LISTINDICATORS()`¶

About ListIndicators¶

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Method Signature¶

METHODS /AWS1/IF_DET~LISTINDICATORS
  IMPORTING
    !IV_GRAPHARN TYPE /AWS1/DETGRAPHARN OPTIONAL
    !IV_INVESTIGATIONID TYPE /AWS1/DETINVESTIGATIONID OPTIONAL
    !IV_INDICATORTYPE TYPE /AWS1/DETINDICATORTYPE OPTIONAL
    !IV_NEXTTOKEN TYPE /AWS1/DETAIPAGINATIONTOKEN OPTIONAL
    !IV_MAXRESULTS TYPE /AWS1/DETMAXRESULTS OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_detlistindicatorsrsp
  RAISING
    /AWS1/CX_DETACCESSDENIEDEX
    /AWS1/CX_DETINTERNALSERVEREX
    /AWS1/CX_DETRESOURCENOTFOUNDEX
    /AWS1/CX_DETTOOMANYREQUESTSEX
    /AWS1/CX_DETVALIDATIONEX
    /AWS1/CX_DETCLIENTEXC
    /AWS1/CX_DETSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_grapharn` `TYPE /AWS1/DETGRAPHARN` `/AWS1/DETGRAPHARN`¶

The Amazon Resource Name (ARN) of the behavior graph.

`iv_investigationid` `TYPE /AWS1/DETINVESTIGATIONID` `/AWS1/DETINVESTIGATIONID`¶

The investigation ID of the investigation report.

Optional arguments:¶

`iv_indicatortype` `TYPE /AWS1/DETINDICATORTYPE` `/AWS1/DETINDICATORTYPE`¶

For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations.

`iv_nexttoken` `TYPE /AWS1/DETAIPAGINATIONTOKEN` `/AWS1/DETAIPAGINATIONTOKEN`¶

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

`iv_maxresults` `TYPE /AWS1/DETMAXRESULTS` `/AWS1/DETMAXRESULTS`¶

Lists the maximum number of indicators in a page.

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_detlistindicatorsrsp` `/AWS1/CL_DETLISTINDICATORSRSP`¶

Domain /AWS1/RT_ACCOUNT_ID

Primitive Type NUMC

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->listindicators(
  iv_grapharn = |string|
  iv_indicatortype = |string|
  iv_investigationid = |string|
  iv_maxresults = 123
  iv_nexttoken = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_grapharn = lo_result->get_grapharn( ).
  lv_investigationid = lo_result->get_investigationid( ).
  lv_aipaginationtoken = lo_result->get_nexttoken( ).
  LOOP AT lo_result->get_indicators( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_indicatortype = lo_row_1->get_indicatortype( ).
      lo_indicatordetail = lo_row_1->get_indicatordetail( ).
      IF lo_indicatordetail IS NOT INITIAL.
        lo_ttpsobserveddetail = lo_indicatordetail->get_ttpsobserveddetail( ).
        IF lo_ttpsobserveddetail IS NOT INITIAL.
          lv_tactic = lo_ttpsobserveddetail->get_tactic( ).
          lv_technique = lo_ttpsobserveddetail->get_technique( ).
          lv_procedure = lo_ttpsobserveddetail->get_procedure( ).
          lv_ipaddress = lo_ttpsobserveddetail->get_ipaddress( ).
          lv_apiname = lo_ttpsobserveddetail->get_apiname( ).
          lv_apisuccesscount = lo_ttpsobserveddetail->get_apisuccesscount( ).
          lv_apifailurecount = lo_ttpsobserveddetail->get_apifailurecount( ).
        ENDIF.
        lo_impossibletraveldetail = lo_indicatordetail->get_impossibletraveldetail( ).
        IF lo_impossibletraveldetail IS NOT INITIAL.
          lv_ipaddress = lo_impossibletraveldetail->get_startingipaddress( ).
          lv_ipaddress = lo_impossibletraveldetail->get_endingipaddress( ).
          lv_location = lo_impossibletraveldetail->get_startinglocation( ).
          lv_location = lo_impossibletraveldetail->get_endinglocation( ).
          lv_hourlytimedelta = lo_impossibletraveldetail->get_hourlytimedelta( ).
        ENDIF.
        lo_flaggedipaddressdetail = lo_indicatordetail->get_flaggedipaddressdetail( ).
        IF lo_flaggedipaddressdetail IS NOT INITIAL.
          lv_ipaddress = lo_flaggedipaddressdetail->get_ipaddress( ).
          lv_reason = lo_flaggedipaddressdetail->get_reason( ).
        ENDIF.
        lo_newgeolocationdetail = lo_indicatordetail->get_newgeolocationdetail( ).
        IF lo_newgeolocationdetail IS NOT INITIAL.
          lv_location = lo_newgeolocationdetail->get_location( ).
          lv_ipaddress = lo_newgeolocationdetail->get_ipaddress( ).
          lv_isnewforentireaccount = lo_newgeolocationdetail->get_isnewforentireaccount( ).
        ENDIF.
        lo_newasodetail = lo_indicatordetail->get_newasodetail( ).
        IF lo_newasodetail IS NOT INITIAL.
          lv_aso = lo_newasodetail->get_aso( ).
          lv_isnewforentireaccount = lo_newasodetail->get_isnewforentireaccount( ).
        ENDIF.
        lo_newuseragentdetail = lo_indicatordetail->get_newuseragentdetail( ).
        IF lo_newuseragentdetail IS NOT INITIAL.
          lv_useragent = lo_newuseragentdetail->get_useragent( ).
          lv_isnewforentireaccount = lo_newuseragentdetail->get_isnewforentireaccount( ).
        ENDIF.
        lo_relatedfindingdetail = lo_indicatordetail->get_relatedfindingdetail( ).
        IF lo_relatedfindingdetail IS NOT INITIAL.
          lv_entityarn = lo_relatedfindingdetail->get_arn( ).
          lv_type = lo_relatedfindingdetail->get_type( ).
          lv_ipaddress = lo_relatedfindingdetail->get_ipaddress( ).
        ENDIF.
        lo_relatedfindinggroupdeta = lo_indicatordetail->get_relatedfndggroupdetail( ).
        IF lo_relatedfindinggroupdeta IS NOT INITIAL.
          lv_id = lo_relatedfindinggroupdeta->get_id( ).
        ENDIF.
      ENDIF.
    ENDIF.
  ENDLOOP.
ENDIF.

/AWS1/IF_DET=>LISTINDICATORS()¶