indicators

Creates, updates, deletes, gets or lists an indicators resource.

Overview

Name	indicators
Type	Resource
Id	aws.detective.indicators

Fields

The following fields are returned by SELECT queries:

list_indicators

Name	Datatype	Description
graph_arn	string	The Amazon Resource Name (ARN) of the behavior graph. (pattern: <code>^arn:aws[-\w]{0,10}?:detective:[-\w]{2,20}?:\d{12}?:graph:[abcdef\d]{32}?$</code>)
indicators	array	Lists the indicators of compromise.
investigation_id	string	The investigation ID of the investigation report. (pattern: <code>^[0-9]+$</code>)
next_token	string	Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_indicators	select	region		Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_indicators

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

SELECT
graph_arn,
indicators,
investigation_id,
next_token
FROM aws.detective.indicators
WHERE region = '{{ region }}' -- required
;