Interface GuardDutyFinding.IAdditionalInfo
(experimental) Type definition for AdditionalInfo.
Namespace: Amazon.CDK.Mixins.Preview.AWS.GuardDuty.Events
Assembly: Amazon.CDK.Mixins.Preview.dll
Syntax (csharp)
public interface GuardDutyFinding.IAdditionalInfoSyntax (vb)
Public Interface GuardDutyFinding.IAdditionalInfoRemarks
Stability: Experimental
ExampleMetadata: fixture=_generated
Examples
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
using Amazon.CDK.Mixins.Preview.AWS.GuardDuty.Events;
var additionalScannedPorts;
var unusual;
var additionalInfo = new AdditionalInfo {
AdditionalScannedPorts = new [] { additionalScannedPorts },
Anomalies = new Anomalies {
AnomalousApIs = new [] { "anomalousApIs" }
},
ApiCalls = new [] { new AdditionalInfoItem {
Count = new [] { "count" },
FirstSeen = new [] { "firstSeen" },
LastSeen = new [] { "lastSeen" },
Name = new [] { "name" }
} },
Domain = new [] { "domain" },
InBytes = new [] { "inBytes" },
LocalPort = new [] { "localPort" },
NewPolicy = new NewPolicy {
AllowUsersToChangePassword = new [] { "allowUsersToChangePassword" },
HardExpiry = new [] { "hardExpiry" },
MaxPasswordAge = new [] { "maxPasswordAge" },
MinimumPasswordLength = new [] { "minimumPasswordLength" },
PasswordReusePrevention = new [] { "passwordReusePrevention" },
RequireLowercaseCharacters = new [] { "requireLowercaseCharacters" },
RequireNumbers = new [] { "requireNumbers" },
RequireSymbols = new [] { "requireSymbols" },
RequireUppercaseCharacters = new [] { "requireUppercaseCharacters" }
},
OldPolicy = new OldPolicy {
AllowUsersToChangePassword = new [] { "allowUsersToChangePassword" },
HardExpiry = new [] { "hardExpiry" },
MaxPasswordAge = new [] { "maxPasswordAge" },
MinimumPasswordLength = new [] { "minimumPasswordLength" },
PasswordReusePrevention = new [] { "passwordReusePrevention" },
RequireLowercaseCharacters = new [] { "requireLowercaseCharacters" },
RequireNumbers = new [] { "requireNumbers" },
RequireSymbols = new [] { "requireSymbols" },
RequireUppercaseCharacters = new [] { "requireUppercaseCharacters" }
},
OutBytes = new [] { "outBytes" },
PortsScannedSample = new [] { 123 },
ProfiledBehavior = new ProfiledBehavior {
FrequentProfiledApIsAccountProfiling = new [] { "frequentProfiledApIsAccountProfiling" },
FrequentProfiledApIsUserIdentityProfiling = new [] { "frequentProfiledApIsUserIdentityProfiling" },
FrequentProfiledAsNsAccountProfiling = new [] { "frequentProfiledAsNsAccountProfiling" },
FrequentProfiledAsNsBucketProfiling = new [] { "frequentProfiledAsNsBucketProfiling" },
FrequentProfiledAsNsUserIdentityProfiling = new [] { "frequentProfiledAsNsUserIdentityProfiling" },
FrequentProfiledBucketsAccountProfiling = new [] { "frequentProfiledBucketsAccountProfiling" },
FrequentProfiledBucketsUserIdentityProfiling = new [] { "frequentProfiledBucketsUserIdentityProfiling" },
FrequentProfiledUserAgentsAccountProfiling = new [] { "frequentProfiledUserAgentsAccountProfiling" },
FrequentProfiledUserAgentsUserIdentityProfiling = new [] { "frequentProfiledUserAgentsUserIdentityProfiling" },
FrequentProfiledUserNamesAccountProfiling = new [] { "frequentProfiledUserNamesAccountProfiling" },
FrequentProfiledUserNamesBucketProfiling = new [] { "frequentProfiledUserNamesBucketProfiling" },
FrequentProfiledUserTypesAccountProfiling = new [] { "frequentProfiledUserTypesAccountProfiling" },
InfrequentProfiledApIsAccountProfiling = new [] { "infrequentProfiledApIsAccountProfiling" },
InfrequentProfiledApIsUserIdentityProfiling = new [] { "infrequentProfiledApIsUserIdentityProfiling" },
InfrequentProfiledAsNsAccountProfiling = new [] { "infrequentProfiledAsNsAccountProfiling" },
InfrequentProfiledAsNsBucketProfiling = new [] { "infrequentProfiledAsNsBucketProfiling" },
InfrequentProfiledAsNsUserIdentityProfiling = new [] { "infrequentProfiledAsNsUserIdentityProfiling" },
InfrequentProfiledBucketsAccountProfiling = new [] { "infrequentProfiledBucketsAccountProfiling" },
InfrequentProfiledBucketsUserIdentityProfiling = new [] { "infrequentProfiledBucketsUserIdentityProfiling" },
InfrequentProfiledUserAgentsAccountProfiling = new [] { "infrequentProfiledUserAgentsAccountProfiling" },
InfrequentProfiledUserAgentsUserIdentityProfiling = new [] { "infrequentProfiledUserAgentsUserIdentityProfiling" },
InfrequentProfiledUserNamesAccountProfiling = new [] { "infrequentProfiledUserNamesAccountProfiling" },
InfrequentProfiledUserNamesBucketProfiling = new [] { "infrequentProfiledUserNamesBucketProfiling" },
InfrequentProfiledUserTypesAccountProfiling = new [] { "infrequentProfiledUserTypesAccountProfiling" },
NumberOfHistoricalDailyAvgApIsBucketProfiling = new [] { "numberOfHistoricalDailyAvgApIsBucketProfiling" },
NumberOfHistoricalDailyAvgApIsBucketUserIdentityProfiling = new [] { "numberOfHistoricalDailyAvgApIsBucketUserIdentityProfiling" },
