Skip to content

/AWS1/IF_GDY=>GETFINDINGSSTATISTICS()

About GetFindingsStatistics

Lists GuardDuty findings statistics for the specified detector ID.

You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Method Signature

METHODS /AWS1/IF_GDY~GETFINDINGSSTATISTICS
  IMPORTING
    !IV_DETECTORID TYPE /AWS1/GDYDETECTORID OPTIONAL
    !IT_FINDINGSTATISTICTYPES TYPE /AWS1/CL_GDYFNDSTATISTICTYPE00=>TT_FINDINGSTATISTICTYPES OPTIONAL
    !IO_FINDINGCRITERIA TYPE REF TO /AWS1/CL_GDYFINDINGCRITERIA OPTIONAL
    !IV_GROUPBY TYPE /AWS1/GDYGROUPBYTYPE OPTIONAL
    !IV_ORDERBY TYPE /AWS1/GDYORDERBY OPTIONAL
    !IV_MAXRESULTS TYPE /AWS1/GDYMAXRESULTS100 OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_gdygetfndgsstatsrsp
  RAISING
    /AWS1/CX_GDYBADREQUESTEX
    /AWS1/CX_GDYINTERNALSERVERER00
    /AWS1/CX_GDYCLIENTEXC
    /AWS1/CX_GDYSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_detectorid TYPE /AWS1/GDYDETECTORID /AWS1/GDYDETECTORID

The ID of the detector whose findings statistics you want to retrieve.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Optional arguments:

it_findingstatistictypes TYPE /AWS1/CL_GDYFNDSTATISTICTYPE00=>TT_FINDINGSTATISTICTYPES TT_FINDINGSTATISTICTYPES

The types of finding statistics to retrieve.

io_findingcriteria TYPE REF TO /AWS1/CL_GDYFINDINGCRITERIA /AWS1/CL_GDYFINDINGCRITERIA

Represents the criteria that is used for querying findings.

iv_groupby TYPE /AWS1/GDYGROUPBYTYPE /AWS1/GDYGROUPBYTYPE

Displays the findings statistics grouped by one of the listed valid values.

iv_orderby TYPE /AWS1/GDYORDERBY /AWS1/GDYORDERBY

Displays the sorted findings in the requested order. The default value of orderBy is DESC.

You can use this parameter only with the groupBy parameter.

iv_maxresults TYPE /AWS1/GDYMAXRESULTS100 /AWS1/GDYMAXRESULTS100

The maximum number of results to be returned in the response. The default value is 25.

You can use this parameter only with the groupBy parameter.

RETURNING

oo_output TYPE REF TO /aws1/cl_gdygetfndgsstatsrsp /AWS1/CL_GDYGETFNDGSSTATSRSP

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->getfindingsstatistics(
  io_findingcriteria = new /aws1/cl_gdyfindingcriteria(
    it_criterion = VALUE /aws1/cl_gdycondition=>tt_criterion(
      (
        VALUE /aws1/cl_gdycondition=>ts_criterion_maprow(
          value = new /aws1/cl_gdycondition(
            it_eq = VALUE /aws1/cl_gdyeq_w=>tt_eq(
              ( new /aws1/cl_gdyeq_w( |string| ) )
            )
            it_equals = VALUE /aws1/cl_gdyequals_w=>tt_equals(
              ( new /aws1/cl_gdyequals_w( |string| ) )
            )
            it_neq = VALUE /aws1/cl_gdyneq_w=>tt_neq(
              ( new /aws1/cl_gdyneq_w( |string| ) )
            )
            it_notequals = VALUE /aws1/cl_gdynotequals_w=>tt_notequals(
              ( new /aws1/cl_gdynotequals_w( |string| ) )
            )
            iv_greaterthan = 123
            iv_greaterthanorequal = 123
            iv_gt = 123
            iv_gte = 123
            iv_lessthan = 123
            iv_lessthanorequal = 123
            iv_lt = 123
            iv_lte = 123
          )
          key = |string|
        )
      )
    )
  )
  it_findingstatistictypes = VALUE /aws1/cl_gdyfndstatistictype00=>tt_findingstatistictypes(
    ( new /aws1/cl_gdyfndstatistictype00( |string| ) )
  )
  iv_detectorid = |string|
  iv_groupby = |string|
  iv_maxresults = 123
  iv_orderby = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lo_findingstatistics = lo_result->get_findingstatistics( ).
  IF lo_findingstatistics IS NOT INITIAL.
    LOOP AT lo_findingstatistics->get_countbyseverity( ) into ls_row.
      lv_key = ls_row-key.
      lo_value = ls_row-value.
      IF lo_value IS NOT INITIAL.
        lv_integer = lo_value->get_value( ).
      ENDIF.
    ENDLOOP.
    LOOP AT lo_findingstatistics->get_groupedbyaccount( ) into lo_row_1.
      lo_row_2 = lo_row_1.
      IF lo_row_2 IS NOT INITIAL.
        lv_string = lo_row_2->get_accountid( ).
        lv_timestamp = lo_row_2->get_lastgeneratedat( ).
        lv_integer = lo_row_2->get_totalfindings( ).
      ENDIF.
    ENDLOOP.
    LOOP AT lo_findingstatistics->get_groupedbydate( ) into lo_row_3.
      lo_row_4 = lo_row_3.
      IF lo_row_4 IS NOT INITIAL.
        lv_timestamp = lo_row_4->get_date( ).
        lv_timestamp = lo_row_4->get_lastgeneratedat( ).
        lv_double = lo_row_4->get_severity( ).
        lv_integer = lo_row_4->get_totalfindings( ).
      ENDIF.
    ENDLOOP.
    LOOP AT lo_findingstatistics->get_groupedbyfindingtype( ) into lo_row_5.
      lo_row_6 = lo_row_5.
      IF lo_row_6 IS NOT INITIAL.
        lv_string = lo_row_6->get_findingtype( ).
        lv_timestamp = lo_row_6->get_lastgeneratedat( ).
        lv_integer = lo_row_6->get_totalfindings( ).
      ENDIF.
    ENDLOOP.
    LOOP AT lo_findingstatistics->get_groupedbyresource( ) into lo_row_7.
      lo_row_8 = lo_row_7.
      IF lo_row_8 IS NOT INITIAL.
        lv_string = lo_row_8->get_accountid( ).
        lv_timestamp = lo_row_8->get_lastgeneratedat( ).
        lv_string = lo_row_8->get_resourceid( ).
        lv_string = lo_row_8->get_resourcetype( ).
        lv_integer = lo_row_8->get_totalfindings( ).
      ENDIF.
    ENDLOOP.
    LOOP AT lo_findingstatistics->get_groupedbyseverity( ) into lo_row_9.
      lo_row_10 = lo_row_9.
      IF lo_row_10 IS NOT INITIAL.
        lv_timestamp = lo_row_10->get_lastgeneratedat( ).
        lv_double = lo_row_10->get_severity( ).
        lv_integer = lo_row_10->get_totalfindings( ).
      ENDIF.
    ENDLOOP.
  ENDIF.
  lv_string = lo_result->get_nexttoken( ).
ENDIF.