made.
	UserAgent *string
	// contains filtered or unexported fields
}

Contains information about the API action.

type BadRequestException 

type BadRequestException struct {
	Message *string

	Type *string
	// contains filtered or unexported fields
}

A bad request exception object.

func (*BadRequestException) Error 

func (e *BadRequestException) Error() string

func (*BadRequestException) ErrorCode 

func (e *BadRequestException) ErrorCode() string

func (*BadRequestException) ErrorFault 

func (e *BadRequestException) ErrorFault() smithy.ErrorFault

func (*BadRequestException) ErrorMessage 

func (e *BadRequestException) ErrorMessage() string

type BlockPublicAccess 

type BlockPublicAccess struct {

	// Indicates if S3 Block Public Access is set to BlockPublicAcls.
	BlockPublicAcls bool

	// Indicates if S3 Block Public Access is set to BlockPublicPolicy.
	BlockPublicPolicy bool

	// Indicates if S3 Block Public Access is set to IgnorePublicAcls.
	IgnorePublicAcls bool

	// Indicates if S3 Block Public Access is set to RestrictPublicBuckets.
	RestrictPublicBuckets bool
	// contains filtered or unexported fields
}

Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access (https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html) for more information.

type BucketLevelPermissions 

type BucketLevelPermissions struct {

	// Contains information on how Access Control Policies are applied to the bucket.
	AccessControlList *AccessControlList

	// Contains information on which account level S3 Block Public Access settings are
	// applied to the S3 bucket.
	BlockPublicAccess *BlockPublicAccess

	// Contains information on the bucket policies for the S3 bucket.
	BucketPolicy *BucketPolicy
	// contains filtered or unexported fields
}

Contains information about the bucket level permissions for the S3 bucket.

type BucketPolicy 

type BucketPolicy struct {

	// A value that indicates whether public read access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicReadAccess bool

	// A value that indicates whether public write access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicWriteAccess bool
	// contains filtered or unexported fields
}

Contains information on the current bucket policies for the S3 bucket.

type City 

type City struct {

	// The city name of the remote IP address.
	CityName *string
	// contains filtered or unexported fields
}

Contains information about the city associated with the IP address.

type CloudTrailConfigurationResult 

type CloudTrailConfigurationResult struct {

	// Describes whether CloudTrail is enabled as a data source for the detector.
	//
	// This member is required.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Contains information on the status of CloudTrail as a data source for the detector.

type Condition 

type Condition struct {

	// Represents the equal condition to be applied to a single field when querying for
	// findings.
	//
	// Deprecated: This member has been deprecated.
	Eq []string

	// Represents an equal condition to be applied to a single field when querying for
	// findings.
	Equals []string

	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	GreaterThan int64

	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	GreaterThanOrEqual int64

	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	//
	// Deprecated: This member has been deprecated.
	Gt int32

	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	//
	// Deprecated: This member has been deprecated.
	Gte int32

	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	LessThan int64

	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	LessThanOrEqual int64

	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	//
	// Deprecated: This member has been deprecated.
	Lt int32

	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	//
	// Deprecated: This member has been deprecated.
	Lte int32

	// Represents the not equal condition to be applied to a single field when querying
	// for findings.
	//
	// Deprecated: This member has been deprecated.
	Neq []string

	// Represents a not equal condition to be applied to a single field when querying
	// for findings.
	NotEquals []string
	// contains filtered or unexported fields
}

Contains information about the condition.

type Container added in v1.11.0 

type Container struct {

	// The container runtime (such as, Docker or containerd) used to run the container.
	ContainerRuntime *string

	// Container ID.
	Id *string

	// Container image.
	Image *string

	// Part of the image name before the last slash. For example, imagePrefix for
	// public.ecr.aws/amazonlinux/amazonlinux:latest would be
	// public.ecr.aws/amazonlinux. If the image name is relative and does not have a
	// slash, this field is empty.
	ImagePrefix *string

	// Container name.
	Name *string

	// Container security context.
	SecurityContext *SecurityContext

	// Container volume mounts.
	VolumeMounts []VolumeMount
	// contains filtered or unexported fields
}

Details of a container.

type Country 

type Country struct {

	// The country code of the remote IP address.
	CountryCode *string

	// The country name of the remote IP address.
	CountryName *string
	// contains filtered or unexported fields
}

Contains information about the country where the remote IP address is located.

type CriterionKey added in v1.15.0 

type CriterionKey string
const (
	CriterionKeyEc2InstanceArn     CriterionKey = "EC2_INSTANCE_ARN"
	CriterionKeyScanId             CriterionKey = "SCAN_ID"
	CriterionKeyAccountId          CriterionKey = "ACCOUNT_ID"
	CriterionKeyGuarddutyFindingId CriterionKey = "GUARDDUTY_FINDING_ID"
	CriterionKeyScanStartTime      CriterionKey = "SCAN_START_TIME"
	CriterionKeyScanStatus         CriterionKey = "SCAN_STATUS"
)

Enum values for CriterionKey

func (CriterionKey) Values added in v1.15.0 

func (CriterionKey) Values() []CriterionKey

Values returns all known values for CriterionKey. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DNSLogsConfigurationResult 

type DNSLogsConfigurationResult struct {

	// Denotes whether DNS logs is enabled as a data source.
	//
	// This member is required.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Contains information on the status of DNS logs as a data source.

type DataSource 

type DataSource string
const (
	DataSourceFlowLogs            DataSource = "FLOW_LOGS"
	DataSourceCloudTrail          DataSource = "CLOUD_TRAIL"
	DataSourceDnsLogs             DataSource = "DNS_LOGS"
	DataSourceS3Logs              DataSource = "S3_LOGS"
	DataSourceKubernetesAuditLogs DataSource = "KUBERNETES_AUDIT_LOGS"
	DataSourceEc2MalwareScan      DataSource = "EC2_MALWARE_SCAN"
)

Enum values for DataSource

func (DataSource) Values added in v0.29.0 

func (DataSource) Values() []DataSource

Values returns all known values for DataSource. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DataSourceConfigurations 

type DataSourceConfigurations struct {

	// Describes whether any Kubernetes logs are enabled as data sources.
	Kubernetes *KubernetesConfiguration

	// Describes whether Malware Protection is enabled as a data source.
	MalwareProtection *MalwareProtectionConfiguration

	// Describes whether S3 data event logs are enabled as a data source.
	S3Logs *S3LogsConfiguration
	// contains filtered or unexported fields
}

Contains information about which data sources are enabled.

type DataSourceConfigurationsResult 

type DataSourceConfigurationsResult struct {

	// An object that contains information on the status of CloudTrail as a data
	// source.
	//
	// This member is required.
	CloudTrail *CloudTrailConfigurationResult

	// An object that contains information on the status of DNS logs as a data source.
	//
	// This member is required.
	DNSLogs *DNSLogsConfigurationResult

	// An object that contains information on the status of VPC flow logs as a data
	// source.
	//
	// This member is required.
	FlowLogs *FlowLogsConfigurationResult

	// An object that contains information on the status of S3 Data event logs as a
	// data source.
	//
	// This member is required.
	S3Logs *S3LogsConfigurationResult

	// An object that contains information on the status of all Kubernetes data
	// sources.
	Kubernetes *KubernetesConfigurationResult

	// Describes the configuration of Malware Protection data sources.
	MalwareProtection *MalwareProtectionConfigurationResult
	// contains filtered or unexported fields
}

Contains information on the status of data sources for the detector.

type DataSourceFreeTrial added in v1.14.0 

type DataSourceFreeTrial struct {

	// A value that specifies the number of days left to use each enabled data source.
	FreeTrialDaysRemaining int32
	// contains filtered or unexported fields
}

Contains information about which data sources are enabled for the GuardDuty member account.

type DataSourceStatus 

type DataSourceStatus string
const (
	DataSourceStatusEnabled  DataSourceStatus = "ENABLED"
	DataSourceStatusDisabled DataSourceStatus = "DISABLED"
)

Enum values for DataSourceStatus

func (DataSourceStatus) Values added in v0.29.0 

func (DataSourceStatus) Values() []DataSourceStatus

Values returns all known values for DataSourceStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DataSourcesFreeTrial added in v1.14.0 

type DataSourcesFreeTrial struct {

	// Describes whether any AWS CloudTrail management event logs are enabled as data
	// sources.
	CloudTrail *DataSourceFreeTrial

	// Describes whether any DNS logs are enabled as data sources.
	DnsLogs *DataSourceFreeTrial

	// Describes whether any VPC Flow logs are enabled as data sources.
	FlowLogs *DataSourceFreeTrial

	// Describes whether any Kubernetes logs are enabled as data sources.
	Kubernetes *KubernetesDataSourceFreeTrial

	// Describes whether Malware Protection is enabled as a data source.
	MalwareProtection *MalwareProtectionDataSourceFreeTrial

	// Describes whether any S3 data event logs are enabled as data sources.
	S3Logs *DataSourceFreeTrial
	// contains filtered or unexported fields
}

Contains information about which data sources are enabled for the GuardDuty member account.

type DefaultServerSideEncryption 

type DefaultServerSideEncryption struct {

	// The type of encryption used for objects within the S3 bucket.
	EncryptionType *string

	// The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the
	// bucket EncryptionType is aws:kms.
	KmsMasterKeyArn *string
	// contains filtered or unexported fields
}

Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption (https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html) for more information.

type Destination 

type Destination struct {

	// The unique ID of the publishing destination.
	//
	// This member is required.
	DestinationId *string

	// The type of resource used for the publishing destination. Currently, only Amazon
	// S3 buckets are supported.
	//
	// This member is required.
	DestinationType DestinationType

	// The status of the publishing destination.
	//
	// This member is required.
	Status PublishingStatus
	// contains filtered or unexported fields
}

Contains information about the publishing destination, including the ID, type, and status.

type DestinationProperties 

type DestinationProperties struct {

	// The ARN of the resource to publish to. To specify an S3 bucket folder use the
	// following format: arn:aws:s3:::DOC-EXAMPLE-BUCKET/myFolder/
	DestinationArn *string

	// The ARN of the KMS key to use for encryption.
	KmsKeyArn *string
	// contains filtered or unexported fields
}

Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.

type DestinationType 

type DestinationType string
const (
	DestinationTypeS3 DestinationType = "S3"
)

Enum values for DestinationType

func (DestinationType) Values added in v0.29.0 

func (DestinationType) Values() []DestinationType

Values returns all known values for DestinationType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DetectorStatus 

type DetectorStatus string
const (
	DetectorStatusEnabled  DetectorStatus = "ENABLED"
	DetectorStatusDisabled DetectorStatus = "DISABLED"
)

Enum values for DetectorStatus

func (DetectorStatus) Values added in v0.29.0 

func (DetectorStatus) Values() []DetectorStatus

Values returns all known values for DetectorStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DnsRequestAction 

type DnsRequestAction struct {

	// Indicates whether the targeted port is blocked.
	Blocked bool

	// The domain information for the API request.
	Domain *string

	// The network connection protocol observed in the activity that prompted GuardDuty
	// to generate the finding.
	Protocol *string
	// contains filtered or unexported fields
}

Contains information about the DNS_REQUEST action described in this finding.

type DomainDetails 

type DomainDetails struct {

	// The domain information for the Amazon Web Services API call.
	Domain *string
	// contains filtered or unexported fields
}

Contains information about the domain.

type EbsSnapshotPreservation added in v1.15.0 

type EbsSnapshotPreservation string
const (
	EbsSnapshotPreservationNoRetention          EbsSnapshotPreservation = "NO_RETENTION"
	EbsSnapshotPreservationRetentionWithFinding EbsSnapshotPreservation = "RETENTION_WITH_FINDING"
)

Enum values for EbsSnapshotPreservation

func (EbsSnapshotPreservation) Values added in v1.15.0 

func (EbsSnapshotPreservation) Values() []EbsSnapshotPreservation

Values returns all known values for EbsSnapshotPreservation. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type EbsVolumeDetails added in v1.15.0 

type EbsVolumeDetails struct {

	// List of EBS volumes that were scanned.
	ScannedVolumeDetails []VolumeDetail

	// List of EBS volumes that were skipped from the malware scan.
	SkippedVolumeDetails []VolumeDetail
	// contains filtered or unexported fields
}

Contains list of scanned and skipped EBS volumes with details.

type EbsVolumeScanDetails added in v1.15.0 

type EbsVolumeScanDetails struct {

	// Returns the completion date and time of the malware scan.
	ScanCompletedAt *time.Time

	// Contains a complete view providing malware scan result details.
	ScanDetections *ScanDetections

	// Unique Id of the malware scan that generated the finding.
	ScanId *string

	// Returns the start date and time of the malware scan.
	ScanStartedAt *time.Time

	// Contains list of threat intelligence sources used to detect threats.
	Sources []string

	// GuardDuty finding ID that triggered a malware scan.
	TriggerFindingId *string
	// contains filtered or unexported fields
}

Contains details from the malware scan that created a finding.

type EbsVolumesResult added in v1.15.0 

type EbsVolumesResult struct {

	// Describes whether scanning EBS volumes is enabled as a data source.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Describes the configuration of scanning EBS volumes as a data source.

type EcsClusterDetails added in v1.15.0 

type EcsClusterDetails struct {

	// The number of services that are running on the cluster in an ACTIVE state.
	ActiveServicesCount int32

	// The Amazon Resource Name (ARN) that identifies the cluster.
	Arn *string

	// The name of the ECS Cluster.
	Name *string

	// The number of container instances registered into the cluster.
	RegisteredContainerInstancesCount int32

	// The number of tasks in the cluster that are in the RUNNING state.
	RunningTasksCount int32

	// The status of the ECS cluster.
	Status *string

	// The tags of the ECS Cluster.
	Tags []Tag

	// Contains information about the details of the ECS Task.
	TaskDetails *EcsTaskDetails
	// contains filtered or unexported fields
}

Contains information about the details of the ECS Cluster.

type EcsTaskDetails added in v1.15.0 

type EcsTaskDetails struct {

	// The Amazon Resource Name (ARN) of the task.
	Arn *string

	// The containers that's associated with the task.
	Containers []Container

	// The ARN of the task definition that creates the task.
	DefinitionArn *string

	// The name of the task group that's associated with the task.
	Group *string

	// The Unix timestamp for the time when the task started.
	StartedAt *time.Time

	// Contains the tag specified when a task is started.
	StartedBy *string

	// The tags of the ECS Task.
	Tags []Tag

	// The Unix timestamp for the time when the task was created.
	TaskCreatedAt *time.Time

	// The version counter for the task.
	Version *string

	// The list of data volume definitions for the task.
	Volumes []Volume
	// contains filtered or unexported fields
}

Contains information about the task in an ECS cluster.

type EksClusterDetails added in v1.11.0 

type EksClusterDetails struct {

	// EKS cluster ARN.
	Arn *string

	// The timestamp when the EKS cluster was created.
	CreatedAt *time.Time

	// EKS cluster name.
	Name *string

	// The EKS cluster status.
	Status *string

	// The EKS cluster tags.
	Tags []Tag

	// The VPC ID to which the EKS cluster is attached.
	VpcId *string
	// contains filtered or unexported fields
}

Details about the EKS cluster involved in a Kubernetes finding.

