Sequence - Amazon GuardDuty
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Sequence

Contains information about the GuardDuty attack sequence finding.

Contents

description

Description of the attack sequence.

Type: String

Length Constraints: Maximum length of 4096.

Required: Yes

signals

Contains information about the signals involved in the attack sequence.

Type: Array of Signal objects

Array Members: Minimum number of 1 item. Maximum number of 100 items.

Required: Yes

uid

Unique identifier of the attack sequence.

Type: String

Required: Yes

actors

Contains information about the actors involved in the attack sequence.

Type: Array of Actor objects

Array Members: Maximum number of 400 items.

Required: No

additionalSequenceTypes

Additional types of sequences that may be associated with the attack sequence finding, providing further context about the nature of the detected threat.

Type: Array of strings

Length Constraints: Minimum length of 1. Maximum length of 50.

Required: No

endpoints

Contains information about the network endpoints that were used in the attack sequence.

Type: Array of NetworkEndpoint objects

Array Members: Maximum number of 400 items.

Required: No

resources

Contains information about the resources involved in the attack sequence.

Type: Array of ResourceV2 objects

Array Members: Maximum number of 400 items.

Required: No

sequenceIndicators

Contains information about the indicators observed in the attack sequence.

Type: Array of Indicator objects

Array Members: Maximum number of 400 items.

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: