Skip to content
AWS for Query.Farm

aws.detective.list_indicators

Example SQL Queries

SELECT * FROM
aws.detective.list_indicators
WHERE
"graph_arn" = 'VALUE'
AND "investigation_id" = 'VALUE';

Description

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Table Definition

Column NameColumn Data Type
graph_arn Required Input Column

The Amazon Resource Name (ARN) of the behavior graph.

VARCHAR
investigation_id Required Input Column

The investigation ID of the investigation report.

VARCHAR
indicator_type Input Column

For the list of indicators of compromise that are generated by Detective investigations, see Detective investigations.

VARCHAR
max_results Input Column

Lists the maximum number of indicators in a page.

BIGINT
next_token Input Column

Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.

Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

indicators

Lists the indicators of compromise.

STRUCT(
    "indicator_type" VARCHAR,
    "indicator_detail" STRUCT(
        "tt_ps_observed_detail" STRUCT(
            "tactic" VARCHAR,
            "technique" VARCHAR,
            "procedure" VARCHAR,
            "ip_address" VARCHAR,
            "api_name" VARCHAR,
            "api_success_count" BIGINT,
            "api_failure_count" BIGINT
        ),
        "impossible_travel_detail" STRUCT(
            "starting_ip_address" VARCHAR,
            "ending_ip_address" VARCHAR,
            "starting_location" VARCHAR,
            "ending_location" VARCHAR,
            "hourly_time_delta" BIGINT
        ),
        "flagged_ip_address_detail" STRUCT(
            "ip_address" VARCHAR,
            "reason" VARCHAR
        ),
        "new_geolocation_detail" STRUCT(
            "location" VARCHAR,
            "ip_address" VARCHAR,
            "is_new_for_entire_account" BOOLEAN
        ),
        "new_aso_detail" STRUCT(
            "aso" VARCHAR,
            "is_new_for_entire_account" BOOLEAN
        ),
        "new_user_agent_detail" STRUCT(
            "user_agent" VARCHAR,
            "is_new_for_entire_account" BOOLEAN
        ),
        "related_finding_detail" STRUCT(
            "arn" VARCHAR,
            "type" VARCHAR,
            "ip_address" VARCHAR
        ),
        "related_finding_group_detail" STRUCT(
            "id" VARCHAR
        )
    )
)[]
Show child fields
indicators[]
Show child fields
indicators[].indicator_detail

Details about the indicators of compromise that are used to determine if a resource is involved in a security incident. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident.

Show child fields
indicators[].indicator_detail.flagged_ip_address_detail

Suspicious IP addresses that are flagged, which indicates critical or severe threats based on threat intelligence by Detective. This indicator is derived from Amazon Web Services threat intelligence.

Show child fields
indicators[].indicator_detail.flagged_ip_address_detail.ip_address

IP address of the suspicious entity.

indicators[].indicator_detail.flagged_ip_address_detail.reason

Details the reason the IP address was flagged as suspicious.

indicators[].indicator_detail.impossible_travel_detail

Identifies unusual and impossible user activity for an account.

Show child fields
indicators[].indicator_detail.impossible_travel_detail.ending_ip_address

IP address where the resource was last used in the impossible travel.

indicators[].indicator_detail.impossible_travel_detail.ending_location

Location where the resource was last used in the impossible travel.

indicators[].indicator_detail.impossible_travel_detail.hourly_time_delta

Returns the time difference between the first and last timestamp the resource was used.

indicators[].indicator_detail.impossible_travel_detail.starting_ip_address

IP address where the resource was first used in the impossible travel.

indicators[].indicator_detail.impossible_travel_detail.starting_location

Location where the resource was first used in the impossible travel.

indicators[].indicator_detail.new_aso_detail

Contains details about the new Autonomous System Organization (ASO).

Show child fields
indicators[].indicator_detail.new_aso_detail.aso

Details about the new Autonomous System Organization (ASO).

indicators[].indicator_detail.new_aso_detail.is_new_for_entire_account

Checks if the Autonomous System Organization (ASO) is new for the entire account.

indicators[].indicator_detail.new_geolocation_detail

Contains details about the new geographic location.

Show child fields
indicators[].indicator_detail.new_geolocation_detail.ip_address

IP address using which the resource was accessed.

indicators[].indicator_detail.new_geolocation_detail.is_new_for_entire_account

Checks if the geolocation is new for the entire account.

indicators[].indicator_detail.new_geolocation_detail.location

Location where the resource was accessed.

indicators[].indicator_detail.new_user_agent_detail

Contains details about the new user agent.

Show child fields
indicators[].indicator_detail.new_user_agent_detail.is_new_for_entire_account

Checks if the user agent is new for the entire account.

indicators[].indicator_detail.new_user_agent_detail.user_agent

New user agent which accessed the resource.

indicators[].indicator_detail.related_finding_detail

Contains details about related findings.

Show child fields
indicators[].indicator_detail.related_finding_detail.arn

The Amazon Resource Name (ARN) of the related finding.

indicators[].indicator_detail.related_finding_detail.ip_address

The IP address of the finding.

indicators[].indicator_detail.related_finding_detail.type

The type of finding.

indicators[].indicator_detail.related_finding_group_detail

Contains details about related finding groups.

Show child fields
indicators[].indicator_detail.related_finding_group_detail.id

The unique identifier for the finding group.

indicators[].indicator_detail.tt_ps_observed_detail

Details about the indicator of compromise.

Show child fields
indicators[].indicator_detail.tt_ps_observed_detail.api_failure_count

The total number of failed API requests.

indicators[].indicator_detail.tt_ps_observed_detail.api_name

The name of the API where the tactics, techniques, and procedure (TTP) was observed.

indicators[].indicator_detail.tt_ps_observed_detail.api_success_count

The total number of successful API requests.

indicators[].indicator_detail.tt_ps_observed_detail.ip_address

The IP address where the tactics, techniques, and procedure (TTP) was observed.

indicators[].indicator_detail.tt_ps_observed_detail.procedure

The procedure used, identified by the investigation.

indicators[].indicator_detail.tt_ps_observed_detail.tactic

The tactic used, identified by the investigation.

indicators[].indicator_detail.tt_ps_observed_detail.technique

The technique used, identified by the investigation.

indicators[].indicator_type

The type of indicator.