type Evidence 

type Evidence struct {

	// A list of threat intelligence details related to the evidence.
	ThreatIntelligenceDetails []ThreatIntelligenceDetail
	// contains filtered or unexported fields
}

Contains information about the reason that the finding was generated.

type Feedback 

type Feedback string
const (
	FeedbackUseful    Feedback = "USEFUL"
	FeedbackNotUseful Feedback = "NOT_USEFUL"
)

Enum values for Feedback

func (Feedback) Values added in v0.29.0 

func (Feedback) Values() []Feedback

Values returns all known values for Feedback. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type FilterAction 

type FilterAction string
const (
	FilterActionNoop    FilterAction = "NOOP"
	FilterActionArchive FilterAction = "ARCHIVE"
)

Enum values for FilterAction

func (FilterAction) Values added in v0.29.0 

func (FilterAction) Values() []FilterAction

Values returns all known values for FilterAction. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type FilterCondition added in v1.15.0 

type FilterCondition struct {

	// Represents an equal condition to be applied to a single field when querying for
	// scan entries.
	EqualsValue *string

	// Represents a greater than condition to be applied to a single field when
	// querying for scan entries.
	GreaterThan int64

	// Represents a less than condition to be applied to a single field when querying
	// for scan entries.
	LessThan int64
	// contains filtered or unexported fields
}

Contains information about the condition.

type FilterCriteria added in v1.15.0 

type FilterCriteria struct {

	// Represents a condition that when matched will be added to the response of the
	// operation.
	FilterCriterion []FilterCriterion
	// contains filtered or unexported fields
}

Represents the criteria to be used in the filter for describing scan entries.

type FilterCriterion added in v1.15.0 

type FilterCriterion struct {

	// An enum value representing possible scan properties to match with given scan
	// entries.
	CriterionKey CriterionKey

	// Contains information about the condition.
	FilterCondition *FilterCondition
	// contains filtered or unexported fields
}

Represents a condition that when matched will be added to the response of the operation.

type Finding 

type Finding struct {

	// The ID of the account in which the finding was generated.
	//
	// This member is required.
	AccountId *string

	// The ARN of the finding.
	//
	// This member is required.
	Arn *string

	// The time and date when the finding was created.
	//
	// This member is required.
	CreatedAt *string

	// The ID of the finding.
	//
	// This member is required.
	Id *string

	// The Region where the finding was generated.
	//
	// This member is required.
	Region *string

	// Contains information about the Amazon Web Services resource associated with the
	// activity that prompted GuardDuty to generate a finding.
	//
	// This member is required.
	Resource *Resource

	// The version of the schema used for the finding.
	//
	// This member is required.
	SchemaVersion *string

	// The severity of the finding.
	//
	// This member is required.
	Severity float64

	// The type of finding.
	//
	// This member is required.
	Type *string

	// The time and date when the finding was last updated.
	//
	// This member is required.
	UpdatedAt *string

	// The confidence score for the finding.
	Confidence float64

	// The description of the finding.
	Description *string

	// The partition associated with the finding.
	Partition *string

	// Contains additional information about the generated finding.
	Service *Service

	// The title of the finding.
	Title *string
	// contains filtered or unexported fields
}

Contains information about the finding, which is generated when abnormal or suspicious activity is detected.

type FindingCriteria 

type FindingCriteria struct {

	// Represents a map of finding properties that match specified conditions and
	// values when querying findings.
	Criterion map[string]Condition
	// contains filtered or unexported fields
}

Contains information about the criteria used for querying findings.

type FindingPublishingFrequency 

type FindingPublishingFrequency string
const (
	FindingPublishingFrequencyFifteenMinutes FindingPublishingFrequency = "FIFTEEN_MINUTES"
	FindingPublishingFrequencyOneHour        FindingPublishingFrequency = "ONE_HOUR"
	FindingPublishingFrequencySixHours       FindingPublishingFrequency = "SIX_HOURS"
)

Enum values for FindingPublishingFrequency

func (FindingPublishingFrequency) Values added in v0.29.0 

func (FindingPublishingFrequency) Values() []FindingPublishingFrequency

Values returns all known values for FindingPublishingFrequency. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type FindingStatisticType 

type FindingStatisticType string
const (
	FindingStatisticTypeCountBySeverity FindingStatisticType = "COUNT_BY_SEVERITY"
)

Enum values for FindingStatisticType

func (FindingStatisticType) Values added in v0.29.0 

func (FindingStatisticType) Values() []FindingStatisticType

Values returns all known values for FindingStatisticType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type FindingStatistics 

type FindingStatistics struct {

	// Represents a map of severity to count statistics for a set of findings.
	CountBySeverity map[string]int32
	// contains filtered or unexported fields
}

Contains information about finding statistics.

type FlowLogsConfigurationResult 

type FlowLogsConfigurationResult struct {

	// Denotes whether VPC flow logs is enabled as a data source.
	//
	// This member is required.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Contains information on the status of VPC flow logs as a data source.

type GeoLocation 

type GeoLocation struct {

	// The latitude information of the remote IP address.
	Lat float64

	// The longitude information of the remote IP address.
	Lon float64
	// contains filtered or unexported fields
}

Contains information about the location of the remote IP address.

type HighestSeverityThreatDetails added in v1.15.0 

type HighestSeverityThreatDetails struct {

	// Total number of infected files with the highest severity threat detected.
	Count int32

	// Severity level of the highest severity threat detected.
	Severity *string

	// Threat name of the highest severity threat detected as part of the malware scan.
	ThreatName *string
	// contains filtered or unexported fields
}

Contains details of the highest severity threat detected during scan and number of infected files.

type HostPath added in v1.11.0 

type HostPath struct {

	// Path of the file or directory on the host that the volume maps to.
	Path *string
	// contains filtered or unexported fields
}

Represents a pre-existing file or directory on the host machine that the volume maps to.

type IamInstanceProfile 

type IamInstanceProfile struct {

	// The profile ARN of the EC2 instance.
	Arn *string

	// The profile ID of the EC2 instance.
	Id *string
	// contains filtered or unexported fields
}

Contains information about the EC2 instance profile.

type InstanceDetails 

type InstanceDetails struct {

	// The Availability Zone of the EC2 instance.
	AvailabilityZone *string

	// The profile information of the EC2 instance.
	IamInstanceProfile *IamInstanceProfile

	// The image description of the EC2 instance.
	ImageDescription *string

	// The image ID of the EC2 instance.
	ImageId *string

	// The ID of the EC2 instance.
	InstanceId *string

	// The state of the EC2 instance.
	InstanceState *string

	// The type of the EC2 instance.
	InstanceType *string

	// The launch time of the EC2 instance.
	LaunchTime *string

	// The elastic network interface information of the EC2 instance.
	NetworkInterfaces []NetworkInterface

	// The Amazon Resource Name (ARN) of the Amazon Web Services Outpost. Only
	// applicable to Amazon Web Services Outposts instances.
	OutpostArn *string

	// The platform of the EC2 instance.
	Platform *string

	// The product code of the EC2 instance.
	ProductCodes []ProductCode

	// The tags of the EC2 instance.
	Tags []Tag
	// contains filtered or unexported fields
}

Contains information about the details of an instance.

type InternalServerErrorException 

type InternalServerErrorException struct {
	Message *string

	Type *string
	// contains filtered or unexported fields
}

An internal server error exception object.

func (*InternalServerErrorException) Error 

func (e *InternalServerErrorException) Error() string

func (*InternalServerErrorException) ErrorCode 

func (e *InternalServerErrorException) ErrorCode() string

func (*InternalServerErrorException) ErrorFault 

func (e *InternalServerErrorException) ErrorFault() smithy.ErrorFault

func (*InternalServerErrorException) ErrorMessage 

func (e *InternalServerErrorException) ErrorMessage() string

type Invitation 

type Invitation struct {

	// The ID of the account that the invitation was sent from.
	AccountId *string

	// The ID of the invitation. This value is used to validate the inviter account to
	// the member account.
	InvitationId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The status of the relationship between the inviter and invitee accounts.
	RelationshipStatus *string
	// contains filtered or unexported fields
}

