RuleDetail
Contains the full details of a custom detection rule, including its detection logic.
Contents
- arn
-
The Amazon Resource Name (ARN) of the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1024.
Pattern:
arn:[a-zA-Z0-9\-]+:[a-zA-Z0-9\-]+:[a-zA-Z0-9\-]*:([0-9]*|aws):.+Required: Yes
- createdAt
-
The timestamp when the rule was created.
Type: Timestamp
Required: Yes
- dataSource
-
The data source that the rule analyzes.
Type: String
Valid Values:
CloudTrailManagementEventRequired: Yes
- definition
-
The detection logic definition for the rule.
Type: RuleDefinition object
Required: Yes
- description
-
A description of what the rule detects.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1024.
Required: Yes
- name
-
The display name of the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Required: Yes
- ruleId
-
The unique identifier for the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 100.
Pattern:
[a-z0-9]+(-[a-z0-9]+)*Required: Yes
- service
-
The AWS service associated with the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 128.
Required: Yes
- severity
-
The severity level assigned to findings generated by this rule.
Type: String
Valid Values:
CRITICAL | HIGH | MEDIUM | LOWRequired: Yes
- tactic
-
The MITRE ATT&CK tactic associated with the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Required: Yes
- technique
-
The MITRE ATT&CK technique associated with the rule.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Required: Yes
- language
-
The language used for the detection logic expression.
Type: String
Valid Values:
SQLRequired: No
- schema
-
The schema version used by the rule definition.
Type: String
Valid Values:
CloudTrailRequired: No
- updatedAt
-
The timestamp when the rule was last updated.
Type: Timestamp
Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
