aws.guardduty.get_findings

Example SQL Queries

SELECT * FROM
aws.guardduty.get_findings
WHERE
"detector_id" = 'VALUE'
AND "finding_ids" = 'VALUE';

Description

Describes Amazon GuardDuty findings specified by finding IDs.

Table Definition

Column Name	Column Data Type
`detector_id` Required Input Column The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.	VARCHAR
`finding_ids` Required Input Column The IDs of the findings that you want to retrieve.	VARCHAR[]
Show child fields `finding_ids[]`
`sort_criteria` Input Column Represents the criteria used for sorting findings.	STRUCT( "attribute_name" VARCHAR, "order_by" VARCHAR )
Show child fields `sort_criteria.attribute_name` Represents the finding attribute, such as `accountId`, that sorts the findings. `sort_criteria.order_by` The order by which the sorted findings are to be displayed.
`_aws_profile` Input Column The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.	STRUCT( "type" VARCHAR, "name" VARCHAR, "account_id" VARCHAR, "via_profile_name" VARCHAR, "assumed_role_arn" VARCHAR, "organization" STRUCT( "account_name" VARCHAR, "id" VARCHAR, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[], "master_account" STRUCT( "id" VARCHAR, "email" VARCHAR ), "parents" STRUCT( "type" VARCHAR, "id" VARCHAR, "name" VARCHAR, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[] )[] ) )
Show child fields `_aws_profile.account_id` The AWS account id `_aws_profile.assumed_role_arn` The ARN of the assumed role `_aws_profile.name` The unique name of the profile. `_aws_profile.organization` Information about this profile's membership in the AWS organization. Show child fields `_aws_profile.organization.account_name` The name of account speciifed by the organization `_aws_profile.organization.id` The organization id `_aws_profile.organization.master_account` Show child fields `_aws_profile.organization.master_account.email` The organization master account email address `_aws_profile.organization.master_account.id` The organization master account id `_aws_profile.organization.parents[]` Show child fields `_aws_profile.organization.parents[].id` The id of the parent `_aws_profile.organization.parents[].name` The name of the parent `_aws_profile.organization.parents[].tags[]` Show child fields `_aws_profile.organization.parents[].tags[].key` `_aws_profile.organization.parents[].tags[].value` `_aws_profile.organization.parents[].type` The type of parent can be an organization unit or a root `_aws_profile.organization.tags[]` Show child fields `_aws_profile.organization.tags[].key` `_aws_profile.organization.tags[].value` `_aws_profile.type` The type of profile, either 'credentials' or 'assumed_role' `_aws_profile.via_profile_name` This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
`_aws_region` Input Column The AWS region to use.	VARCHAR
`findings` A list of findings.	STRUCT( "account_id" VARCHAR, "arn" VARCHAR, "confidence" DOUBLE, "created_at" VARCHAR, "description" VARCHAR, "id" VARCHAR, "partition" VARCHAR, "region" VARCHAR, "resource" STRUCT( "access_key_details" STRUCT( "access_key_id" VARCHAR, "principal_id" VARCHAR, "user_name" VARCHAR, "user_type" VARCHAR ), "s3_bucket_details" STRUCT( "arn" VARCHAR, "name" VARCHAR, "type" VARCHAR, "created_at" TIMESTAMP_S, "owner" STRUCT( "id" VARCHAR ), "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[], "default_server_side_encryption" STRUCT( "encryption_type" VARCHAR, "kms_master_key_arn" VARCHAR ), "public_access" STRUCT( "permission_configuration" STRUCT( "bucket_level_permissions" STRUCT( "access_control_list" STRUCT( "allows_public_read_access" BOOLEAN, "allows_public_write_access" BOOLEAN ), "bucket_policy" STRUCT( "allows_public_read_access" BOOLEAN, "allows_public_write_access" BOOLEAN ), "block_public_access" STRUCT( "ignore_public_acls" BOOLEAN, "restrict_public_buckets" BOOLEAN, "block_public_acls" BOOLEAN, "block_public_policy" BOOLEAN ) ), "account_level_permissions" STRUCT( "block_public_access" STRUCT( "ignore_public_acls" BOOLEAN, "restrict_public_buckets" BOOLEAN, "block_public_acls" BOOLEAN, "block_public_policy" BOOLEAN ) ) ), "effective_permission" VARCHAR ), "s3_object_details" STRUCT( "object_arn" VARCHAR, "key" VARCHAR, "e_tag" VARCHAR, "hash" VARCHAR, "version_id" VARCHAR )[] )[], "instance_details" STRUCT( "availability_zone" VARCHAR, "iam_instance_profile" STRUCT( "arn" VARCHAR, "id" VARCHAR ), "image_description" VARCHAR, "image_id" VARCHAR, "instance_id" VARCHAR, "instance_state" VARCHAR, "instance_type" VARCHAR, "outpost_arn" VARCHAR, "launch_time" VARCHAR, "network_interfaces" STRUCT( "ipv6_addresses" VARCHAR[], "network_interface_id" VARCHAR, "private_dns_name" VARCHAR, "private_ip_address" VARCHAR, "private_ip_addresses" STRUCT( "private_dns_name" VARCHAR, "private_ip_address" VARCHAR )[], "public_dns_name" VARCHAR, "public_ip" VARCHAR, "security_groups" STRUCT( "group_id" VARCHAR, "group_name" VARCHAR )[], "subnet_id" VARCHAR, "vpc_id" VARCHAR )[], "platform" VARCHAR, "product_codes" STRUCT( "code" VARCHAR, "product_type" VARCHAR )[], "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[] ), "eks_cluster_details" STRUCT( "name" VARCHAR, "arn" VARCHAR, "vpc_id" VARCHAR, "status" VARCHAR, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[], "created_at" TIMESTAMP_S ), "kubernetes_details" STRUCT( "kubernetes_user_details" STRUCT( "username" VARCHAR, "uid" VARCHAR, "groups" VARCHAR[], "session_name" VARCHAR[], "impersonated_user" STRUCT( "username" VARCHAR, "groups" VARCHAR[] ) ), "kubernetes_workload_details" STRUCT( "name" VARCHAR, "type" VARCHAR, "uid" VARCHAR, "namespace" VARCHAR, "host_network" BOOLEAN, "containers" STRUCT( "container_runtime" VARCHAR, "id" VARCHAR, "name" VARCHAR, "image" VARCHAR, "image_prefix" VARCHAR, "volume_mounts" STRUCT( "name" VARCHAR, "mount_path" VARCHAR )[], "security_context" STRUCT( "privileged" BOOLEAN, "allow_privilege_escalation" BOOLEAN ) )[], "volumes" STRUCT( "name" VARCHAR, "host_path" STRUCT( "path" VARCHAR ) )[], "service_account_name" VARCHAR, "host_ipc" BOOLEAN, "host_pid" BOOLEAN ) ), "resource_type" VARCHAR, "ebs_volume_details" STRUCT( "scanned_volume_details" STRUCT( "volume_arn" VARCHAR, "volume_type" VARCHAR, "device_name" VARCHAR, "volume_size_in_gb" BIGINT, "encryption_type" VARCHAR, "snapshot_arn" VARCHAR, "kms_key_arn" VARCHAR )[], "skipped_volume_details" STRUCT( "volume_arn" VARCHAR, "volume_type" VARCHAR, "device_name" VARCHAR, "volume_size_in_gb" BIGINT, "encryption_type" VARCHAR, "snapshot_arn" VARCHAR, "kms_key_arn" VARCHAR )[] ), "ecs_cluster_details" STRUCT( "name" VARCHAR, "arn" VARCHAR, "status" VARCHAR, "active_services_count" BIGINT, "registered_container_instances_count" BIGINT, "running_tasks_count" BIGINT, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[], "task_details" STRUCT( "arn" VARCHAR, "definition_arn" VARCHAR, "version" VARCHAR, "task_created_at" TIMESTAMP_S, "started_at" TIMESTAMP_S, "started_by" VARCHAR, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[], "volumes" STRUCT( "name" VARCHAR, "host_path" STRUCT( "path" VARCHAR ) )[], "containers" STRUCT( "container_runtime" VARCHAR, "id" VARCHAR, "name" VARCHAR, "image" VARCHAR, "image_prefix" VARCHAR, "volume_mounts" STRUCT( "name" VARCHAR, "mount_path" VARCHAR )[], "security_context" STRUCT( "privileged" BOOLEAN, "allow_privilege_escalation" BOOLEAN ) )[], "group" VARCHAR ) ), "container_details" STRUCT( "container_runtime" VARCHAR, "id" VARCHAR, "name" VARCHAR, "image" VARCHAR, "image_prefix" VARCHAR, "volume_mounts" STRUCT( "name" VARCHAR, "mount_path" VARCHAR )[], "security_context" STRUCT( "privileged" BOOLEAN, "allow_privilege_escalation" BOOLEAN ) ), "rds_db_instance_details" STRUCT( "db_instance_identifier" VARCHAR, "engine" VARCHAR, "engine_version" VARCHAR, "db_cluster_identifier" VARCHAR, "db_instance_arn" VARCHAR, "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[] ), "rds_db_user_details" STRUCT( "user" VARCHAR, "application" VARCHAR, "database" VARCHAR, "ssl" VARCHAR, "auth_method" VARCHAR ), "lambda_details" STRUCT( "function_arn" VARCHAR, "function_name" VARCHAR, "description" VARCHAR, "last_modified_at" TIMESTAMP_S, "revision_id" VARCHAR, "function_version" VARCHAR, "role" VARCHAR, "vpc_config" STRUCT( "subnet_ids" VARCHAR[], "vpc_id" VARCHAR, "security_groups" STRUCT( "group_id" VARCHAR, "group_name" VARCHAR )[] ), "tags" STRUCT( "key" VARCHAR, "value" VARCHAR )[] ) ), "schema_version" VARCHAR, "service" STRUCT( "action" STRUCT( "action_type" VARCHAR, "aws_api_call_action" STRUCT( "api" VARCHAR, "caller_type" VARCHAR, "domain_details" STRUCT( "domain" VARCHAR ), "error_code" VARCHAR, "user_agent" VARCHAR, "remote_ip_details" STRUCT( "city" STRUCT( "city_name" VARCHAR ), "country" STRUCT( "country_code" VARCHAR, "country_name" VARCHAR ), "geo_location" STRUCT( "lat" DOUBLE, "lon" DOUBLE ), "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR, "organization" STRUCT( "asn" VARCHAR, "asn_org" VARCHAR, "isp" VARCHAR, "org" VARCHAR ) ), "service_name" VARCHAR, "remote_account_details" STRUCT( "account_id" VARCHAR, "affiliated" BOOLEAN ), "affected_resources" MAP(VARCHAR, VARCHAR) ), "dns_request_action" STRUCT( "domain" VARCHAR, "protocol" VARCHAR, "blocked" BOOLEAN, "domain_with_suffix" VARCHAR ), "network_connection_action" STRUCT( "blocked" BOOLEAN, "connection_direction" VARCHAR, "local_port_details" STRUCT( "port" BIGINT, "port_name" VARCHAR ), "protocol" VARCHAR, "local_ip_details" STRUCT( "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR ), "remote_ip_details" STRUCT( "city" STRUCT( "city_name" VARCHAR ), "country" STRUCT( "country_code" VARCHAR, "country_name" VARCHAR ), "geo_location" STRUCT( "lat" DOUBLE, "lon" DOUBLE ), "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR, "organization" STRUCT( "asn" VARCHAR, "asn_org" VARCHAR, "isp" VARCHAR, "org" VARCHAR ) ), "remote_port_details" STRUCT( "port" BIGINT, "port_name" VARCHAR ) ), "port_probe_action" STRUCT( "blocked" BOOLEAN, "port_probe_details" STRUCT( "local_port_details" STRUCT( "port" BIGINT, "port_name" VARCHAR ), "local_ip_details" STRUCT( "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR ), "remote_ip_details" STRUCT( "city" STRUCT( "city_name" VARCHAR ), "country" STRUCT( "country_code" VARCHAR, "country_name" VARCHAR ), "geo_location" STRUCT( "lat" DOUBLE, "lon" DOUBLE ), "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR, "organization" STRUCT( "asn" VARCHAR, "asn_org" VARCHAR, "isp" VARCHAR, "org" VARCHAR ) ) )[] ), "kubernetes_api_call_action" STRUCT( "request_uri" VARCHAR, "verb" VARCHAR, "source_ips" VARCHAR[], "user_agent" VARCHAR, "remote_ip_details" STRUCT( "city" STRUCT( "city_name" VARCHAR ), "country" STRUCT( "country_code" VARCHAR, "country_name" VARCHAR ), "geo_location" STRUCT( "lat" DOUBLE, "lon" DOUBLE ), "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR, "organization" STRUCT( "asn" VARCHAR, "asn_org" VARCHAR, "isp" VARCHAR, "org" VARCHAR ) ), "status_code" BIGINT, "parameters" VARCHAR, "resource" VARCHAR, "subresource" VARCHAR, "namespace" VARCHAR, "resource_name" VARCHAR ), "rds_login_attempt_action" STRUCT( "remote_ip_details" STRUCT( "city" STRUCT( "city_name" VARCHAR ), "country" STRUCT( "country_code" VARCHAR, "country_name" VARCHAR ), "geo_location" STRUCT( "lat" DOUBLE, "lon" DOUBLE ), "ip_address_v4" VARCHAR, "ip_address_v6" VARCHAR, "organization" STRUCT( "asn" VARCHAR, "asn_org" VARCHAR, "isp" VARCHAR, "org" VARCHAR ) ), "login_attributes" STRUCT( "user" VARCHAR, "application" VARCHAR, "failed_login_attempts" BIGINT, "successful_login_attempts" BIGINT )[] ), "kubernetes_permission_checked_details" STRUCT( "verb" VARCHAR, "resource" VARCHAR, "namespace" VARCHAR, "allowed" BOOLEAN ), "kubernetes_role_binding_details" STRUCT( "kind" VARCHAR, "name" VARCHAR, "uid" VARCHAR, "role_ref_name" VARCHAR, "role_ref_kind" VARCHAR ), "kubernetes_role_details" STRUCT( "kind" VARCHAR, "name" VARCHAR, "uid" VARCHAR ) ), "evidence" STRUCT( "threat_intelligence_details" STRUCT( "threat_list_name" VARCHAR, "threat_names" VARCHAR[], "threat_file_sha256" VARCHAR )[] ), "archived" BOOLEAN, "count" BIGINT, "detector_id" VARCHAR, "event_first_seen" VARCHAR, "event_last_seen" VARCHAR, "resource_role" VARCHAR, "service_name" VARCHAR, "user_feedback" VARCHAR, "additional_info" STRUCT( "value" VARCHAR, "type" VARCHAR ), "feature_name" VARCHAR, "ebs_volume_scan_details" STRUCT( "scan_id" VARCHAR, "scan_started_at" TIMESTAMP_S, "scan_completed_at" TIMESTAMP_S, "trigger_finding_id" VARCHAR, "sources" VARCHAR[], "scan_detections" STRUCT( "scanned_item_count" STRUCT( "total_gb" BIGINT, "files" BIGINT, "volumes" BIGINT ), "threats_detected_item_count" STRUCT( "files" BIGINT ), "highest_severity_threat_details" STRUCT( "severity" VARCHAR, "threat_name" VARCHAR, "count" BIGINT ), "threat_detected_by_name" STRUCT( "item_count" BIGINT, "unique_threat_name_count" BIGINT, "shortened" BOOLEAN, "threat_names" STRUCT( "name" VARCHAR, "severity" VARCHAR, "item_count" BIGINT, "file_paths" STRUCT( "file_path" VARCHAR, "volume_arn" VARCHAR, "hash" VARCHAR, "file_name" VARCHAR )[] )[] ) ), "scan_type" VARCHAR ), "runtime_details" STRUCT( "process" STRUCT( "name" VARCHAR, "executable_path" VARCHAR, "executable_sha256" VARCHAR, "namespace_pid" BIGINT, "pwd" VARCHAR, "pid" BIGINT, "start_time" TIMESTAMP_S, "uuid" VARCHAR, "parent_uuid" VARCHAR, "user" VARCHAR, "user_id" BIGINT, "euid" BIGINT, "lineage" STRUCT( "start_time" TIMESTAMP_S, "namespace_pid" BIGINT, "user_id" BIGINT, "name" VARCHAR, "pid" BIGINT, "uuid" VARCHAR, "executable_path" VARCHAR, "euid" BIGINT, "parent_uuid" VARCHAR )[] ), "context" STRUCT( "modifying_process" STRUCT( "name" VARCHAR, "executable_path" VARCHAR, "executable_sha256" VARCHAR, "namespace_pid" BIGINT, "pwd" VARCHAR, "pid" BIGINT, "start_time" TIMESTAMP_S, "uuid" VARCHAR, "parent_uuid" VARCHAR, "user" VARCHAR, "user_id" BIGINT, "euid" BIGINT, "lineage" STRUCT( "start_time" TIMESTAMP_S, "namespace_pid" BIGINT, "user_id" BIGINT, "name" VARCHAR, "pid" BIGINT, "uuid" VARCHAR, "executable_path" VARCHAR, "euid" BIGINT, "parent_uuid" VARCHAR )[] ), "modified_at" TIMESTAMP_S, "script_path" VARCHAR, "library_path" VARCHAR, "ld_preload_value" VARCHAR, "socket_path" VARCHAR, "runc_binary_path" VARCHAR, "release_agent_path" VARCHAR, "mount_source" VARCHAR, "mount_target" VARCHAR, "file_system_type" VARCHAR, "flags" VARCHAR[], "module_name" VARCHAR, "module_file_path" VARCHAR, "module_sha256" VARCHAR, "shell_history_file_path" VARCHAR, "target_process" STRUCT( "name" VARCHAR, "executable_path" VARCHAR, "executable_sha256" VARCHAR, "namespace_pid" BIGINT, "pwd" VARCHAR, "pid" BIGINT, "start_time" TIMESTAMP_S, "uuid" VARCHAR, "parent_uuid" VARCHAR, "user" VARCHAR, "user_id" BIGINT, "euid" BIGINT, "lineage" STRUCT( "start_time" TIMESTAMP_S, "namespace_pid" BIGINT, "user_id" BIGINT, "name" VARCHAR, "pid" BIGINT, "uuid" VARCHAR, "executable_path" VARCHAR, "euid" BIGINT, "parent_uuid" VARCHAR )[] ), "address_family" VARCHAR, "iana_protocol_number" BIGINT, "memory_regions" VARCHAR[], "tool_name" VARCHAR, "tool_category" VARCHAR, "service_name" VARCHAR, "command_line_example" VARCHAR, "threat_file_path" VARCHAR ) ), "detection" STRUCT( "anomaly" STRUCT( "profiles" MAP(VARCHAR, MAP(VARCHAR, STRUCT( "profile_type" VARCHAR, "profile_subtype" VARCHAR, "observations" STRUCT( "text" VARCHAR[] ) )[])), "unusual" STRUCT( "behavior" MAP(VARCHAR, MAP(VARCHAR, STRUCT( "profile_type" VARCHAR, "profile_subtype" VARCHAR, "observations" STRUCT( "text" VARCHAR[] ) ))) ) ) ), "malware_scan_details" STRUCT( "threats" STRUCT( "name" VARCHAR, "source" VARCHAR, "item_paths" STRUCT( "nested_item_path" VARCHAR, "hash" VARCHAR )[] )[] ) ), "severity" DOUBLE, "title" VARCHAR, "type" VARCHAR, "updated_at" VARCHAR )[]
