Guardduty  >  Structures  >  Investigation

Investigation

Structure Class

Investigation dataclass

Contains the details and results of a GuardDuty investigation.

Attributes

cloud class-attribute instance-attribute

cloud: CloudDetails | None = None

Details about the cloud environment in which the investigation was performed, including the provider, region, and account.

confidence class-attribute instance-attribute

confidence: Confidence | None = None

The confidence level of the investigation's assessment. Possible values are Unknown, Low, Medium, and High.

end_time class-attribute instance-attribute

end_time: datetime | None = None

The timestamp at which the investigation completed.

error class-attribute instance-attribute

error: str | None = None

Details about the error if the investigation status is FAILED.

investigation_id class-attribute instance-attribute

investigation_id: str | None = None

The unique identifier of the investigation.

metadata class-attribute instance-attribute

metadata: InvestigationMetadata | None = None

Metadata about the product and version that produced the investigation.

risk class-attribute instance-attribute

risk: str | None = None

A human-readable description of the assessed risk.

risk_level class-attribute instance-attribute

risk_level: RiskLevel | None = None

The assessed risk level of the investigated threat. Possible values are Info, Low, Medium, High, and Critical.

start_time class-attribute instance-attribute

start_time: datetime | None = None

The timestamp at which the investigation started.

status class-attribute instance-attribute

status: InvestigationStatus | None = None

The current status of the investigation. Possible values are RUNNING, COMPLETED, and FAILED.

summary class-attribute instance-attribute

summary: str | None = None

A structured summary of the investigation findings, including affected resources, threat assessment, and recommended remediation steps.

trigger_prompt class-attribute instance-attribute

trigger_prompt: str | None = None

The natural-language prompt that initiated this investigation.

triggered_by class-attribute instance-attribute

triggered_by: str | None = None

The account that initiated the investigation.