Contains information about the invitation to become a member account.

type IpSetFormat 

type IpSetFormat string
const (
	IpSetFormatTxt        IpSetFormat = "TXT"
	IpSetFormatStix       IpSetFormat = "STIX"
	IpSetFormatOtxCsv     IpSetFormat = "OTX_CSV"
	IpSetFormatAlienVault IpSetFormat = "ALIEN_VAULT"
	IpSetFormatProofPoint IpSetFormat = "PROOF_POINT"
	IpSetFormatFireEye    IpSetFormat = "FIRE_EYE"
)

Enum values for IpSetFormat

func (IpSetFormat) Values added in v0.29.0 

func (IpSetFormat) Values() []IpSetFormat

Values returns all known values for IpSetFormat. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type IpSetStatus 

type IpSetStatus string
const (
	IpSetStatusInactive      IpSetStatus = "INACTIVE"
	IpSetStatusActivating    IpSetStatus = "ACTIVATING"
	IpSetStatusActive        IpSetStatus = "ACTIVE"
	IpSetStatusDeactivating  IpSetStatus = "DEACTIVATING"
	IpSetStatusError         IpSetStatus = "ERROR"
	IpSetStatusDeletePending IpSetStatus = "DELETE_PENDING"
	IpSetStatusDeleted       IpSetStatus = "DELETED"
)

Enum values for IpSetStatus

func (IpSetStatus) Values added in v0.29.0 

func (IpSetStatus) Values() []IpSetStatus

Values returns all known values for IpSetStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type KubernetesApiCallAction added in v1.11.0 

type KubernetesApiCallAction struct {

	// Parameters related to the Kubernetes API call action.
	Parameters *string

	// Contains information about the remote IP address of the connection.
	RemoteIpDetails *RemoteIpDetails

	// The Kubernetes API request URI.
	RequestUri *string

	// The IP of the Kubernetes API caller and the IPs of any proxies or load balancers
	// between the caller and the API endpoint.
	SourceIps []string

	// The resulting HTTP response code of the Kubernetes API call action.
	StatusCode int32

	// The user agent of the caller of the Kubernetes API.
	UserAgent *string

	// The Kubernetes API request HTTP verb.
	Verb *string
	// contains filtered or unexported fields
}

Information about the Kubernetes API call action described in this finding.

type KubernetesAuditLogsConfiguration added in v1.11.0 

type KubernetesAuditLogsConfiguration struct {

	// The status of Kubernetes audit logs as a data source.
	//
	// This member is required.
	Enable bool
	// contains filtered or unexported fields
}

Describes whether Kubernetes audit logs are enabled as a data source.

type KubernetesAuditLogsConfigurationResult added in v1.11.0 

type KubernetesAuditLogsConfigurationResult struct {

	// A value that describes whether Kubernetes audit logs are enabled as a data
	// source.
	//
	// This member is required.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Describes whether Kubernetes audit logs are enabled as a data source.

type KubernetesConfiguration added in v1.11.0 

type KubernetesConfiguration struct {

	// The status of Kubernetes audit logs as a data source.
	//
	// This member is required.
	AuditLogs *KubernetesAuditLogsConfiguration
	// contains filtered or unexported fields
}

Describes whether any Kubernetes data sources are enabled.

type KubernetesConfigurationResult added in v1.11.0 

type KubernetesConfigurationResult struct {

	// Describes whether Kubernetes audit logs are enabled as a data source.
	//
	// This member is required.
	AuditLogs *KubernetesAuditLogsConfigurationResult
	// contains filtered or unexported fields
}

Describes whether any Kubernetes logs will be enabled as a data source.

type KubernetesDataSourceFreeTrial added in v1.14.0 

type KubernetesDataSourceFreeTrial struct {

	// Describes whether Kubernetes audit logs are enabled as a data source.
	AuditLogs *DataSourceFreeTrial
	// contains filtered or unexported fields
}

Provides details about the Kubernetes resources when it is enabled as a data source.

type KubernetesDetails added in v1.11.0 

type KubernetesDetails struct {

	// Details about the Kubernetes user involved in a Kubernetes finding.
	KubernetesUserDetails *KubernetesUserDetails

	// Details about the Kubernetes workload involved in a Kubernetes finding.
	KubernetesWorkloadDetails *KubernetesWorkloadDetails
	// contains filtered or unexported fields
}

Details about Kubernetes resources such as a Kubernetes user or workload resource involved in a Kubernetes finding.

type KubernetesUserDetails added in v1.11.0 

type KubernetesUserDetails struct {

	// The groups that include the user who called the Kubernetes API.
	Groups []string

	// The user ID of the user who called the Kubernetes API.
	Uid *string

	// The username of the user who called the Kubernetes API.
	Username *string
	// contains filtered or unexported fields
}

Details about the Kubernetes user involved in a Kubernetes finding.

type KubernetesWorkloadDetails added in v1.11.0 

type KubernetesWorkloadDetails struct {

	// Containers running as part of the Kubernetes workload.
	Containers []Container

	// Whether the hostNetwork flag is enabled for the pods included in the workload.
	HostNetwork bool

	// Kubernetes workload name.
	Name *string

	// Kubernetes namespace that the workload is part of.
	Namespace *string

	// Kubernetes workload type (e.g. Pod, Deployment, etc.).
	Type *string

	// Kubernetes workload ID.
	Uid *string

	// Volumes used by the Kubernetes workload.
	Volumes []Volume
	// contains filtered or unexported fields
}

Details about the Kubernetes workload involved in a Kubernetes finding.

type LocalIpDetails 

type LocalIpDetails struct {

	// The IPv4 local address of the connection.
	IpAddressV4 *string
	// contains filtered or unexported fields
}

Contains information about the local IP address of the connection.

type LocalPortDetails 

type LocalPortDetails struct {

	// The port number of the local connection.
	Port int32

	// The port name of the local connection.
	PortName *string
	// contains filtered or unexported fields
}

Contains information about the port for the local connection.

type MalwareProtectionConfiguration added in v1.15.0 

type MalwareProtectionConfiguration struct {

	// Describes the configuration of Malware Protection for EC2 instances with
	// findings.
	ScanEc2InstanceWithFindings *ScanEc2InstanceWithFindings
	// contains filtered or unexported fields
}

Describes whether Malware Protection will be enabled as a data source.

type MalwareProtectionConfigurationResult added in v1.15.0 

type MalwareProtectionConfigurationResult struct {

	// Describes the configuration of Malware Protection for EC2 instances with
	// findings.
	ScanEc2InstanceWithFindings *ScanEc2InstanceWithFindingsResult

	// The GuardDuty Malware Protection service role.
	ServiceRole *string
	// contains filtered or unexported fields
}

An object that contains information on the status of all Malware Protection data sources.

type MalwareProtectionDataSourceFreeTrial added in v1.15.0 

type MalwareProtectionDataSourceFreeTrial struct {

	// Describes whether Malware Protection for EC2 instances with findings is enabled
	// as a data source.
	ScanEc2InstanceWithFindings *DataSourceFreeTrial
	// contains filtered or unexported fields
}

Provides details about Malware Protection when it is enabled as a data source.

type Master 

type Master struct {

	// The ID of the account used as the administrator account.
	AccountId *string

	// The value used to validate the administrator account to the member account.
	InvitationId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string

	// The status of the relationship between the administrator and member accounts.
	RelationshipStatus *string
	// contains filtered or unexported fields
}

Contains information about the administrator account and invitation.

