Builder

Information about the IDs of the threat actors involved in the signal.

The number of times this signal was observed.

The timestamp when the first finding or activity related to this signal was observed.

The description of the signal.

Information about the endpoint IDs associated with this signal.

The timestamp when the first finding or activity related to this signal was observed.

The timestamp when the last finding or activity related to this signal was observed.

The name of the signal. For example, when signal type is FINDING, the signal name is the name of the finding.

Information about the unique identifiers of the resources involved in the signal.

The severity associated with the signal. For more information about severity, see Findings severity levels in the Amazon GuardDuty User Guide.

Contains information about the indicators associated with the signals.

The type of the signal used to identify an attack sequence.

The unique identifier of the signal.

The timestamp when this signal was last observed.