types

type AccessDeniedException struct {
	Message *string

	ErrorCodeOverride *string

	ErrorCode_         ErrorCode
	ErrorCodeReason    *string
	SubErrorCode       ErrorCode
	SubErrorCodeReason *string
	// contains filtered or unexported fields
}

type Account struct {

	// The account identifier of the Amazon Web Services account.
	//
	// This member is required.
	AccountId *string

	// The Amazon Web Services account root user email address for the Amazon Web
	// Services account.
	//
	// This member is required.
	EmailAddress *string
	// contains filtered or unexported fields
}

type Administrator struct {

	// The Amazon Web Services account identifier of the Detective administrator
	// account for the organization.
	AccountId *string

	// The date and time when the Detective administrator account was enabled. The
	// value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	DelegationTime *time.Time

	// The ARN of the organization behavior graph.
	GraphArn *string
	// contains filtered or unexported fields
}

type ConflictException struct {
	Message *string

	ErrorCodeOverride *string
	// contains filtered or unexported fields
}

type DatasourcePackage string

type DatasourcePackageIngestDetail struct {

	// Details on which data source packages are ingested for a member account.
	DatasourcePackageIngestState DatasourcePackageIngestState

	// The date a data source package was enabled for this account
	LastIngestStateChange map[string]TimestampForCollection
	// contains filtered or unexported fields
}

type DatasourcePackageIngestState string

type DatasourcePackageUsageInfo struct {

	// Total volume of data in bytes per day ingested for a given data source package.
	VolumeUsageInBytes *int64

	// The data and time when the member account data volume was last updated. The
	// value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	VolumeUsageUpdateTime *time.Time
	// contains filtered or unexported fields
}

type DateFilter struct {

	// A timestamp representing the end date of the time period until when data is
	// filtered, including the end date.
	//
	// This member is required.
	EndInclusive *time.Time

	// A timestamp representing the start of the time period from when data is
	// filtered, including the start date.
	//
	// This member is required.
	StartInclusive *time.Time
	// contains filtered or unexported fields
}

type EntityType string

type ErrorCode string

type Field string

type FilterCriteria struct {

	// Filter the investigation results based on when the investigation was created.
	CreatedTime *DateFilter

	// Filter the investigation results based on the Amazon Resource Name (ARN) of the
	// entity.
	EntityArn *StringFilter

	// Filter the investigation results based on the severity.
	Severity *StringFilter

	// Filter the investigation results based on the state.
	State *StringFilter

	// Filter the investigation results based on the status.
	Status *StringFilter
	// contains filtered or unexported fields
}

type FlaggedIpAddressDetail struct {

	// IP address of the suspicious entity.
	IpAddress *string

	// Details the reason the IP address was flagged as suspicious.
	Reason Reason
	// contains filtered or unexported fields
}

type Graph struct {

	// The ARN of the behavior graph.
	Arn *string

	// The date and time that the behavior graph was created. The value is an ISO8601
	// formatted string. For example, 2021-08-18T16:35:56.284Z .
	CreatedTime *time.Time
	// contains filtered or unexported fields
}

type ImpossibleTravelDetail struct {

	// IP address where the resource was last used in the impossible travel.
	EndingIpAddress *string

	// Location where the resource was last used in the impossible travel.
	EndingLocation *string

	// Returns the time difference between the first and last timestamp the resource
	// was used.
	HourlyTimeDelta *int32

	// IP address where the resource was first used in the impossible travel.
	StartingIpAddress *string

	// Location where the resource was first used in the impossible travel.
	StartingLocation *string
	// contains filtered or unexported fields
}

type Indicator struct {

	// Details about the indicators of compromise that are used to determine if a
	// resource is involved in a security incident. An indicator of compromise (IOC) is
	// an artifact observed in or on a network, system, or environment that can (with a
	// high level of confidence) identify malicious activity or a security incident.
	IndicatorDetail *IndicatorDetail

	// The type of indicator.
	IndicatorType IndicatorType
	// contains filtered or unexported fields
}

type IndicatorDetail struct {

	// Suspicious IP addresses that are flagged, which indicates critical or severe
	// threats based on threat intelligence by Detective. This indicator is derived
	// from Amazon Web Services threat intelligence.
	FlaggedIpAddressDetail *FlaggedIpAddressDetail

	// Identifies unusual and impossible user activity for an account.
	ImpossibleTravelDetail *ImpossibleTravelDetail

	// Contains details about the new Autonomous System Organization (ASO).
	NewAsoDetail *NewAsoDetail

	// Contains details about the new geographic location.
	NewGeolocationDetail *NewGeolocationDetail

	// Contains details about the new user agent.
	NewUserAgentDetail *NewUserAgentDetail

	// Contains details about related findings.
	RelatedFindingDetail *RelatedFindingDetail