type Member 

type Member struct {

	// The ID of the member account.
	//
	// This member is required.
	AccountId *string

	// The email address of the member account.
	//
	// This member is required.
	Email *string

	// The administrator account ID.
	//
	// This member is required.
	MasterId *string

	// The status of the relationship between the member and the administrator.
	//
	// This member is required.
	RelationshipStatus *string

	// The last-updated timestamp of the member.
	//
	// This member is required.
	UpdatedAt *string

	// The administrator account ID.
	AdministratorId *string

	// The detector ID of the member account.
	DetectorId *string

	// The timestamp when the invitation was sent.
	InvitedAt *string
	// contains filtered or unexported fields
}

Contains information about the member account.

type MemberDataSourceConfiguration 

type MemberDataSourceConfiguration struct {

	// The account ID for the member account.
	//
	// This member is required.
	AccountId *string

	// Contains information on the status of data sources for the account.
	//
	// This member is required.
	DataSources *DataSourceConfigurationsResult
	// contains filtered or unexported fields
}

Contains information on which data sources are enabled for a member account.

type NetworkConnectionAction 

type NetworkConnectionAction struct {

	// Indicates whether EC2 blocked the network connection to your instance.
	Blocked bool

	// The network connection direction.
	ConnectionDirection *string

	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails

	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails

	// The network connection protocol.
	Protocol *string

	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails

	// The remote port information of the connection.
	RemotePortDetails *RemotePortDetails
	// contains filtered or unexported fields
}

Contains information about the NETWORK_CONNECTION action described in the finding.

type NetworkInterface 

type NetworkInterface struct {

	// A list of IPv6 addresses for the EC2 instance.
	Ipv6Addresses []string

	// The ID of the network interface.
	NetworkInterfaceId *string

	// The private DNS name of the EC2 instance.
	PrivateDnsName *string

	// The private IP address of the EC2 instance.
	PrivateIpAddress *string

	// Other private IP address information of the EC2 instance.
	PrivateIpAddresses []PrivateIpAddressDetails

	// The public DNS name of the EC2 instance.
	PublicDnsName *string

	// The public IP address of the EC2 instance.
	PublicIp *string

	// The security groups associated with the EC2 instance.
	SecurityGroups []SecurityGroup

	// The subnet ID of the EC2 instance.
	SubnetId *string

	// The VPC ID of the EC2 instance.
	VpcId *string
	// contains filtered or unexported fields
}

Contains information about the elastic network interface of the EC2 instance.

type OrderBy 

type OrderBy string
const (
	OrderByAsc  OrderBy = "ASC"
	OrderByDesc OrderBy = "DESC"
)

Enum values for OrderBy

func (OrderBy) Values added in v0.29.0 

func (OrderBy) Values() []OrderBy

Values returns all known values for OrderBy. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type Organization 

type Organization struct {

	// The Autonomous System Number (ASN) of the internet provider of the remote IP
	// address.
	Asn *string

	// The organization that registered this ASN.
	AsnOrg *string

	// The ISP information for the internet provider.
	Isp *string

	// The name of the internet provider.
	Org *string
	// contains filtered or unexported fields
}

Contains information about the ISP organization of the remote IP address.

type OrganizationDataSourceConfigurations 

type OrganizationDataSourceConfigurations struct {

	// Describes the configuration of Kubernetes data sources for new members of the
	// organization.
	Kubernetes *OrganizationKubernetesConfiguration

	// Describes the configuration of Malware Protection for new members of the
	// organization.
	MalwareProtection *OrganizationMalwareProtectionConfiguration

	// Describes whether S3 data event logs are enabled for new members of the
	// organization.
	S3Logs *OrganizationS3LogsConfiguration
	// contains filtered or unexported fields
}

An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.

type OrganizationDataSourceConfigurationsResult 

type OrganizationDataSourceConfigurationsResult struct {

	// Describes whether S3 data event logs are enabled as a data source.
	//
	// This member is required.
	S3Logs *OrganizationS3LogsConfigurationResult

	// Describes the configuration of Kubernetes data sources.
	Kubernetes *OrganizationKubernetesConfigurationResult

	// Describes the configuration of Malware Protection data source for an
	// organization.
	MalwareProtection *OrganizationMalwareProtectionConfigurationResult
	// contains filtered or unexported fields
}

An object that contains information on which data sources are automatically enabled for new members within the organization.

type OrganizationEbsVolumes added in v1.15.0 

type OrganizationEbsVolumes struct {

	// Whether scanning EBS volumes should be auto-enabled for new members joining the
	// organization.
	AutoEnable bool
	// contains filtered or unexported fields
}

Organization-wide EBS volumes scan configuration.

type OrganizationEbsVolumesResult added in v1.15.0 

type OrganizationEbsVolumesResult struct {

	// An object that contains the status of whether scanning EBS volumes should be
	// auto-enabled for new members joining the organization.
	AutoEnable bool
	// contains filtered or unexported fields
}

An object that contains information on the status of whether EBS volumes scanning will be enabled as a data source for an organization.

type OrganizationKubernetesAuditLogsConfiguration added in v1.11.0 

type OrganizationKubernetesAuditLogsConfiguration struct {

	// A value that contains information on whether Kubernetes audit logs should be
	// enabled automatically as a data source for the organization.
	//
	// This member is required.
	AutoEnable bool
	// contains filtered or unexported fields
}

Organization-wide Kubernetes audit logs configuration.

type OrganizationKubernetesAuditLogsConfigurationResult added in v1.11.0 

type OrganizationKubernetesAuditLogsConfigurationResult struct {

	// Whether Kubernetes audit logs data source should be auto-enabled for new members
	// joining the organization.
	//
	// This member is required.
	AutoEnable bool
	// contains filtered or unexported fields
}

The current configuration of Kubernetes audit logs as a data source for the organization.

type OrganizationKubernetesConfiguration added in v1.11.0 

type OrganizationKubernetesConfiguration struct {

	// Whether Kubernetes audit logs data source should be auto-enabled for new members
	// joining the organization.
	//
	// This member is required.
	AuditLogs *OrganizationKubernetesAuditLogsConfiguration
	// contains filtered or unexported fields
}

Organization-wide Kubernetes data sources configurations.

type OrganizationKubernetesConfigurationResult added in v1.11.0 

type OrganizationKubernetesConfigurationResult struct {

	// The current configuration of Kubernetes audit logs as a data source for the
	// organization.
	//
	// This member is required.
	AuditLogs *OrganizationKubernetesAuditLogsConfigurationResult
	// contains filtered or unexported fields
}

The current configuration of all Kubernetes data sources for the organization.

type OrganizationMalwareProtectionConfiguration added in v1.15.0 

type OrganizationMalwareProtectionConfiguration struct {

	// Whether Malware Protection for EC2 instances with findings should be
	// auto-enabled for new members joining the organization.
	ScanEc2InstanceWithFindings *OrganizationScanEc2InstanceWithFindings
	// contains filtered or unexported fields
}

Organization-wide Malware Protection configurations.

type OrganizationMalwareProtectionConfigurationResult added in v1.15.0 

type OrganizationMalwareProtectionConfigurationResult struct {

	// Describes the configuration for scanning EC2 instances with findings for an
	// organization.
	ScanEc2InstanceWithFindings *OrganizationScanEc2InstanceWithFindingsResult
	// contains filtered or unexported fields
}

An object that contains information on the status of all Malware Protection data source for an organization.

type OrganizationS3LogsConfiguration 

type OrganizationS3LogsConfiguration struct {

	// A value that contains information on whether S3 data event logs will be enabled
	// automatically as a data source for the organization.
	//
	// This member is required.
	AutoEnable bool
	// contains filtered or unexported fields
}

Describes whether S3 data event logs will be automatically enabled for new members of the organization.