NumberOfHistoricalDailyAvgApIsUserIdentityProfiling = new [] { "numberOfHistoricalDailyAvgApIsUserIdentityProfiling" },
NumberOfHistoricalDailyMaxApIsBucketProfiling = new [] { "numberOfHistoricalDailyMaxApIsBucketProfiling" },
NumberOfHistoricalDailyMaxApIsBucketUserIdentityProfiling = new [] { "numberOfHistoricalDailyMaxApIsBucketUserIdentityProfiling" },
NumberOfHistoricalDailyMaxApIsUserIdentityProfiling = new [] { "numberOfHistoricalDailyMaxApIsUserIdentityProfiling" },
RareProfiledApIsAccountProfiling = new [] { "rareProfiledApIsAccountProfiling" },
RareProfiledApIsUserIdentityProfiling = new [] { "rareProfiledApIsUserIdentityProfiling" },
RareProfiledAsNsAccountProfiling = new [] { "rareProfiledAsNsAccountProfiling" },
RareProfiledAsNsBucketProfiling = new [] { "rareProfiledAsNsBucketProfiling" },
RareProfiledAsNsUserIdentityProfiling = new [] { "rareProfiledAsNsUserIdentityProfiling" },
RareProfiledBucketsAccountProfiling = new [] { "rareProfiledBucketsAccountProfiling" },
RareProfiledBucketsUserIdentityProfiling = new [] { "rareProfiledBucketsUserIdentityProfiling" },
RareProfiledUserAgentsAccountProfiling = new [] { "rareProfiledUserAgentsAccountProfiling" },
RareProfiledUserAgentsUserIdentityProfiling = new [] { "rareProfiledUserAgentsUserIdentityProfiling" },
RareProfiledUserNamesAccountProfiling = new [] { "rareProfiledUserNamesAccountProfiling" },
RareProfiledUserNamesBucketProfiling = new [] { "rareProfiledUserNamesBucketProfiling" },
RareProfiledUserTypesAccountProfiling = new [] { "rareProfiledUserTypesAccountProfiling" }
},
RecentCredentials = new [] { new AdditionalInfoItem1 {
AccessKeyId = new [] { "accessKeyId" },
IpAddressV4 = new [] { "ipAddressV4" },
PrincipalId = new [] { "principalId" }
} },
Sample = new [] { "sample" },
ScannedPort = new [] { "scannedPort" },
ThreatListName = new [] { "threatListName" },
ThreatName = new [] { "threatName" },
Type = new [] { "type" },
Unusual = unusual,
UnusualBehavior = new UnusualBehavior {
IsUnusualUserIdentity = new [] { "isUnusualUserIdentity" },
NumberOfPast24HoursApIsBucketProfiling = new [] { "numberOfPast24HoursApIsBucketProfiling" },
NumberOfPast24HoursApIsBucketUserIdentityProfiling = new [] { "numberOfPast24HoursApIsBucketUserIdentityProfiling" },
NumberOfPast24HoursApIsUserIdentityProfiling = new [] { "numberOfPast24HoursApIsUserIdentityProfiling" },
UnusualApIsAccountProfiling = new [] { "unusualApIsAccountProfiling" },
UnusualApIsUserIdentityProfiling = new [] { "unusualApIsUserIdentityProfiling" },
UnusualAsNsAccountProfiling = new [] { "unusualAsNsAccountProfiling" },
UnusualAsNsBucketProfiling = new [] { "unusualAsNsBucketProfiling" },
UnusualAsNsUserIdentityProfiling = new [] { "unusualAsNsUserIdentityProfiling" },
UnusualBucketsAccountProfiling = new [] { "unusualBucketsAccountProfiling" },
UnusualBucketsUserIdentityProfiling = new [] { "unusualBucketsUserIdentityProfiling" },
UnusualUserAgentsAccountProfiling = new [] { "unusualUserAgentsAccountProfiling" },
UnusualUserAgentsUserIdentityProfiling = new [] { "unusualUserAgentsUserIdentityProfiling" },
UnusualUserNamesAccountProfiling = new [] { "unusualUserNamesAccountProfiling" },
UnusualUserNamesBucketProfiling = new [] { "unusualUserNamesBucketProfiling" },
UnusualUserTypesAccountProfiling = new [] { "unusualUserTypesAccountProfiling" }
},
UnusualProtocol = new [] { "unusualProtocol" },
UserAgent = new UserAgent {
FullUserAgent = new [] { "fullUserAgent" },
UserAgentCategory = new [] { "userAgentCategory" }
},
Value = new [] { "value" }
};Synopsis
Properties
| AdditionalScannedPorts | (experimental) additionalScannedPorts property. |
| Anomalies | (experimental) anomalies property. |
| ApiCalls | (experimental) apiCalls property. |
| Domain | (experimental) domain property. |
| InBytes | (experimental) inBytes property. |
| LocalPort | (experimental) localPort property. |
| NewPolicy | (experimental) newPolicy property. |
| OldPolicy | (experimental) oldPolicy property. |
| OutBytes | (experimental) outBytes property. |
| PortsScannedSample | (experimental) portsScannedSample property. |
| ProfiledBehavior | (experimental) profiledBehavior property. |
| RecentCredentials | (experimental) recentCredentials property. |
| Sample | (experimental) sample property. |
| ScannedPort | (experimental) scannedPort property. |
| ThreatListName | (experimental) threatListName property. |
| ThreatName | (experimental) threatName property. |
| Type | (experimental) type property. |
| Unusual | (experimental) unusual property. |
| UnusualBehavior | (experimental) unusualBehavior property. |
| UnusualProtocol | (experimental) unusualProtocol property. |
| UserAgent | (experimental) userAgent property. |
| Value | (experimental) value property. |
Properties
AdditionalScannedPorts
(experimental) additionalScannedPorts property.
object[]? AdditionalScannedPorts { get; }Property Value
object[]