	// Contains details about related finding groups.
	RelatedFindingGroupDetail *RelatedFindingGroupDetail

	// Details about the indicator of compromise.
	TTPsObservedDetail *TTPsObservedDetail
	// contains filtered or unexported fields
}

type IndicatorType string

type InternalServerException struct {
	Message *string

	ErrorCodeOverride *string
	// contains filtered or unexported fields
}

type InvestigationDetail struct {

	// The time stamp of the creation time of the investigation report. The value is
	// an UTC ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	CreatedTime *time.Time

	// The unique Amazon Resource Name (ARN) of the IAM user and IAM role.
	EntityArn *string

	// Type of entity. For example, Amazon Web Services accounts, such as IAM user and
	// role.
	EntityType EntityType

	// The investigation ID of the investigation report.
	InvestigationId *string

	// Severity based on the likelihood and impact of the indicators of compromise
	// discovered in the investigation.
	Severity Severity

	// The current state of the investigation. An archived investigation indicates you
	// have completed reviewing the investigation.
	State State

	// Status based on the completion status of the investigation.
	Status Status
	// contains filtered or unexported fields
}

type InvitationType string

type MemberDetail struct {

	// The Amazon Web Services account identifier for the member account.
	AccountId *string

	// The Amazon Web Services account identifier of the administrator account for the
	// behavior graph.
	AdministratorId *string

	// The state of a data source package for the behavior graph.
	DatasourcePackageIngestStates map[string]DatasourcePackageIngestState

	// For member accounts with a status of ACCEPTED_BUT_DISABLED , the reason that the
	// member account is not enabled. The reason can have one of the following values:
	//   - VOLUME_TOO_HIGH - Indicates that adding the member account would cause the
	//   data volume for the behavior graph to be too high.
	//   - VOLUME_UNKNOWN - Indicates that Detective is unable to verify the data
	//   volume for the member account. This is usually because the member account is not
	//   enrolled in Amazon GuardDuty.
	DisabledReason MemberDisabledReason

	// The Amazon Web Services account root user email address for the member account.
	EmailAddress *string

	// The ARN of the behavior graph.
	GraphArn *string

	// The type of behavior graph membership. For an organization account in the
	// organization behavior graph, the type is ORGANIZATION . For an account that was
	// invited to a behavior graph, the type is INVITATION .
	InvitationType InvitationType

	// For invited accounts, the date and time that Detective sent the invitation to
	// the account. The value is an ISO8601 formatted string. For example,
	// 2021-08-18T16:35:56.284Z .
	InvitedTime *time.Time

	// The Amazon Web Services account identifier of the administrator account for the
	// behavior graph.
	//
	// Deprecated: This property is deprecated. Use AdministratorId instead.
	MasterId *string

	// The member account data volume as a percentage of the maximum allowed data
	// volume. 0 indicates 0 percent, and 100 indicates 100 percent. Note that this is
	// not the percentage of the behavior graph data volume. For example, the data
	// volume for the behavior graph is 80 GB per day. The maximum data volume is 160
	// GB per day. If the data volume for the member account is 40 GB per day, then
	// PercentOfGraphUtilization is 25. It represents 25% of the maximum allowed data
	// volume.
	//
	// Deprecated: This property is deprecated. Use VolumeUsageByDatasourcePackage
	// instead.
	PercentOfGraphUtilization *float64

	// The date and time when the graph utilization percentage was last updated. The
	// value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	//
	// Deprecated: This property is deprecated. Use VolumeUsageByDatasourcePackage
	// instead.
	PercentOfGraphUtilizationUpdatedTime *time.Time

	// The current membership status of the member account. The status can have one of
	// the following values:
	//   - INVITED - For invited accounts only. Indicates that the member was sent an
	//   invitation but has not yet responded.
	//   - VERIFICATION_IN_PROGRESS - For invited accounts only, indicates that
	//   Detective is verifying that the account identifier and email address provided
	//   for the member account match. If they do match, then Detective sends the
	//   invitation. If the email address and account identifier don't match, then the
	//   member cannot be added to the behavior graph. For organization accounts in the
	//   organization behavior graph, indicates that Detective is verifying that the
	//   account belongs to the organization.
	//   - VERIFICATION_FAILED - For invited accounts only. Indicates that the account
	//   and email address provided for the member account do not match, and Detective
	//   did not send an invitation to the account.
	//   - ENABLED - Indicates that the member account currently contributes data to
	//   the behavior graph. For invited accounts, the member account accepted the
	//   invitation. For organization accounts in the organization behavior graph, the
	//   Detective administrator account enabled the organization account as a member
	//   account.
	//   - ACCEPTED_BUT_DISABLED - The account accepted the invitation, or was enabled
	//   by the Detective administrator account, but is prevented from contributing data
	//   to the behavior graph. DisabledReason provides the reason why the member
	//   account is not enabled.
	// Invited accounts that declined an invitation or that were removed from the
	// behavior graph are not included. In the organization behavior graph,
	// organization accounts that the Detective administrator account did not enable
	// are not included.
	Status MemberStatus

