Struct IndicatorDetail

#[non_exhaustive]
pub struct IndicatorDetail {
    pub ttps_observed_detail: Option<TtPsObservedDetail>,
    pub impossible_travel_detail: Option<ImpossibleTravelDetail>,
    pub flagged_ip_address_detail: Option<FlaggedIpAddressDetail>,
    pub new_geolocation_detail: Option<NewGeolocationDetail>,
    pub new_aso_detail: Option<NewAsoDetail>,
    pub new_user_agent_detail: Option<NewUserAgentDetail>,
    pub related_finding_detail: Option<RelatedFindingDetail>,
    pub related_finding_group_detail: Option<RelatedFindingGroupDetail>,
}

Details about the indicators of compromise which are used to determine if a resource is involved in a security incident. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

ttps_observed_detail: Option<TtPsObservedDetail>

Details about the indicator of compromise.

impossible_travel_detail: Option<ImpossibleTravelDetail>

Identifies unusual and impossible user activity for an account.

flagged_ip_address_detail: Option<FlaggedIpAddressDetail>

Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from Amazon Web Services threat intelligence.

new_geolocation_detail: Option<NewGeolocationDetail>

Contains details about the new geographic location.

new_aso_detail: Option<NewAsoDetail>

Contains details about the new Autonomous System Organization (ASO).

new_user_agent_detail: Option<NewUserAgentDetail>

Contains details about the new user agent.

related_finding_detail: Option<RelatedFindingDetail>

Contains details about related findings.

related_finding_group_detail: Option<RelatedFindingGroupDetail>

Contains details about related finding groups.

Implementations

impl IndicatorDetail

pub fn ttps_observed_detail(&self) -> Option<&TtPsObservedDetail>

Details about the indicator of compromise.

pub fn impossible_travel_detail(&self) -> Option<&ImpossibleTravelDetail>

Identifies unusual and impossible user activity for an account.

pub fn flagged_ip_address_detail(&self) -> Option<&FlaggedIpAddressDetail>

Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from Amazon Web Services threat intelligence.

pub fn new_geolocation_detail(&self) -> Option<&NewGeolocationDetail>

Contains details about the new geographic location.

pub fn new_aso_detail(&self) -> Option<&NewAsoDetail>

Contains details about the new Autonomous System Organization (ASO).

pub fn new_user_agent_detail(&self) -> Option<&NewUserAgentDetail>

Contains details about the new user agent.

pub fn related_finding_detail(&self) -> Option<&RelatedFindingDetail>

Contains details about related findings.

pub fn related_finding_group_detail(&self) -> Option<&RelatedFindingGroupDetail>

Contains details about related finding groups.

impl IndicatorDetail

pub fn builder() -> IndicatorDetailBuilder

Creates a new builder-style object to manufacture IndicatorDetail.

Trait Implementations

impl Clone for IndicatorDetail

fn clone(&self) -> IndicatorDetail

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IndicatorDetail

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for IndicatorDetail

fn eq(&self, other: &IndicatorDetail) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for IndicatorDetail