Module Values.SequenceSource

Contains information about an Amazon GuardDuty Extended Threat Detection attack sequence finding. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub CSPM, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Sourcetype nonrec t = {
  1. uid : NonEmptyString.t option;
    (*

    Unique identifier of the attack sequence.

    *)
  2. actors : ActorsList.t option;
    (*

    Provides information about the actors involved in the attack sequence.

    *)
  3. endpoints : NetworkEndpointsList.t option;
    (*

    Contains information about the network endpoints that were used in the attack sequence.

    *)
  4. signals : SignalsList.t option;
    (*

    Contains information about the signals involved in the attack sequence.

    *)
  5. sequenceIndicators : IndicatorsList.t option;
    (*

    Contains information about the indicators observed in the attack sequence. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.

    *)
}
Sourceval make : ?uid:??? -> ?actors:??? -> ?endpoints:??? -> ?signals:??? -> ?sequenceIndicators:??? -> unit -> t
Sourceval to_value : t -> [> `Structure of (string * [> `List of [> `Structure of (string * [> `Double of Double.t | `Integer of Integer.t | `List of [> `String of NonEmptyString.t | `Structure of (string * [> `List of [> `String of NonEmptyString.t ] list | `String of NonEmptyString.t ]) list ] list | `Long of Long.t | `String of NonEmptyString.t | `Structure of (string * [> `Double of Double.t | `Enum of string | `Integer of Integer.t | `Long of Long.t | `String of NonEmptyString.t | `Structure of (string * [> `String of NonEmptyString.t ]) list ]) list ]) list ] list | `String of NonEmptyString.t ]) list ]
Sourceval to_query : t -> Awso.Client.Query.t
Sourceval of_xml : Awso.Xml.t -> t
Sourceval of_string : string -> t
Sourceval of_json : Yojson.Safe.t -> t
Sourceval to_json : t -> Yojson.Safe.t