	// The date and time that the member account was last updated. The value is an
	// ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	UpdatedTime *time.Time

	// Details on the volume of usage for each data source package in a behavior graph.
	VolumeUsageByDatasourcePackage map[string]DatasourcePackageUsageInfo

	// The data volume in bytes per day for the member account.
	//
	// Deprecated: This property is deprecated. Use VolumeUsageByDatasourcePackage
	// instead.
	VolumeUsageInBytes *int64

	// The data and time when the member account data volume was last updated. The
	// value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	//
	// Deprecated: This property is deprecated. Use VolumeUsageByDatasourcePackage
	// instead.
	VolumeUsageUpdatedTime *time.Time
	// contains filtered or unexported fields
}

type MemberDisabledReason string

type MemberStatus string

type MembershipDatasources struct {

	// The account identifier of the Amazon Web Services account.
	AccountId *string

	// Details on when a data source package was added to a behavior graph.
	DatasourcePackageIngestHistory map[string]map[string]TimestampForCollection

	// The ARN of the organization behavior graph.
	GraphArn *string
	// contains filtered or unexported fields
}

type NewAsoDetail struct {

	// Details about the new Autonomous System Organization (ASO).
	Aso *string

	// Checks if the Autonomous System Organization (ASO) is new for the entire
	// account.
	IsNewForEntireAccount bool
	// contains filtered or unexported fields
}

type NewGeolocationDetail struct {

	// IP address using which the resource was accessed.
	IpAddress *string

	// Checks if the geolocation is new for the entire account.
	IsNewForEntireAccount bool

	// Location where the resource was accessed.
	Location *string
	// contains filtered or unexported fields
}

type NewUserAgentDetail struct {

	// Checks if the user agent is new for the entire account.
	IsNewForEntireAccount bool

	// New user agent which accessed the resource.
	UserAgent *string
	// contains filtered or unexported fields
}

type Reason string

type RelatedFindingDetail struct {

	// The Amazon Resource Name (ARN) of the related finding.
	Arn *string

	// The IP address of the finding.
	IpAddress *string

	// The type of finding.
	Type *string
	// contains filtered or unexported fields
}

type RelatedFindingGroupDetail struct {

	// The unique identifier for the finding group.
	Id *string
	// contains filtered or unexported fields
}

type ResourceNotFoundException struct {
	Message *string

	ErrorCodeOverride *string
	// contains filtered or unexported fields
}

type ServiceQuotaExceededException struct {
	Message *string

	ErrorCodeOverride *string

	Resources []string
	// contains filtered or unexported fields
}

type Severity string

type SortCriteria struct {

	// Represents the Field attribute to sort investigations.
	Field Field

	// The order by which the sorted findings are displayed.
	SortOrder SortOrder
	// contains filtered or unexported fields
}

type SortOrder string

type State string

type Status string

type StringFilter struct {

	// The string filter value.
	//
	// This member is required.
	Value *string
	// contains filtered or unexported fields
}

type TTPsObservedDetail struct {

	// The total number of failed API requests.
	APIFailureCount int64

	// The name of the API where the tactics, techniques, and procedure (TTP) was
	// observed.
	APIName *string

	// The total number of successful API requests.
	APISuccessCount int64

	// The IP address where the tactics, techniques, and procedure (TTP) was observed.
	IpAddress *string

	// The procedure used, identified by the investigation.
	Procedure *string

	// The tactic used, identified by the investigation.
	Tactic *string

	// The technique used, identified by the investigation.
	Technique *string
	// contains filtered or unexported fields
}

type TimestampForCollection struct {

	// The data and time when data collection began for a source package. The value is
	// an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z .
	Timestamp *time.Time
	// contains filtered or unexported fields
}

type TooManyRequestsException struct {
	Message *string

	ErrorCodeOverride *string
	// contains filtered or unexported fields
}

type UnprocessedAccount struct {

	// The Amazon Web Services account identifier of the member account that was not
	// processed.
	AccountId *string

	// The reason that the member account request could not be processed.
	Reason *string
	// contains filtered or unexported fields
}

type UnprocessedGraph struct {

	// The ARN of the organization behavior graph.
	GraphArn *string

	// The reason data source package information could not be processed for a
	// behavior graph.
	Reason *string
	// contains filtered or unexported fields
}

type ValidationException struct {
	Message *string

	ErrorCodeOverride *string

	ErrorCode_      ErrorCode
	ErrorCodeReason *string
	// contains filtered or unexported fields
}