Indicator
Contains information about the indicators observed in an Amazon GuardDuty Extended Threat Detection attack sequence. Indicators include a set of signals, which can be API activities or findings that GuardDuty uses to detect an attack sequence finding. GuardDuty generates an attack sequence finding when multiple signals align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Amazon Security Hub, you must have GuardDuty and GuardDuty S3 Protection enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.
Contents
- Key
-
The name of the indicator that’s present in the attack sequence finding.
Type: String
Pattern:
.*\S.*Required: No
- Title
-
The title describing the indicator.
Type: String
Pattern:
.*\S.*Required: No
- Type
-
The type of indicator.
Type: String
Pattern:
.*\S.*Required: No
- Values
-
Values associated with each indicator key. For example, if the indicator key is
SUSPICIOUS_NETWORK, then the value will be the name of the network. If the indicator key isATTACK_TACTIC, then the value will be one of the MITRE tactics.Type: Array of strings
Pattern:
.*\S.*Required: No
See Also
For more information about using this API in one of the language-specific Amazon SDKs, see the following: