# ActorSession
<a name="API_ActorSession"></a>

 Contains information about the authenticated session used by the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Amazon Security Hub CSPM, you must have GuardDuty enabled. For more information, see [GuardDuty Extended Threat Detection ](https://docs.amazonaws.cn/guardduty/latest/ug/guardduty-extended-threat-detection.html) in the *Amazon GuardDuty User Guide*.

## Contents
<a name="API_ActorSession_Contents"></a>

 ** CreatedTime **   <a name="securityhub-Type-ActorSession-CreatedTime"></a>
The timestamp for when the session was created.   
In Amazon CloudTrail, you can find this value as `userIdentity.sessionContext.attributes.creationDate`.  
Type: Long  
Required: No

 ** Issuer **   <a name="securityhub-Type-ActorSession-Issuer"></a>
 The issuer of the session.   
In Amazon CloudTrail, you can find this value as `userIdentity.sessionContext.sessionIssuer.arn`.  
Type: String  
Pattern: `.*\S.*`   
Required: No

 ** MfaStatus **   <a name="securityhub-Type-ActorSession-MfaStatus"></a>
 Indicates whether multi-factor authentication (MFA) was used for authentication during the session.  
In Amazon CloudTrail, you can find this value as `userIdentity.sessionContext.attributes.mfaAuthenticated`.  
Type: String  
Valid Values: `ENABLED | DISABLED`   
Required: No

 ** Uid **   <a name="securityhub-Type-ActorSession-Uid"></a>
 Unique identifier of the session.   
Type: String  
Pattern: `.*\S.*`   
Required: No

## See Also
<a name="API_ActorSession_SeeAlso"></a>

For more information about using this API in one of the language-specific Amazon SDKs, see the following:
+  [Amazon SDK for C\$1\$1](https://docs.amazonaws.cn/goto/SdkForCpp/securityhub-2018-10-26/ActorSession) 
+  [Amazon SDK for Java V2](https://docs.amazonaws.cn/goto/SdkForJavaV2/securityhub-2018-10-26/ActorSession) 
+  [Amazon SDK for Ruby V3](https://docs.amazonaws.cn/goto/SdkForRubyV3/securityhub-2018-10-26/ActorSession)