violation_events

Creates, updates, deletes, gets or lists a violation_events resource.

Overview

Name	violation_events
Type	Resource
Id	aws.iot.violation_events

Fields

The following fields are returned by SELECT queries:

list_violation_events

Name	Datatype	Description
behavior	object	A Device Defender security profile behavior.
metric_value	object	The value of the metric (the measurement).
security_profile_name	string	The name of the security profile whose behavior was violated. (pattern: <code>[a-zA-Z0-9:_-]+</code>)
thing_name	string	The name of the thing responsible for the violation event.
verification_state	string	The verification state of the violation (detect alarm). (FALSE_POSITIVE, BENIGN_POSITIVE, TRUE_POSITIVE, UNKNOWN)
verification_state_description	string	The description of the verification state of the violation. (pattern: <code>[^\p{Cntrl}]*</code>)
violation_event_additional_info	object	The details of a violation event.
violation_event_time	string (date-time)	The time the violation event occurred.
violation_event_type	string	The type of violation event. (in-alarm, alarm-cleared, alarm-invalidated)
violation_id	string	The ID of the violation event. (pattern: <code>[a-zA-Z0-9-]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_violation_events	select	startTime, endTime, region	thingName, securityProfileName, behaviorCriteriaType, listSuppressedAlerts, verificationState, nextToken, maxResults	Lists the Device Defender security profile violations discovered during the given time period. You can use filters to limit the results to those alerts issued for a particular security profile, behavior, or thing (device). Requires permission to access the ListViolationEvents action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
endTime	string (date-time)	The end time for the alerts to be listed.
region	string	AWS region (default: us-east-1)
startTime	string (date-time)	The start time for the alerts to be listed.
behaviorCriteriaType	string	The criteria for a behavior.
listSuppressedAlerts	boolean	A list of all suppressed alerts.
maxResults	integer	The maximum number of results to return at one time.
nextToken	string	The token for the next set of results.
securityProfileName	string	A filter to limit results to those alerts generated by the specified security profile.
thingName	string	A filter to limit results to those alerts caused by the specified thing.
verificationState	string	The verification state of the violation (detect alarm).

SELECT examples

list_violation_events

Lists the Device Defender security profile violations discovered during the given time period. You can use filters to limit the results to those alerts issued for a particular security profile, behavior, or thing (device). Requires permission to access the ListViolationEvents action.

SELECT
behavior,
metric_value,
security_profile_name,
thing_name,
verification_state,
verification_state_description,
violation_event_additional_info,
violation_event_time,
violation_event_type,
violation_id
FROM aws.iot.violation_events
WHERE startTime = '{{ startTime }}' -- required
AND endTime = '{{ endTime }}' -- required
AND region = '{{ region }}' -- required
AND thingName = '{{ thingName }}'
AND securityProfileName = '{{ securityProfileName }}'
AND behaviorCriteriaType = '{{ behaviorCriteriaType }}'
AND listSuppressedAlerts = '{{ listSuppressedAlerts }}'
AND verificationState = '{{ verificationState }}'
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;