Show child fields `findings[]` Show child fields `findings[].account_id` The ID of the account in which the finding was generated. `findings[].arn` The ARN of the finding. `findings[].confidence` The confidence score for the finding. `findings[].created_at` The time and date when the finding was created. `findings[].description` The description of the finding. `findings[].id` The ID of the finding. `findings[].partition` The partition associated with the finding. `findings[].region` The Region where the finding was generated. `findings[].resource` Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding. Show child fields `findings[].resource.access_key_details` The IAM access key details (user information) of a user that engaged in the activity that prompted GuardDuty to generate a finding. Show child fields `findings[].resource.access_key_details.access_key_id` The access key ID of the user. `findings[].resource.access_key_details.principal_id` The principal ID of the user. `findings[].resource.access_key_details.user_name` The name of the user. `findings[].resource.access_key_details.user_type` The type of the user. `findings[].resource.container_details` Details of a container. Show child fields `findings[].resource.container_details.container_runtime` The container runtime (such as, Docker or containerd) used to run the container. `findings[].resource.container_details.id` Container ID. `findings[].resource.container_details.image` Container image. `findings[].resource.container_details.image_prefix` Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty. `findings[].resource.container_details.name` Container name. `findings[].resource.container_details.security_context` Container security context. Show child fields `findings[].resource.container_details.security_context.allow_privilege_escalation` Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process. `findings[].resource.container_details.security_context.privileged` Whether the container is privileged. `findings[].resource.container_details.volume_mounts[]` Show child fields `findings[].resource.container_details.volume_mounts[].mount_path` Volume mount path. `findings[].resource.container_details.volume_mounts[].name` Volume mount name. `findings[].resource.ebs_volume_details` Contains list of scanned and skipped EBS volumes with details. Show child fields `findings[].resource.ebs_volume_details.scanned_volume_details[]` Show child fields `findings[].resource.ebs_volume_details.scanned_volume_details[].device_name` The device name for the EBS volume. `findings[].resource.ebs_volume_details.scanned_volume_details[].encryption_type` EBS volume encryption type. `findings[].resource.ebs_volume_details.scanned_volume_details[].kms_key_arn` KMS key ARN used to encrypt the EBS volume. `findings[].resource.ebs_volume_details.scanned_volume_details[].snapshot_arn` Snapshot ARN of the EBS volume. `findings[].resource.ebs_volume_details.scanned_volume_details[].volume_arn` EBS volume ARN information. `findings[].resource.ebs_volume_details.scanned_volume_details[].volume_size_in_gb` EBS volume size in GB. `findings[].resource.ebs_volume_details.scanned_volume_details[].volume_type` The EBS volume type. `findings[].resource.ebs_volume_details.skipped_volume_details[]` Show child fields `findings[].resource.ebs_volume_details.skipped_volume_details[].device_name` The device name for the EBS volume. `findings[].resource.ebs_volume_details.skipped_volume_details[].encryption_type` EBS volume encryption type. `findings[].resource.ebs_volume_details.skipped_volume_details[].kms_key_arn` KMS key ARN used to encrypt the EBS volume. `findings[].resource.ebs_volume_details.skipped_volume_details[].snapshot_arn` Snapshot ARN of the EBS volume. `findings[].resource.ebs_volume_details.skipped_volume_details[].volume_arn` EBS volume ARN information. `findings[].resource.ebs_volume_details.skipped_volume_details[].volume_size_in_gb` EBS volume size in GB. `findings[].resource.ebs_volume_details.skipped_volume_details[].volume_type` The EBS volume type. `findings[].resource.ecs_cluster_details` Contains information about the details of the ECS Cluster. Show child fields `findings[].resource.ecs_cluster_details.active_services_count` The number of services that are running on the cluster in an ACTIVE state. `findings[].resource.ecs_cluster_details.arn` The Amazon Resource Name (ARN) that identifies the cluster. `findings[].resource.ecs_cluster_details.name` The name of the ECS Cluster. `findings[].resource.ecs_cluster_details.registered_container_instances_count` The number of container instances registered into the cluster. `findings[].resource.ecs_cluster_details.running_tasks_count` The number of tasks in the cluster that are in the