Indicator¶
Structure Class¶
dataclass
¶
Contains information about the indicators that include a set of signals observed in an attack sequence.
Attributes¶
class-attribute
instance-attribute
¶
key: IndicatorType | None = None
Specific indicator keys observed in the attack sequence. For description of the valid values for key, see Attack sequence finding details in the Amazon GuardDuty User Guide.
class-attribute
instance-attribute
¶
values: list[str] | None = None
Values associated with each indicator key. For example, if the indicator
key is SUSPICIOUS_NETWORK, then the value will be the name of the
network. If the indicator key is ATTACK_TACTIC, then the value will be
one of the MITRE tactics.