type OrganizationS3LogsConfigurationResult 

type OrganizationS3LogsConfigurationResult struct {

	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	//
	// This member is required.
	AutoEnable bool
	// contains filtered or unexported fields
}

The current configuration of S3 data event logs as a data source for the organization.

type OrganizationScanEc2InstanceWithFindings added in v1.15.0 

type OrganizationScanEc2InstanceWithFindings struct {

	// Whether scanning EBS volumes should be auto-enabled for new members joining the
	// organization.
	EbsVolumes *OrganizationEbsVolumes
	// contains filtered or unexported fields
}

Organization-wide EC2 instances with findings scan configuration.

type OrganizationScanEc2InstanceWithFindingsResult added in v1.15.0 

type OrganizationScanEc2InstanceWithFindingsResult struct {

	// Describes the configuration for scanning EBS volumes for an organization.
	EbsVolumes *OrganizationEbsVolumesResult
	// contains filtered or unexported fields
}

An object that contains information on the status of scanning EC2 instances with findings for an organization.

type Owner 

type Owner struct {

	// The canonical user ID of the bucket owner. For information about locating your
	// canonical user ID see Finding Your Account Canonical User ID.
	// (https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId)
	Id *string
	// contains filtered or unexported fields
}

Contains information on the owner of the bucket.

type PermissionConfiguration 

type PermissionConfiguration struct {

	// Contains information about the account level permissions on the S3 bucket.
	AccountLevelPermissions *AccountLevelPermissions

	// Contains information about the bucket level permissions for the S3 bucket.
	BucketLevelPermissions *BucketLevelPermissions
	// contains filtered or unexported fields
}

Contains information about how permissions are configured for the S3 bucket.

type PortProbeAction 

type PortProbeAction struct {

	// Indicates whether EC2 blocked the port probe to the instance, such as with an
	// ACL.
	Blocked bool

	// A list of objects related to port probe details.
	PortProbeDetails []PortProbeDetail
	// contains filtered or unexported fields
}

Contains information about the PORT_PROBE action described in the finding.

type PortProbeDetail 

type PortProbeDetail struct {

	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails

	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails

	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
	// contains filtered or unexported fields
}

Contains information about the port probe details.

type PrivateIpAddressDetails 

type PrivateIpAddressDetails struct {

	// The private DNS name of the EC2 instance.
	PrivateDnsName *string

	// The private IP address of the EC2 instance.
	PrivateIpAddress *string
	// contains filtered or unexported fields
}

Contains other private IP address information of the EC2 instance.

type ProductCode 

type ProductCode struct {

	// The product code information.
	Code *string

	// The product code type.
	ProductType *string
	// contains filtered or unexported fields
}

Contains information about the product code for the EC2 instance.

type PublicAccess 

type PublicAccess struct {

	// Describes the effective permission on this bucket after factoring all attached
	// policies.
	EffectivePermission *string

	// Contains information about how permissions are configured for the S3 bucket.
	PermissionConfiguration *PermissionConfiguration
	// contains filtered or unexported fields
}

Describes the public access policies that apply to the S3 bucket.

type PublishingStatus 

type PublishingStatus string
const (
	PublishingStatusPendingVerification                   PublishingStatus = "PENDING_VERIFICATION"
	PublishingStatusPublishing                            PublishingStatus = "PUBLISHING"
	PublishingStatusUnableToPublishFixDestinationProperty PublishingStatus = "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY"
	PublishingStatusStopped                               PublishingStatus = "STOPPED"
)

Enum values for PublishingStatus

func (PublishingStatus) Values added in v0.29.0 

func (PublishingStatus) Values() []PublishingStatus

Values returns all known values for PublishingStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type RemoteAccountDetails added in v1.11.0 

type RemoteAccountDetails struct {

	// The Amazon Web Services account ID of the remote API caller.
	AccountId *string

	// Details on whether the Amazon Web Services account of the remote API caller is
	// related to your GuardDuty environment. If this value is True the API caller is
	// affiliated to your account in some way. If it is False the API caller is from
	// outside your environment.
	Affiliated bool
	// contains filtered or unexported fields
}

Contains details about the remote Amazon Web Services account that made the API call.

type RemoteIpDetails 

type RemoteIpDetails struct {

	// The city information of the remote IP address.
	City *City

	// The country code of the remote IP address.
	Country *Country

	// The location information of the remote IP address.
	GeoLocation *GeoLocation

	// The IPv4 remote address of the connection.
	IpAddressV4 *string

	// The ISP organization information of the remote IP address.
	Organization *Organization
	// contains filtered or unexported fields
}

Contains information about the remote IP address of the connection.

type RemotePortDetails 

type RemotePortDetails struct {

	// The port number of the remote connection.
	Port int32

	// The port name of the remote connection.
	PortName *string
	// contains filtered or unexported fields
}

Contains information about the remote port.

type Resource 

type Resource struct {

	// The IAM access key details (IAM user information) of a user that engaged in the
	// activity that prompted GuardDuty to generate a finding.
	AccessKeyDetails *AccessKeyDetails

	// Details of a container.
	ContainerDetails *Container

	// Contains list of scanned and skipped EBS volumes with details.
	EbsVolumeDetails *EbsVolumeDetails

	// Contains information about the details of the ECS Cluster.
	EcsClusterDetails *EcsClusterDetails

	// Details about the EKS cluster involved in a Kubernetes finding.
	EksClusterDetails *EksClusterDetails

	// The information about the EC2 instance associated with the activity that
	// prompted GuardDuty to generate a finding.
	InstanceDetails *InstanceDetails

	// Details about the Kubernetes user and workload involved in a Kubernetes finding.
	KubernetesDetails *KubernetesDetails

	// The type of Amazon Web Services resource.
	ResourceType *string

	// Contains information on the S3 bucket.
	S3BucketDetails []S3BucketDetail
	// contains filtered or unexported fields
}

Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.

type ResourceDetails added in v1.15.0 

type ResourceDetails struct {

	// InstanceArn that was scanned in the scan entry.
	InstanceArn *string
	// contains filtered or unexported fields
}

Represents the resources that were scanned in the scan entry.

type S3BucketDetail 

type S3BucketDetail struct {

	// The Amazon Resource Name (ARN) of the S3 bucket.
	Arn *string

	// The date and time the bucket was created at.
	CreatedAt *time.Time

	// Describes the server side encryption method used in the S3 bucket.
	DefaultServerSideEncryption *DefaultServerSideEncryption

	// The name of the S3 bucket.
	Name *string

	// The owner of the S3 bucket.
	Owner *Owner

	// Describes the public access policies that apply to the S3 bucket.
	PublicAccess *PublicAccess

	// All tags attached to the S3 bucket
	Tags []Tag

	// Describes whether the bucket is a source or destination bucket.
	Type *string
	// contains filtered or unexported fields
}

Contains information on the S3 bucket.

type S3LogsConfiguration 

type S3LogsConfiguration struct {

	// The status of S3 data event logs as a data source.
	//
	// This member is required.
	Enable bool
	// contains filtered or unexported fields
}

Describes whether S3 data event logs will be enabled as a data source.

type S3LogsConfigurationResult 

type S3LogsConfigurationResult struct {

	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	//
	// This member is required.
	Status DataSourceStatus
	// contains filtered or unexported fields
}

Describes whether S3 data event logs will be enabled as a data source.

type Scan added in v1.15.0 

type Scan struct {

	// The ID for the account that belongs to the scan.
	AccountId *string

	// The unique detector ID of the administrator account that the request is
	// associated with. Note that this value will be the same as the one used for
	// DetectorId if the account is an administrator.
	AdminDetectorId *string

	// List of volumes that were attached to the original instance to be scanned.
	AttachedVolumes []VolumeDetail