RUNNING state. `findings[].resource.ecs_cluster_details.status` The status of the ECS cluster. `findings[].resource.ecs_cluster_details.tags[]` Show child fields `findings[].resource.ecs_cluster_details.tags[].key` The EC2 instance tag key. `findings[].resource.ecs_cluster_details.tags[].value` The EC2 instance tag value. `findings[].resource.ecs_cluster_details.task_details` Contains information about the details of the ECS Task. Show child fields `findings[].resource.ecs_cluster_details.task_details.arn` The Amazon Resource Name (ARN) of the task. `findings[].resource.ecs_cluster_details.task_details.containers[]` Show child fields `findings[].resource.ecs_cluster_details.task_details.containers[].container_runtime` The container runtime (such as, Docker or containerd) used to run the container. `findings[].resource.ecs_cluster_details.task_details.containers[].id` Container ID. `findings[].resource.ecs_cluster_details.task_details.containers[].image` Container image. `findings[].resource.ecs_cluster_details.task_details.containers[].image_prefix` Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty. `findings[].resource.ecs_cluster_details.task_details.containers[].name` Container name. `findings[].resource.ecs_cluster_details.task_details.containers[].security_context` Container security context. Show child fields `findings[].resource.ecs_cluster_details.task_details.containers[].security_context.allow_privilege_escalation` Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process. `findings[].resource.ecs_cluster_details.task_details.containers[].security_context.privileged` Whether the container is privileged. `findings[].resource.ecs_cluster_details.task_details.containers[].volume_mounts[]` Show child fields `findings[].resource.ecs_cluster_details.task_details.containers[].volume_mounts[].mount_path` Volume mount path. `findings[].resource.ecs_cluster_details.task_details.containers[].volume_mounts[].name` Volume mount name. `findings[].resource.ecs_cluster_details.task_details.definition_arn` The ARN of the task definition that creates the task. `findings[].resource.ecs_cluster_details.task_details.group` The name of the task group that's associated with the task. `findings[].resource.ecs_cluster_details.task_details.started_at` The Unix timestamp for the time when the task started. `findings[].resource.ecs_cluster_details.task_details.started_by` Contains the tag specified when a task is started. `findings[].resource.ecs_cluster_details.task_details.tags[]` Show child fields `findings[].resource.ecs_cluster_details.task_details.tags[].key` The EC2 instance tag key. `findings[].resource.ecs_cluster_details.task_details.tags[].value` The EC2 instance tag value. `findings[].resource.ecs_cluster_details.task_details.task_created_at` The Unix timestamp for the time when the task was created. `findings[].resource.ecs_cluster_details.task_details.version` The version counter for the task. `findings[].resource.ecs_cluster_details.task_details.volumes[]` Show child fields `findings[].resource.ecs_cluster_details.task_details.volumes[].host_path` Represents a pre-existing file or directory on the host machine that the volume maps to. Show child fields `findings[].resource.ecs_cluster_details.task_details.volumes[].host_path.path` Path of the file or directory on the host that the volume maps to. `findings[].resource.ecs_cluster_details.task_details.volumes[].name` Volume name. `findings[].resource.eks_cluster_details` Details about the EKS cluster involved in a Kubernetes finding. Show child fields `findings[].resource.eks_cluster_details.arn` EKS cluster ARN. `findings[].resource.eks_cluster_details.created_at` The timestamp when the EKS cluster was created. `findings[].resource.eks_cluster_details.name` EKS cluster name. `findings[].resource.eks_cluster_details.status` The EKS cluster status. `findings[].resource.eks_cluster_details.tags[]` Show child fields `findings[].resource.eks_cluster_details.tags[].key` The EC2 instance tag key. `findings[].resource.eks_cluster_details.tags[].value` The EC2 instance tag value. `findings[].resource.eks_cluster_details.vpc_id` The VPC ID to which the EKS cluster is attached. `findings[].resource.instance_details` The information about the EC2 instance associated with the activity that prompted GuardDuty to generate a finding. Show child fields `findings[].resource.instance_details.availability_zone` The Availability Zone of the EC2 instance. `findings[].resource.instance_details.iam_instance_profile` The profile information of the EC2 instance. Show child fields `findings[].resource.instance_details.iam_instance_profile.arn` The profile ARN of the EC2 instance. `findings[].resource.instance_details.iam_instance_profile.id` The profile ID of the EC2 instance. `findings[].resource.instance_details.image_description` The image description of the EC2 instance. `findings[].resource.instance_details.image_id` The image ID of the EC2 instance. `findings[].resource.instance_details.instance_id` The ID of the EC2 instance. `findings[].resource.instance_details.instance_state` The state of the EC2 