/AWS1/CL_DETTTPSOBSERVEDDETAIL¶
Details tactics, techniques, and procedures (TTPs) used in a potential security event. Tactics are based on MITRE ATT&CK Matrix for Enterprise.
CONSTRUCTOR¶
IMPORTING¶
Optional arguments:¶
iv_tactic TYPE /AWS1/DETTACTIC /AWS1/DETTACTIC¶
The tactic used, identified by the investigation.
iv_technique TYPE /AWS1/DETTECHNIQUE /AWS1/DETTECHNIQUE¶
The technique used, identified by the investigation.
iv_procedure TYPE /AWS1/DETPROCEDURE /AWS1/DETPROCEDURE¶
The procedure used, identified by the investigation.
iv_ipaddress TYPE /AWS1/DETIPADDRESS /AWS1/DETIPADDRESS¶
The IP address where the tactics, techniques, and procedure (TTP) was observed.
iv_apiname TYPE /AWS1/DETAPINAME /AWS1/DETAPINAME¶
The name of the API where the tactics, techniques, and procedure (TTP) was observed.
iv_apisuccesscount TYPE /AWS1/DETAPISUCCESSCOUNT /AWS1/DETAPISUCCESSCOUNT¶
The total number of successful API requests.
iv_apifailurecount TYPE /AWS1/DETAPIFAILURECOUNT /AWS1/DETAPIFAILURECOUNT¶
The total number of failed API requests.
Queryable Attributes¶
Tactic¶
The tactic used, identified by the investigation.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_TACTIC() |
Getter for TACTIC, with configurable default |
ASK_TACTIC() |
Getter for TACTIC w/ exceptions if field has no value |
HAS_TACTIC() |
Determine if TACTIC has a value |
Technique¶
The technique used, identified by the investigation.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_TECHNIQUE() |
Getter for TECHNIQUE, with configurable default |
ASK_TECHNIQUE() |
Getter for TECHNIQUE w/ exceptions if field has no value |
HAS_TECHNIQUE() |
Determine if TECHNIQUE has a value |
Procedure¶
The procedure used, identified by the investigation.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_PROCEDURE() |
Getter for PROCEDURE, with configurable default |
ASK_PROCEDURE() |
Getter for PROCEDURE w/ exceptions if field has no value |
HAS_PROCEDURE() |
Determine if PROCEDURE has a value |
IpAddress¶
The IP address where the tactics, techniques, and procedure (TTP) was observed.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_IPADDRESS() |
Getter for IPADDRESS, with configurable default |
ASK_IPADDRESS() |
Getter for IPADDRESS w/ exceptions if field has no value |
HAS_IPADDRESS() |
Determine if IPADDRESS has a value |
APIName¶
The name of the API where the tactics, techniques, and procedure (TTP) was observed.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_APINAME() |
Getter for APINAME, with configurable default |
ASK_APINAME() |
Getter for APINAME w/ exceptions if field has no value |
HAS_APINAME() |
Determine if APINAME has a value |
APISuccessCount¶
The total number of successful API requests.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_APISUCCESSCOUNT() |
Getter for APISUCCESSCOUNT |
APIFailureCount¶
The total number of failed API requests.
Accessible with the following methods¶
| Method | Description |
|---|---|
GET_APIFAILURECOUNT() |
Getter for APIFAILURECOUNT |