ListIndicatorsCommand

Suggest an Edit

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Example Syntax

Use a bare-bones client and the command you need to make an API call.

import { DetectiveClient, ListIndicatorsCommand } from "@aws-sdk/client-detective"; // ES Modules import
// const { DetectiveClient, ListIndicatorsCommand } = require("@aws-sdk/client-detective"); // CommonJS import
const client = new DetectiveClient(config);
const input = { // ListIndicatorsRequest
  GraphArn: "STRING_VALUE", // required
  InvestigationId: "STRING_VALUE", // required
  IndicatorType: "TTP_OBSERVED" || "IMPOSSIBLE_TRAVEL" || "FLAGGED_IP_ADDRESS" || "NEW_GEOLOCATION" || "NEW_ASO" || "NEW_USER_AGENT" || "RELATED_FINDING" || "RELATED_FINDING_GROUP",
  NextToken: "STRING_VALUE",
  MaxResults: Number("int"),
};
const command = new ListIndicatorsCommand(input);
const response = await client.send(command);
// { // ListIndicatorsResponse
//   GraphArn: "STRING_VALUE",
//   InvestigationId: "STRING_VALUE",
//   NextToken: "STRING_VALUE",
//   Indicators: [ // Indicators
//     { // Indicator
//       IndicatorType: "TTP_OBSERVED" || "IMPOSSIBLE_TRAVEL" || "FLAGGED_IP_ADDRESS" || "NEW_GEOLOCATION" || "NEW_ASO" || "NEW_USER_AGENT" || "RELATED_FINDING" || "RELATED_FINDING_GROUP",
//       IndicatorDetail: { // IndicatorDetail
//         TTPsObservedDetail: { // TTPsObservedDetail
//           Tactic: "STRING_VALUE",
//           Technique: "STRING_VALUE",
//           Procedure: "STRING_VALUE",
//           IpAddress: "STRING_VALUE",
//           APIName: "STRING_VALUE",
//           APISuccessCount: Number("long"),
//           APIFailureCount: Number("long"),
//         },
//         ImpossibleTravelDetail: { // ImpossibleTravelDetail
//           StartingIpAddress: "STRING_VALUE",
//           EndingIpAddress: "STRING_VALUE",
//           StartingLocation: "STRING_VALUE",
//           EndingLocation: "STRING_VALUE",
//           HourlyTimeDelta: Number("int"),
//         },
//         FlaggedIpAddressDetail: { // FlaggedIpAddressDetail
//           IpAddress: "STRING_VALUE",
//           Reason: "AWS_THREAT_INTELLIGENCE",
//         },
//         NewGeolocationDetail: { // NewGeolocationDetail
//           Location: "STRING_VALUE",
//           IpAddress: "STRING_VALUE",
//           IsNewForEntireAccount: true || false,
//         },
//         NewAsoDetail: { // NewAsoDetail
//           Aso: "STRING_VALUE",
//           IsNewForEntireAccount: true || false,
//         },
//         NewUserAgentDetail: { // NewUserAgentDetail
//           UserAgent: "STRING_VALUE",
//           IsNewForEntireAccount: true || false,
//         },
//         RelatedFindingDetail: { // RelatedFindingDetail
//           Arn: "STRING_VALUE",
//           Type: "STRING_VALUE",
//           IpAddress: "STRING_VALUE",
//         },
//         RelatedFindingGroupDetail: { // RelatedFindingGroupDetail
//           Id: "STRING_VALUE",
//         },
//       },
//     },
//   ],
// };

ListIndicatorsCommand Input

See ListIndicatorsCommandInput for more details

Parameter
Type
Description
GraphArn
Required
string | undefined

The Amazon Resource Name (ARN) of the behavior graph.

InvestigationId
Required
string | undefined

The investigation ID of the investigation report.

IndicatorType
IndicatorType | undefined

For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations .

MaxResults
number | undefined

Lists the maximum number of indicators in a page.

NextToken
string | undefined

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

ListIndicatorsCommand Output

See ListIndicatorsCommandOutput for details

Parameter
Type
Description
$metadata
Required
ResponseMetadata
Metadata pertaining to this request.
GraphArn
string | undefined

The Amazon Resource Name (ARN) of the behavior graph.

Indicators
Indicator[] | undefined

Lists the indicators of compromise.

InvestigationId
string | undefined

The investigation ID of the investigation report.

NextToken
string | undefined

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

Throws

Name
Fault
Details
AccessDeniedException
client

The request issuer does not have permission to access this resource or perform this operation.

InternalServerException
server

The request was valid but failed because of a problem with the service.

ResourceNotFoundException
client

The request refers to a nonexistent resource.

TooManyRequestsException
client

The request cannot be completed because too many other requests are occurring at the same time.

ValidationException
client

The request parameters are invalid.

DetectiveServiceException
Base exception class for all service exceptions from Detective service.