instance. `findings[].resource.instance_details.instance_type` The type of the EC2 instance. `findings[].resource.instance_details.launch_time` The launch time of the EC2 instance. `findings[].resource.instance_details.network_interfaces[]` Show child fields `findings[].resource.instance_details.network_interfaces[].ipv6_addresses[]` `findings[].resource.instance_details.network_interfaces[].network_interface_id` The ID of the network interface. `findings[].resource.instance_details.network_interfaces[].private_dns_name` The private DNS name of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].private_ip_address` The private IP address of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].private_ip_addresses[]` Show child fields `findings[].resource.instance_details.network_interfaces[].private_ip_addresses[].private_dns_name` The private DNS name of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].private_ip_addresses[].private_ip_address` The private IP address of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].public_dns_name` The public DNS name of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].public_ip` The public IP address of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].security_groups[]` Show child fields `findings[].resource.instance_details.network_interfaces[].security_groups[].group_id` The security group ID of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].security_groups[].group_name` The security group name of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].subnet_id` The subnet ID of the EC2 instance. `findings[].resource.instance_details.network_interfaces[].vpc_id` The VPC ID of the EC2 instance. `findings[].resource.instance_details.outpost_arn` The Amazon Resource Name (ARN) of the Amazon Web Services Outpost. Only applicable to Amazon Web Services Outposts instances. `findings[].resource.instance_details.platform` The platform of the EC2 instance. `findings[].resource.instance_details.product_codes[]` Show child fields `findings[].resource.instance_details.product_codes[].code` The product code information. `findings[].resource.instance_details.product_codes[].product_type` The product code type. `findings[].resource.instance_details.tags[]` Show child fields `findings[].resource.instance_details.tags[].key` The EC2 instance tag key. `findings[].resource.instance_details.tags[].value` The EC2 instance tag value. `findings[].resource.kubernetes_details` Details about the Kubernetes user and workload involved in a Kubernetes finding. Show child fields `findings[].resource.kubernetes_details.kubernetes_user_details` Details about the Kubernetes user involved in a Kubernetes finding. Show child fields `findings[].resource.kubernetes_details.kubernetes_user_details.groups[]` `findings[].resource.kubernetes_details.kubernetes_user_details.impersonated_user` Information about the impersonated user. Show child fields `findings[].resource.kubernetes_details.kubernetes_user_details.impersonated_user.groups[]` `findings[].resource.kubernetes_details.kubernetes_user_details.impersonated_user.username` Information about the `username` that was being impersonated. `findings[].resource.kubernetes_details.kubernetes_user_details.session_name[]` `findings[].resource.kubernetes_details.kubernetes_user_details.uid` The user ID of the user who called the Kubernetes API. `findings[].resource.kubernetes_details.kubernetes_user_details.username` The username of the user who called the Kubernetes API. `findings[].resource.kubernetes_details.kubernetes_workload_details` Details about the Kubernetes workload involved in a Kubernetes finding. Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[]` Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].container_runtime` The container runtime (such as, Docker or containerd) used to run the container. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].id` Container ID. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].image` Container image. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].image_prefix` Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].name` Container name. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].security_context` Container security context. Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].security_context.allow_privilege_escalation` Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].security_context.privileged` Whether the container is privileged. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].volume_mounts[]` Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].volume_mounts[].mount_path` Volume mount path. `findings[].resource.kubernetes_details.kubernetes_workload_details.containers[].volume_mounts[].name` Volume mount name. `findings[].resource.kubernetes_details.kubernetes_workload_details.host_ipc` Whether the host IPC flag is enabled for the pods in the workload. `findings[].resource.kubernetes_details.kubernetes_workload_details.host_network` Whether the hostNetwork flag is enabled for the pods included in the workload. `findings[].resource.kubernetes_details.kubernetes_workload_details.host_pid` Whether the host PID flag is enabled for the pods in the workload. `findings[].resource.kubernetes_details.kubernetes_workload_details.name` Kubernetes workload name. `findings[].resource.kubernetes_details.kubernetes_workload_details.namespace` Kubernetes namespace that the workload is part of. `findings[].resource.kubernetes_details.kubernetes_workload_details.service_account_name` The service account name that is associated with a Kubernetes workload. `findings[].resource.kubernetes_details.kubernetes_workload_details.type` Kubernetes workload type (e.g. Pod, Deployment, etc.). `findings[].resource.kubernetes_details.kubernetes_workload_details.uid` Kubernetes workload ID. `findings[].resource.kubernetes_details.kubernetes_workload_details.volumes[]` Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.volumes[].host_path` Represents a pre-existing file or directory on the host machine that the volume maps to. Show child fields `findings[].resource.kubernetes_details.kubernetes_workload_details.volumes[].host_path.path` Path of the file or directory on the host that the volume maps to. `findings[].resource.kubernetes_details.kubernetes_workload_details.volumes[].name` Volume name. `findings[].resource.lambda_details` Contains information about the Lambda function that was involved in a finding. Show child fields `findings[].resource.lambda_details.description` Description of the Lambda function. `findings[].resource.lambda_details.function_arn` Amazon Resource Name (ARN) of the Lambda function. `findings[].resource.lambda_details.function_name` Name of the Lambda function. `findings[].resource.lambda_details.function_version` The version of the Lambda function. `findings[].resource.lambda_details.last_modified_at` The timestamp when the Lambda function was last modified. This field is in the UTC date string format `(2023-03-22T19:37:20.168Z)`. `findings[].resource.lambda_details.revision_id` The revision ID of the Lambda function version. `findings[].resource.lambda_details.role` The execution role of the Lambda function. `findings[].resource.lambda_details.tags[]` Show child fields `findings[].resource.lambda_details.tags[].key` The EC2 instance tag key. `findings[].resource.lambda_details.tags[].value` The EC2 instance tag value. `findings[].resource.lambda_details.vpc_config` Amazon Virtual Private Cloud configuration details associated with your Lambda function. Show child fields `findings[].resource.lambda_details.vpc_config.security_groups[]` Show child fields `findings[].resource.lambda_details.vpc_config.security_groups[].group_id` The security group ID of the EC2 instance. `findings[].resource.lambda_details.vpc_config.security_groups[].group_name` The security group name of the EC2 instance. `findings[].resource.lambda_details.vpc_config.subnet_ids[]` `findings[].resource.lambda_details.vpc_config.vpc_id` The identifier of the Amazon Virtual Private Cloud. `findings[].resource.rds_db_instance_details` Contains information about the database instance to which an anomalous login attempt was made. Show child fields `findings[].resource.rds_db_instance_details.db_cluster_identifier` The identifier of the database cluster that contains the database instance ID involved in the finding. `findings[].resource.rds_db_instance_details.db_instance_arn` The Amazon Resource Name (ARN) that identifies the database instance involved in the finding. `findings[].resource.rds_db_instance_details.db_instance_identifier` The identifier associated to the database instance that was involved in the finding. `findings[].resource.rds_db_instance_details.engine` The database engine of the database instance involved in the finding. `findings[].resource.rds_db_instance_details.engine_version` The version of the database engine that was involved in the finding. `findings[].resource.rds_db_instance_details.tags[]` Show child fields `findings[].resource.rds_db_instance_details.tags[].key` The EC2 instance tag key. `findings[].resource.rds_db_instance_details.tags[].value` The EC2 instance tag value. `findings[].resource.rds_db_user_details` Contains information about the user details through which anomalous login attempt was made. Show child fields `findings[].resource.rds_db_user_details.application` The application name used in the anomalous login attempt. `findings[].resource.rds_db_user_details.auth_method` The authentication method used by the user involved in the finding. `findings[].resource.rds_db_user_details.database` The name of the database instance involved in the anomalous login attempt. `findings[].resource.rds_db_user_details.ssl` The version of the Secure Socket Layer (SSL) used for the network. `findings[].resource.rds_db_user_details.user` The user name used in the anomalous login attempt. `findings[].resource.resource_type` The type of Amazon Web Services resource. `findings[].resource.s3_bucket_details[]` Show child fields `findings[].resource.s3_bucket_details[].arn` The Amazon Resource Name (ARN) of the S3 bucket. `findings[].resource.s3_bucket_details[].created_at` The date and time the bucket was created