Remarks
Specify an array of string values to match this event if the actual value of additionalScannedPorts is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Anomalies
(experimental) anomalies property.
GuardDutyFinding.IAnomalies? Anomalies { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of anomalies is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
ApiCalls
(experimental) apiCalls property.
GuardDutyFinding.IAdditionalInfoItem[]? ApiCalls { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of apiCalls is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Domain
(experimental) domain property.
string[]? Domain { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of domain is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
InBytes
(experimental) inBytes property.
string[]? InBytes { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of inBytes is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
LocalPort
(experimental) localPort property.
string[]? LocalPort { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of localPort is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
NewPolicy
(experimental) newPolicy property.
GuardDutyFinding.INewPolicy? NewPolicy { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of newPolicy is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
OldPolicy
(experimental) oldPolicy property.
GuardDutyFinding.IOldPolicy? OldPolicy { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of oldPolicy is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
OutBytes
(experimental) outBytes property.
string[]? OutBytes { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of outBytes is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
PortsScannedSample
(experimental) portsScannedSample property.
double[]? PortsScannedSample { get; }Property Value
double[]
Remarks
Specify an array of string values to match this event if the actual value of portsScannedSample is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
ProfiledBehavior
(experimental) profiledBehavior property.
GuardDutyFinding.IProfiledBehavior? ProfiledBehavior { get; }Property Value
GuardDutyFinding.IProfiledBehavior
Remarks
Specify an array of string values to match this event if the actual value of profiledBehavior is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
RecentCredentials
(experimental) recentCredentials property.
GuardDutyFinding.IAdditionalInfoItem1[]? RecentCredentials { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of recentCredentials is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Sample
(experimental) sample property.
string[]? Sample { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of sample is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
ScannedPort
(experimental) scannedPort property.
string[]? ScannedPort { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of scannedPort is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
ThreatListName
(experimental) threatListName property.
string[]? ThreatListName { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of threatListName is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
ThreatName
(experimental) threatName property.
string[]? ThreatName { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of threatName is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Type
(experimental) type property.
string[]? Type { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of type is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Unusual
(experimental) unusual property.
object? Unusual { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of unusual is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
UnusualBehavior
(experimental) unusualBehavior property.
GuardDutyFinding.IUnusualBehavior? UnusualBehavior { get; }Property Value
GuardDutyFinding.IUnusualBehavior
Remarks
Specify an array of string values to match this event if the actual value of unusualBehavior is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
UnusualProtocol
(experimental) unusualProtocol property.
string[]? UnusualProtocol { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of unusualProtocol is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
UserAgent
(experimental) userAgent property.
GuardDutyFinding.IUserAgent? UserAgent { get; }Property Value
Remarks
Specify an array of string values to match this event if the actual value of userAgent is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental
Value
(experimental) value property.
string[]? Value { get; }Property Value
string[]
Remarks
Specify an array of string values to match this event if the actual value of value is one of the values in the array. Use one of the constructors on the aws_events.Match for more advanced matching options.
Default: - Do not filter on this field
Stability: Experimental