Values.StartInvestigationRequestSourceDetective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. StartInvestigation initiates an investigation on an entity in a behavior graph.
type nonrec t = {graphArn : GraphArn.t;The Amazon Resource Name (ARN) of the behavior graph.
*)entityArn : EntityArn.t;The unique Amazon Resource Name (ARN) of the IAM user and IAM role.
*)scopeStartTime : Timestamp.t;The data and time when the investigation began. The value is an UTC ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
*)scopeEndTime : Timestamp.t;The data and time when the investigation ended. The value is an UTC ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
*)}val make :
graphArn:GraphArn.t ->
entityArn:EntityArn.t ->
scopeStartTime:Timestamp.t ->
scopeEndTime:Timestamp.t ->
unit ->
tval to_value :
t ->
[> `Structure of
(string * [> `String of GraphArn.t | `Timestamp of Timestamp.t ]) list ]