Guardduty  >  Structures  >  Finding

Finding

Structure Class

Finding dataclass

Contains information about the finding that is generated when abnormal or suspicious activity is detected.

Attributes

account_id class-attribute instance-attribute

account_id: str | None = None

The ID of the account in which the finding was generated.

arn class-attribute instance-attribute

arn: str | None = None

The ARN of the finding.

associated_attack_sequence_arn class-attribute instance-attribute

associated_attack_sequence_arn: str | None = None

Amazon Resource Name (ARN) associated with the attack sequence finding.

confidence class-attribute instance-attribute

confidence: float | None = None

The confidence score for the finding.

created_at class-attribute instance-attribute

created_at: str | None = None

The time and date when the finding was created.

description class-attribute instance-attribute

description: str | None = None

The description of the finding.

id class-attribute instance-attribute

id: str | None = None

The ID of the finding.

partition class-attribute instance-attribute

partition: str | None = None

The partition associated with the finding.

region class-attribute instance-attribute

region: str | None = None

The Region where the finding was generated. For findings generated from Global Service Events, the Region value in the finding might differ from the Region where GuardDuty identifies the potential threat. For more information, see How GuardDuty handles Amazon Web Services CloudTrail global events in the Amazon GuardDuty User Guide.

resource class-attribute instance-attribute

resource: Resource | None = None

Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.

schema_version class-attribute instance-attribute

schema_version: str | None = None

The version of the schema used for the finding.

service class-attribute instance-attribute

service: Service | None = None

Contains additional information about the generated finding.

severity class-attribute instance-attribute

severity: float | None = None

The severity of the finding.

title class-attribute instance-attribute

title: str | None = None

The title of the finding.

type class-attribute instance-attribute

type: str | None = None

The type of finding.

updated_at class-attribute instance-attribute

updated_at: str | None = None

The time and date when the finding was last updated.