active_violations

Creates, updates, deletes, gets or lists an active_violations resource.

Overview

Name	active_violations
Type	Resource
Id	aws.iot.active_violations

Fields

The following fields are returned by SELECT queries:

list_active_violations

Name	Datatype	Description
behavior	object	A Device Defender security profile behavior.
last_violation_time	string (date-time)	The time the most recent violation occurred.
last_violation_value	object	The value of the metric (the measurement) that caused the most recent violation.
security_profile_name	string	The security profile with the behavior is in violation. (pattern: <code>[a-zA-Z0-9:_-]+</code>)
thing_name	string	The name of the thing responsible for the active violation.
verification_state	string	The verification state of the violation (detect alarm). (FALSE_POSITIVE, BENIGN_POSITIVE, TRUE_POSITIVE, UNKNOWN)
verification_state_description	string	The description of the verification state of the violation. (pattern: <code>[^\p{Cntrl}]*</code>)
violation_event_additional_info	object	The details of a violation event.
violation_id	string	The ID of the active violation. (pattern: <code>[a-zA-Z0-9-]+</code>)
violation_start_time	string (date-time)	The time the violation started.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_active_violations	select	region	thingName, securityProfileName, behaviorCriteriaType, listSuppressedAlerts, verificationState, nextToken, maxResults	Lists the active violations for a given Device Defender security profile. Requires permission to access the ListActiveViolations action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
behaviorCriteriaType	string	The criteria for a behavior.
listSuppressedAlerts	boolean	A list of all suppressed alerts.
maxResults	integer	The maximum number of results to return at one time.
nextToken	string	The token for the next set of results.
securityProfileName	string	The name of the Device Defender security profile for which violations are listed.
thingName	string	The name of the thing whose active violations are listed.
verificationState	string	The verification state of the violation (detect alarm).

SELECT examples

list_active_violations

Lists the active violations for a given Device Defender security profile. Requires permission to access the ListActiveViolations action.

SELECT
behavior,
last_violation_time,
last_violation_value,
security_profile_name,
thing_name,
verification_state,
verification_state_description,
violation_event_additional_info,
violation_id,
violation_start_time
FROM aws.iot.active_violations
WHERE region = '{{ region }}' -- required
AND thingName = '{{ thingName }}'
AND securityProfileName = '{{ securityProfileName }}'
AND behaviorCriteriaType = '{{ behaviorCriteriaType }}'
AND listSuppressedAlerts = '{{ listSuppressedAlerts }}'
AND verificationState = '{{ verificationState }}'
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;