Guardduty  >  Structures  >  RuntimeContext

RuntimeContext

Structure Class

RuntimeContext dataclass

Additional information about the suspicious activity.

Attributes

address_family class-attribute instance-attribute

address_family: str | None = None

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

command_line_example class-attribute instance-attribute

command_line_example: str | None = None

Example of the command line involved in the suspicious activity.

file_operation class-attribute instance-attribute

file_operation: str | None = None

Represents the type of file operation that triggered the finding, such as Write, Delete, Rename, Link, or Symlink.

file_path class-attribute instance-attribute

file_path: str | None = None

The path of the sensitive file that was modified. Modification includes write, delete, rename, link, or symlink operations. This field is indexed for filtering.

file_system_type class-attribute instance-attribute

file_system_type: str | None = None

Represents the type of mounted fileSystem.

flags class-attribute instance-attribute

flags: list[str] | None = None

Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.

iana_protocol_number class-attribute instance-attribute

iana_protocol_number: int | None = None

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

ld_preload_value class-attribute instance-attribute

ld_preload_value: str | None = None

The value of the LD_PRELOAD environment variable.

library_path class-attribute instance-attribute

library_path: str | None = None

The path to the new library that was loaded.

memory_regions class-attribute instance-attribute

memory_regions: list[str] | None = None

Specifies the Region of a process's address space such as stack and heap.

modified_at class-attribute instance-attribute

modified_at: datetime | None = None

The timestamp at which the process modified the current process. The timestamp is in UTC date string format.

modifying_process class-attribute instance-attribute

modifying_process: ProcessDetails | None = None

Information about the process that modified the current process. This is available for multiple finding types.

module_file_path class-attribute instance-attribute

module_file_path: str | None = None

The path to the module loaded into the kernel.

module_name class-attribute instance-attribute

module_name: str | None = None

The name of the module loaded into the kernel.

module_sha256 class-attribute instance-attribute

module_sha256: str | None = None

The SHA256 hash of the module.

mount_source class-attribute instance-attribute

mount_source: str | None = None

The path on the host that is mounted by the container.

mount_target class-attribute instance-attribute

mount_target: str | None = None

The path in the container that is mapped to the host directory.

related_file_paths class-attribute instance-attribute

related_file_paths: list[str] | None = None

All file paths modified by the same process that triggered the finding, up to a maximum of 25 paths.

release_agent_path class-attribute instance-attribute

release_agent_path: str | None = None

The path in the container that modified the release agent file.

runc_binary_path class-attribute instance-attribute

runc_binary_path: str | None = None

The path to the leveraged runc implementation.

script_path class-attribute instance-attribute

script_path: str | None = None

The path to the script that was executed.

service_name class-attribute instance-attribute

service_name: str | None = None

Name of the security service that has been potentially disabled.

shell_history_file_path class-attribute instance-attribute

shell_history_file_path: str | None = None

The path to the modified shell history file.

socket_path class-attribute instance-attribute

socket_path: str | None = None

The path to the docket socket that was accessed.

target_process class-attribute instance-attribute

target_process: ProcessDetails | None = None

Information about the process that had its memory overwritten by the current process.

threat_file_path class-attribute instance-attribute

threat_file_path: str | None = None

The suspicious file path for which the threat intelligence details were found.

tool_category class-attribute instance-attribute

tool_category: str | None = None

Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.

tool_name class-attribute instance-attribute

tool_name: str | None = None

Name of the potentially suspicious tool.