Module Values.ActorSessionSource

Contains information about the authenticated session used by the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub CSPM, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Sourcetype nonrec t = {
  1. uid : NonEmptyString.t option;
    (*

    Unique identifier of the session.

    *)
  2. mfaStatus : ActorSessionMfaStatus.t option;
    (*

    Indicates whether multi-factor authentication (MFA) was used for authentication during the session. In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.mfaAuthenticated.

    *)
  3. createdTime : Long.t option;
    (*

    The timestamp for when the session was created. In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.creationDate.

    *)
  4. issuer : NonEmptyString.t option;
    (*

    The issuer of the session. In CloudTrail, you can find this value as userIdentity.sessionContext.sessionIssuer.arn.

    *)
}
Sourceval make : ?uid:??? -> ?mfaStatus:??? -> ?createdTime:??? -> ?issuer:??? -> unit -> t
Sourceval to_value : t -> [> `Structure of (string * [> `Enum of string | `Long of Long.t | `String of NonEmptyString.t ]) list ]
Sourceval to_query : t -> Awso.Client.Query.t
Sourceval of_xml : Awso.Xml.t -> t
Sourceval of_string : string -> t
Sourceval of_json : Yojson.Safe.t -> t
Sourceval to_json : t -> Yojson.Safe.t