| Column Name | Column Data Type |
|---|
account_ids Required Input Column
The list of Amazon Web Services account identifiers for the member account for which to return member details. You can request details for up to 50 member accounts at a time. You cannot use GetMembers to retrieve information about member accounts that were removed from the behavior graph. | VARCHAR[] |
Show child fields- account_ids[]
|
graph_arn Required Input Column
The ARN of the behavior graph for which to request the member details. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
member_details
The member account details that Detective is returning in response to the request. | STRUCT(
"account_id" VARCHAR,
"email_address" VARCHAR,
"graph_arn" VARCHAR,
"master_id" VARCHAR,
"administrator_id" VARCHAR,
"status" VARCHAR,
"disabled_reason" VARCHAR,
"invited_time" TIMESTAMP_S,
"updated_time" TIMESTAMP_S,
"volume_usage_in_bytes" BIGINT,
"volume_usage_updated_time" TIMESTAMP_S,
"percent_of_graph_utilization" DOUBLE,
"percent_of_graph_utilization_updated_time" TIMESTAMP_S,
"invitation_type" VARCHAR,
"volume_usage_by_datasource_package" MAP(VARCHAR, STRUCT(
"volume_usage_in_bytes" BIGINT,
"volume_usage_update_time" TIMESTAMP_S
)),
"datasource_package_ingest_states" MAP(VARCHAR, VARCHAR)
)[] |
Show child fields- member_details[]
Show child fields- member_details[].account_id
The Amazon Web Services account identifier for the member account. - member_details[].administrator_id
The Amazon Web Services account identifier of the administrator account for the behavior graph. - member_details[].datasource_package_ingest_states
The state of a data source package for the behavior graph. - member_details[].disabled_reason
For member accounts with a status of ACCEPTED_BUT_DISABLED, the reason that the member account is not enabled. The reason can have one of the following values: -
VOLUME_TOO_HIGH - Indicates that adding the member account would cause the data volume for the behavior graph to be too high. -
VOLUME_UNKNOWN - Indicates that Detective is unable to verify the data volume for the member account. This is usually because the member account is not enrolled in Amazon GuardDuty. - member_details[].email_address
The Amazon Web Services account root user email address for the member account. - member_details[].graph_arn
The ARN of the behavior graph. - member_details[].invitation_type
The type of behavior graph membership. For an organization account in the organization behavior graph, the type is ORGANIZATION. For an account that was invited to a behavior graph, the type is INVITATION. - member_details[].invited_time
For invited accounts, the date and time that Detective sent the invitation to the account. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - member_details[].master_id
The Amazon Web Services account identifier of the administrator account for the behavior graph. - member_details[].percent_of_graph_utilization
The member account data volume as a percentage of the maximum allowed data volume. 0 indicates 0 percent, and 100 indicates 100 percent. Note that this is not the percentage of the behavior graph data volume. For example, the data volume for the behavior graph is 80 GB per day. The maximum data volume is 160 GB per day. If the data volume for the member account is 40 GB per day, then PercentOfGraphUtilization is 25. It represents 25% of the maximum allowed data volume. - member_details[].percent_of_graph_utilization_updated_time
The date and time when the graph utilization percentage was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - member_details[].status
The current membership status of the member account. The status can have one of the following values: -
INVITED - For invited accounts only. Indicates that the member was sent an invitation but has not yet responded. -
VERIFICATION_IN_PROGRESS - For invited accounts only, indicates that Detective is verifying that the account identifier and email address provided for the member account match. If they do match, then Detective sends the invitation. If the email address and account identifier don't match, then the member cannot be added to the behavior graph. For organization accounts in the organization behavior graph, indicates that Detective is verifying that the account belongs to the organization. -
VERIFICATION_FAILED - For invited accounts only. Indicates that the account and email address provided for the member account do not match, and Detective did not send an invitation to the account. -
ENABLED - Indicates that the member account currently contributes data to the behavior graph. For invited accounts, the member account accepted the invitation. For organization accounts in the organization behavior graph, the Detective administrator account enabled the organization account as a member account. -
ACCEPTED_BUT_DISABLED - The account accepted the invitation, or was enabled by the Detective administrator account, but is prevented from contributing data to the behavior graph. DisabledReason provides the reason why the member account is not enabled. Invited accounts that declined an invitation or that were removed from the behavior graph are not included. In the organization behavior graph, organization accounts that the Detective administrator account did not enable are not included. - member_details[].updated_time
The date and time that the member account was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - member_details[].volume_usage_by_datasource_package
Details on the volume of usage for each data source package in a behavior graph. - member_details[].volume_usage_in_bytes
The data volume in bytes per day for the member account. - member_details[].volume_usage_updated_time
The data and time when the member account data volume was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
|
unprocessed_accounts
The requested member accounts for which Detective was unable to return member details. For each account, provides the reason why the request could not be processed. | STRUCT(
"account_id" VARCHAR,
"reason" VARCHAR
)[] |
Show child fields- unprocessed_accounts[]
Show child fields- unprocessed_accounts[].account_id
The Amazon Web Services account identifier of the member account that was not processed. - unprocessed_accounts[].reason
The reason that the member account request could not be processed.
|