| Column Name | Column Data Type |
|---|
max_results Input Column
The maximum number of behavior graph invitations to return in the response. The total must be less than the overall limit on the number of results to return, which is currently 200. | BIGINT |
next_token Input Column
If there are more behavior graphs remaining in the results, then this is the pagination token to use to request the next page of behavior graphs. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
invitations
The list of behavior graphs for which the member account has open or accepted invitations. | STRUCT(
"account_id" VARCHAR,
"email_address" VARCHAR,
"graph_arn" VARCHAR,
"master_id" VARCHAR,
"administrator_id" VARCHAR,
"status" VARCHAR,
"disabled_reason" VARCHAR,
"invited_time" TIMESTAMP_S,
"updated_time" TIMESTAMP_S,
"volume_usage_in_bytes" BIGINT,
"volume_usage_updated_time" TIMESTAMP_S,
"percent_of_graph_utilization" DOUBLE,
"percent_of_graph_utilization_updated_time" TIMESTAMP_S,
"invitation_type" VARCHAR,
"volume_usage_by_datasource_package" MAP(VARCHAR, STRUCT(
"volume_usage_in_bytes" BIGINT,
"volume_usage_update_time" TIMESTAMP_S
)),
"datasource_package_ingest_states" MAP(VARCHAR, VARCHAR)
)[] |
Show child fields- invitations[]
Show child fields- invitations[].account_id
The Amazon Web Services account identifier for the member account. - invitations[].administrator_id
The Amazon Web Services account identifier of the administrator account for the behavior graph. - invitations[].datasource_package_ingest_states
The state of a data source package for the behavior graph. - invitations[].disabled_reason
For member accounts with a status of ACCEPTED_BUT_DISABLED, the reason that the member account is not enabled. The reason can have one of the following values: -
VOLUME_TOO_HIGH - Indicates that adding the member account would cause the data volume for the behavior graph to be too high. -
VOLUME_UNKNOWN - Indicates that Detective is unable to verify the data volume for the member account. This is usually because the member account is not enrolled in Amazon GuardDuty. - invitations[].email_address
The Amazon Web Services account root user email address for the member account. - invitations[].graph_arn
The ARN of the behavior graph. - invitations[].invitation_type
The type of behavior graph membership. For an organization account in the organization behavior graph, the type is ORGANIZATION. For an account that was invited to a behavior graph, the type is INVITATION. - invitations[].invited_time
For invited accounts, the date and time that Detective sent the invitation to the account. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - invitations[].master_id
The Amazon Web Services account identifier of the administrator account for the behavior graph. - invitations[].percent_of_graph_utilization
The member account data volume as a percentage of the maximum allowed data volume. 0 indicates 0 percent, and 100 indicates 100 percent. Note that this is not the percentage of the behavior graph data volume. For example, the data volume for the behavior graph is 80 GB per day. The maximum data volume is 160 GB per day. If the data volume for the member account is 40 GB per day, then PercentOfGraphUtilization is 25. It represents 25% of the maximum allowed data volume. - invitations[].percent_of_graph_utilization_updated_time
The date and time when the graph utilization percentage was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - invitations[].status
The current membership status of the member account. The status can have one of the following values: -
INVITED - For invited accounts only. Indicates that the member was sent an invitation but has not yet responded. -
VERIFICATION_IN_PROGRESS - For invited accounts only, indicates that Detective is verifying that the account identifier and email address provided for the member account match. If they do match, then Detective sends the invitation. If the email address and account identifier don't match, then the member cannot be added to the behavior graph. For organization accounts in the organization behavior graph, indicates that Detective is verifying that the account belongs to the organization. -
VERIFICATION_FAILED - For invited accounts only. Indicates that the account and email address provided for the member account do not match, and Detective did not send an invitation to the account. -
ENABLED - Indicates that the member account currently contributes data to the behavior graph. For invited accounts, the member account accepted the invitation. For organization accounts in the organization behavior graph, the Detective administrator account enabled the organization account as a member account. -
ACCEPTED_BUT_DISABLED - The account accepted the invitation, or was enabled by the Detective administrator account, but is prevented from contributing data to the behavior graph. DisabledReason provides the reason why the member account is not enabled. Invited accounts that declined an invitation or that were removed from the behavior graph are not included. In the organization behavior graph, organization accounts that the Detective administrator account did not enable are not included. - invitations[].updated_time
The date and time that the member account was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z. - invitations[].volume_usage_by_datasource_package
Details on the volume of usage for each data source package in a behavior graph. - invitations[].volume_usage_in_bytes
The data volume in bytes per day for the member account. - invitations[].volume_usage_updated_time
The data and time when the member account data volume was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
|