Actor - AWS Security Hub CSPM
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Actor

Information about the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in AWS Security Hub CSPM, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Contents

Id

The ID of the threat actor.

Type: String

Pattern: .*\S.*

Required: No

Session

Contains information about the user session where the activity initiated.

Type: ActorSession object

Required: No

User

Contains information about the user credentials used by the threat actor.

Type: ActorUser object

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: