securityhub/aws.sdk.kotlin.services.securityhub.model/Signal

Signal

Contains information about the signals involved in an Amazon GuardDuty Extended Threat Detection attack sequence. An attack sequence is a type of threat detected by GuardDuty. GuardDuty generates an attack sequence finding when multiple events, or signals, align to a potentially suspicious activity. When GuardDuty and Security Hub are integrated, GuardDuty sends attack sequence findings to Security Hub.

A signal can be an API activity or a finding that GuardDuty uses to detect an attack sequence finding.

Types

Builder

class Builder

Companion

object Companion

Properties

actorIds

val actorIds: List<String>?

The IDs of the threat actors involved in the signal.

count

val count: Int?

The number of times this signal was observed.

createdAt

val createdAt: Long?

The timestamp when the first finding or activity related to this signal was observed.

endpointIds

val endpointIds: List<String>?

Information about the endpoint IDs associated with this signal.

firstSeenAt

val firstSeenAt: Long?

The timestamp when the first finding or activity related to this signal was observed.

val id: String?

The identifier of the signal.

lastSeenAt

val lastSeenAt: Long?

The timestamp when the last finding or activity related to this signal was observed.

name

val name: String?

The name of the GuardDuty signal. For example, when signal type is FINDING, the signal name is the name of the finding.

productArn

val productArn: String?

The Amazon Resource Name (ARN) of the product that generated the signal.

resourceIds

val resourceIds: List<String>?

The ARN or ID of the Amazon Web Services resource associated with the signal.

severity

val severity: Double?

The severity associated with the signal. For more information about severity, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide.

signalIndicators

val signalIndicators: List<Indicator>?

Contains information about the indicators associated with the signals in this attack sequence finding. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.

title

val title: String?

The description of the GuardDuty finding.

type

val type: String?

The type of the signal used to identify an attack sequence.

updatedAt

val updatedAt: Long?

The timestamp when this signal was last observed.