ActorSession
Contains information about the authenticated session used by the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in AWS Security Hub, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.
Contents
- CreatedTime
-
The timestamp for when the session was created.
In AWS CloudTrail, you can find this value as
userIdentity.sessionContext.attributes.creationDate.Type: Long
Required: No
- Issuer
-
The issuer of the session.
In AWS CloudTrail, you can find this value as
userIdentity.sessionContext.sessionIssuer.arn.Type: String
Pattern:
.*\S.*Required: No
- MfaStatus
-
Indicates whether multi-factor authentication (MFA) was used for authentication during the session.
In AWS CloudTrail, you can find this value as
userIdentity.sessionContext.attributes.mfaAuthenticated.Type: String
Valid Values:
ENABLED | DISABLEDRequired: No
- Uid
-
Unique identifier of the session.
Type: String
Pattern:
.*\S.*Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