	// The unique ID of the detector that the request is associated with.
	DetectorId *string

	// Represents the reason for FAILED scan status.
	FailureReason *string

	// Represents the number of files that were scanned.
	FileCount int64

	// Represents the resources that were scanned in the scan entry.
	ResourceDetails *ResourceDetails

	// The timestamp of when the scan was finished.
	ScanEndTime *time.Time

	// The unique scan ID associated with a scan entry.
	ScanId *string

	// Represents the result of the scan.
	ScanResultDetails *ScanResultDetails

	// The timestamp of when the scan was triggered.
	ScanStartTime *time.Time

	// An enum value representing possible scan statuses.
	ScanStatus ScanStatus

	// Represents total bytes that were scanned.
	TotalBytes int64

	// Represents the reason the scan was triggered.
	TriggerDetails *TriggerDetails
	// contains filtered or unexported fields
}

Contains information about a malware scan.

type ScanCondition added in v1.15.0 

type ScanCondition struct {

	// Represents an mapEqual condition to be applied to a single field when triggering
	// for malware scan.
	//
	// This member is required.
	MapEquals []ScanConditionPair
	// contains filtered or unexported fields
}

Contains information about the condition.

type ScanConditionPair added in v1.15.0 

type ScanConditionPair struct {

	// Represents key in the map condition.
	//
	// This member is required.
	Key *string

	// Represents optional value in the map condition. If not specified, only key will
	// be matched.
	Value *string
	// contains filtered or unexported fields
}

Represents key, value pair to be matched against given resource property.

type ScanCriterionKey added in v1.15.0 

type ScanCriterionKey string
const (
	ScanCriterionKeyEc2InstanceTag ScanCriterionKey = "EC2_INSTANCE_TAG"
)

Enum values for ScanCriterionKey

func (ScanCriterionKey) Values added in v1.15.0 

func (ScanCriterionKey) Values() []ScanCriterionKey

Values returns all known values for ScanCriterionKey. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ScanDetections added in v1.15.0 

type ScanDetections struct {

	// Details of the highest severity threat detected during malware scan and number
	// of infected files.
	HighestSeverityThreatDetails *HighestSeverityThreatDetails

	// Total number of scanned files.
	ScannedItemCount *ScannedItemCount

	// Contains details about identified threats organized by threat name.
	ThreatDetectedByName *ThreatDetectedByName

	// Total number of infected files.
	ThreatsDetectedItemCount *ThreatsDetectedItemCount
	// contains filtered or unexported fields
}

Contains a complete view providing malware scan result details.

type ScanEc2InstanceWithFindings added in v1.15.0 

type ScanEc2InstanceWithFindings struct {

	// Describes the configuration for scanning EBS volumes as data source.
	EbsVolumes bool
	// contains filtered or unexported fields
}

Describes whether Malware Protection for EC2 instances with findings will be enabled as a data source.

type ScanEc2InstanceWithFindingsResult added in v1.15.0 

type ScanEc2InstanceWithFindingsResult struct {

	// Describes the configuration of scanning EBS volumes as a data source.
	EbsVolumes *EbsVolumesResult
	// contains filtered or unexported fields
}

An object that contains information on the status of whether Malware Protection for EC2 instances with findings will be enabled as a data source.

type ScanFilePath added in v1.15.0 

type ScanFilePath struct {

	// File name of the infected file.
	FileName *string

	// The file path of the infected file.
	FilePath *string

	// The hash value of the infected file.
	Hash *string

	// EBS volume Arn details of the infected file.
	VolumeArn *string
	// contains filtered or unexported fields
}

Contains details of infected file including name, file path and hash.

type ScanResourceCriteria added in v1.15.0 

type ScanResourceCriteria struct {

	// Represents condition that when matched will prevent a malware scan for a certain
	// resource.
	Exclude map[string]ScanCondition

	// Represents condition that when matched will allow a malware scan for a certain
	// resource.
	Include map[string]ScanCondition
	// contains filtered or unexported fields
}

Contains information about criteria used to filter resources before triggering malware scan.

type ScanResult added in v1.15.0 

type ScanResult string
const (
	ScanResultClean    ScanResult = "CLEAN"
	ScanResultInfected ScanResult = "INFECTED"
)

Enum values for ScanResult

func (ScanResult) Values added in v1.15.0 

func (ScanResult) Values() []ScanResult

Values returns all known values for ScanResult. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ScanResultDetails added in v1.15.0 

type ScanResultDetails struct {

	// An enum value representing possible scan results.
	ScanResult ScanResult
	// contains filtered or unexported fields
}

Represents the result of the scan.

type ScanStatus added in v1.15.0 

type ScanStatus string
const (
	ScanStatusRunning   ScanStatus = "RUNNING"
	ScanStatusCompleted ScanStatus = "COMPLETED"
	ScanStatusFailed    ScanStatus = "FAILED"
)

Enum values for ScanStatus

func (ScanStatus) Values added in v1.15.0 

func (ScanStatus) Values() []ScanStatus

Values returns all known values for ScanStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ScanThreatName added in v1.15.0 

type ScanThreatName struct {

	// List of infected files in EBS volume with details.
	FilePaths []ScanFilePath

	// Total number of files infected with given threat.
	ItemCount int32

	// The name of the identified threat.
	Name *string

	// Severity of threat identified as part of the malware scan.
	Severity *string
	// contains filtered or unexported fields
}

Contains files infected with the given threat providing details of malware name and severity.

type ScannedItemCount added in v1.15.0 

type ScannedItemCount struct {

	// Number of files scanned.
	Files int32

	// Total GB of files scanned for malware.
	TotalGb int32

	// Total number of scanned volumes.
	Volumes int32
	// contains filtered or unexported fields
}

Total number of scanned files.

type SecurityContext added in v1.11.0 

type SecurityContext struct {

	// Whether the container is privileged.
	Privileged bool
	// contains filtered or unexported fields
}

Container security context.

type SecurityGroup 

type SecurityGroup struct {

	// The security group ID of the EC2 instance.
	GroupId *string

	// The security group name of the EC2 instance.
	GroupName *string
	// contains filtered or unexported fields
}

Contains information about the security groups associated with the EC2 instance.

type Service 

type Service struct {

	// Information about the activity that is described in a finding.
	Action *Action

	// Contains additional information about the generated finding.
	AdditionalInfo *ServiceAdditionalInfo

	// Indicates whether this finding is archived.
	Archived bool

	// The total count of the occurrences of this finding type.
	Count int32

	// The detector ID for the GuardDuty service.
	DetectorId *string

	// Returns details from the malware scan that created a finding.
	EbsVolumeScanDetails *EbsVolumeScanDetails

	// The first-seen timestamp of the activity that prompted GuardDuty to generate
	// this finding.
	EventFirstSeen *string

	// The last-seen timestamp of the activity that prompted GuardDuty to generate this
	// finding.
	EventLastSeen *string

	// An evidence object associated with the service.
	Evidence *Evidence

	// The name of the feature that generated a finding.
	FeatureName *string

	// The resource role information for this finding.
	ResourceRole *string

	// The name of the Amazon Web Services service (GuardDuty) that generated a
	// finding.
	ServiceName *string

	// Feedback that was submitted about the finding.
	UserFeedback *string
	// contains filtered or unexported fields
}

Contains additional information about the generated finding.

type ServiceAdditionalInfo added in v1.14.0 

type ServiceAdditionalInfo struct {

	// Describes the type of the additional information.
	Type *string

	// This field specifies the value of the additional information.
	Value *string
	// contains filtered or unexported fields
}

Additional information about the generated finding.

type SortCriteria 

type SortCriteria struct {

	// Represents the finding attribute (for example, accountId) to sort findings by.
	AttributeName *string

	// The order by which the sorted findings are to be displayed.
	OrderBy OrderBy
	// contains filtered or unexported fields
}

Contains information about the criteria used for sorting findings.

type Tag 

type Tag struct {

	// The EC2 instance tag key.
	Key *string

	// The EC2 instance tag value.
	Value *string
	// contains filtered or unexported fields
}

Contains information about a tag associated with the EC2 instance.

type ThreatDetectedByName added in v1.15.0 

type ThreatDetectedByName struct {

	// Total number of infected files identified.
	ItemCount int32

	// Flag to determine if the finding contains every single infected file-path and/or
	// every threat.
	Shortened bool

	// List of identified threats with details, organized by threat name.
	ThreatNames []ScanThreatName

	// Total number of unique threats by name identified, as part of the malware scan.
	UniqueThreatNameCount int32
	// contains filtered or unexported fields
}

Contains details about identified threats organized by threat name.

type ThreatIntelSetFormat 

type ThreatIntelSetFormat string
const (
	ThreatIntelSetFormatTxt        ThreatIntelSetFormat = "TXT"
	ThreatIntelSetFormatStix       ThreatIntelSetFormat = "STIX"
	ThreatIntelSetFormatOtxCsv     ThreatIntelSetFormat = "OTX_CSV"
	ThreatIntelSetFormatAlienVault ThreatIntelSetFormat = "ALIEN_VAULT"
	ThreatIntelSetFormatProofPoint ThreatIntelSetFormat = "PROOF_POINT"
	ThreatIntelSetFormatFireEye    ThreatIntelSetFormat = "FIRE_EYE"
)

Enum values for ThreatIntelSetFormat

func (ThreatIntelSetFormat) Values added in v0.29.0 

func (ThreatIntelSetFormat) Values() []ThreatIntelSetFormat

Values returns all known values for ThreatIntelSetFormat. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ThreatIntelSetStatus 

type ThreatIntelSetStatus string
const (
	ThreatIntelSetStatusInactive      ThreatIntelSetStatus = "INACTIVE"
	ThreatIntelSetStatusActivating    ThreatIntelSetStatus = "ACTIVATING"
	ThreatIntelSetStatusActive        ThreatIntelSetStatus = "ACTIVE"
	ThreatIntelSetStatusDeactivating  ThreatIntelSetStatus = "DEACTIVATING"
	ThreatIntelSetStatusError         ThreatIntelSetStatus = "ERROR"
	ThreatIntelSetStatusDeletePending ThreatIntelSetStatus = "DELETE_PENDING"
	ThreatIntelSetStatusDeleted       ThreatIntelSetStatus = "DELETED"
)

Enum values for ThreatIntelSetStatus

func (ThreatIntelSetStatus) Values added in v0.29.0 

func (ThreatIntelSetStatus) Values() []ThreatIntelSetStatus

Values returns all known values for ThreatIntelSetStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ThreatIntelligenceDetail 

type ThreatIntelligenceDetail struct {

	// The name of the threat intelligence list that triggered the finding.
	ThreatListName *string

	// A list of names of the threats in the threat intelligence list that triggered
	// the finding.
	ThreatNames []string
	// contains filtered or unexported fields
}

An instance of a threat intelligence detail that constitutes evidence for the finding.

type ThreatsDetectedItemCount added in v1.15.0 

type ThreatsDetectedItemCount struct {

	// Total number of infected files.
	Files int32
	// contains filtered or unexported fields
}

Contains total number of infected files.

type Total 

type Total struct {

	// The total usage.
	Amount *string

	// The currency unit that the amount is given in.
	Unit *string
	// contains filtered or unexported fields
}

Contains the total usage with the corresponding currency unit for that value.

type TriggerDetails added in v1.15.0 

type TriggerDetails struct {

	// The description of the scan trigger.
	Description *string

	// The ID of the GuardDuty finding that triggered the BirdDog scan.
	GuardDutyFindingId *string
	// contains filtered or unexported fields
}

Represents the reason the scan was triggered.

type UnprocessedAccount 

type UnprocessedAccount struct {

	// The Amazon Web Services account ID.
	//
	// This member is required.
	AccountId *string

	// A reason why the account hasn't been processed.
	//
	// This member is required.
	Result *string
	// contains filtered or unexported fields
}

Contains information about the accounts that weren't processed.

type UsageAccountResult 

type UsageAccountResult struct {

	// The Account ID that generated usage.
	AccountId *string

	// Represents the total of usage for the Account ID.
	Total *Total
	// contains filtered or unexported fields
}

Contains information on the total of usage based on account IDs.

type UsageCriteria 

type UsageCriteria struct {

	// The data sources to aggregate usage statistics from.
	//
	// This member is required.
	DataSources []DataSource

	// The account IDs to aggregate usage statistics from.
	AccountIds []string

	// The resources to aggregate usage statistics from. Only accepts exact resource
	// names.
	Resources []string
	// contains filtered or unexported fields
}

Contains information about the criteria used to query usage statistics.

type UsageDataSourceResult 

type UsageDataSourceResult struct {

	// The data source type that generated usage.
	DataSource DataSource

	// Represents the total of usage for the specified data source.
	Total *Total
	// contains filtered or unexported fields
}

Contains information on the result of usage based on data source type.

type UsageResourceResult 

type UsageResourceResult struct {

	// The Amazon Web Services resource that generated usage.
	Resource *string

	// Represents the sum total of usage for the specified resource type.
	Total *Total
	// contains filtered or unexported fields
}

Contains information on the sum of usage based on an Amazon Web Services resource.

type UsageStatisticType 

type UsageStatisticType string
const (
	UsageStatisticTypeSumByAccount    UsageStatisticType = "SUM_BY_ACCOUNT"
	UsageStatisticTypeSumByDataSource UsageStatisticType = "SUM_BY_DATA_SOURCE"
	UsageStatisticTypeSumByResource   UsageStatisticType = "SUM_BY_RESOURCE"
	UsageStatisticTypeTopResources    UsageStatisticType = "TOP_RESOURCES"
)

Enum values for UsageStatisticType

func (UsageStatisticType) Values added in v0.29.0 

func (UsageStatisticType) Values() []UsageStatisticType

Values returns all known values for UsageStatisticType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type UsageStatistics 

type UsageStatistics struct {

	// The usage statistic sum organized by account ID.
	SumByAccount []UsageAccountResult

	// The usage statistic sum organized by on data source.
	SumByDataSource []UsageDataSourceResult

	// The usage statistic sum organized by resource.
	SumByResource []UsageResourceResult

	// Lists the top 50 resources that have generated the most GuardDuty usage, in
	// order from most to least expensive.
	TopResources []UsageResourceResult
	// contains filtered or unexported fields
}

Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.

type Volume added in v1.11.0 

type Volume struct {

	// Represents a pre-existing file or directory on the host machine that the volume
	// maps to.
	HostPath *HostPath

	// Volume name.
	Name *string
	// contains filtered or unexported fields
}

Volume used by the Kubernetes workload.

type VolumeDetail added in v1.15.0 

type VolumeDetail struct {

	// The device name for the EBS volume.
	DeviceName *string

	// EBS volume encryption type.
	EncryptionType *string

	// KMS key Arn used to encrypt the EBS volume.
	KmsKeyArn *string

	// Snapshot Arn of the EBS volume.
	SnapshotArn *string

	// EBS volume Arn information.
	VolumeArn *string

	// EBS volume size in GB.
	VolumeSizeInGB int32

	// The EBS volume type.
	VolumeType *string
	// contains filtered or unexported fields
}

Contains EBS volume details.

type VolumeMount added in v1.11.0 

type VolumeMount struct {

	// Volume mount path.
	MountPath *string

	// Volume mount name.
	Name *string
	// contains filtered or unexported fields
}

Container volume mount.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.