at. `findings[].resource.s3_bucket_details[].default_server_side_encryption` Describes the server side encryption method used in the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].default_server_side_encryption.encryption_type` The type of encryption used for objects within the S3 bucket. `findings[].resource.s3_bucket_details[].default_server_side_encryption.kms_master_key_arn` The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the bucket `EncryptionType` is `aws:kms`. `findings[].resource.s3_bucket_details[].name` The name of the S3 bucket. `findings[].resource.s3_bucket_details[].owner` The owner of the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].owner.id` The canonical user ID of the bucket owner. For information about locating your canonical user ID see Finding Your Account Canonical User ID. `findings[].resource.s3_bucket_details[].public_access` Describes the public access policies that apply to the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.effective_permission` Describes the effective permission on this bucket after factoring all attached policies. `findings[].resource.s3_bucket_details[].public_access.permission_configuration` Contains information about how permissions are configured for the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions` Contains information about the account level permissions on the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions.block_public_access` Describes the S3 Block Public Access settings of the bucket's parent account. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions.block_public_access.block_public_acls` Indicates if S3 Block Public Access is set to `BlockPublicAcls`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions.block_public_access.block_public_policy` Indicates if S3 Block Public Access is set to `BlockPublicPolicy`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions.block_public_access.ignore_public_acls` Indicates if S3 Block Public Access is set to `IgnorePublicAcls`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.account_level_permissions.block_public_access.restrict_public_buckets` Indicates if S3 Block Public Access is set to `RestrictPublicBuckets`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions` Contains information about the bucket level permissions for the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.access_control_list` Contains information on how Access Control Policies are applied to the bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_read_access` A value that indicates whether public read access for the bucket is enabled through an Access Control List (ACL). `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_write_access` A value that indicates whether public write access for the bucket is enabled through an Access Control List (ACL). `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.block_public_access` Contains information on which account level S3 Block Public Access settings are applied to the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_acls` Indicates if S3 Block Public Access is set to `BlockPublicAcls`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_policy` Indicates if S3 Block Public Access is set to `BlockPublicPolicy`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.block_public_access.ignore_public_acls` Indicates if S3 Block Public Access is set to `IgnorePublicAcls`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.block_public_access.restrict_public_buckets` Indicates if S3 Block Public Access is set to `RestrictPublicBuckets`. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.bucket_policy` Contains information on the bucket policies for the S3 bucket. Show child fields `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_read_access` A value that indicates whether public read access for the bucket is enabled through a bucket policy. `findings[].resource.s3_bucket_details[].public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_write_access` A value that indicates whether public write access for the bucket is enabled through a bucket policy. `findings[].resource.s3_bucket_details[].s3_object_details[]` Show child fields `findings[].resource.s3_bucket_details[].s3_object_details[].e_tag` The entity tag is a hash of the S3 object. The ETag reflects changes only to the contents of an object, and not its metadata. `findings[].resource.s3_bucket_details[].s3_object_details[].hash` Hash of the threat detected in this finding. `findings[].resource.s3_bucket_details[].s3_object_details[].key` Key of the S3 object. `findings[].resource.s3_bucket_details[].s3_object_details[].object_arn` Amazon Resource Name (ARN) of the S3 object. `findings[].resource.s3_bucket_details[].s3_object_details[].version_id` Version ID of the object. `findings[].resource.s3_bucket_details[].tags[]` Show child fields `findings[].resource.s3_bucket_details[].tags[].key` The EC2 instance tag key. `findings[].resource.s3_bucket_details[].tags[].value` The EC2 instance tag value. `findings[].resource.s3_bucket_details[].type` Describes whether the bucket is a source or destination bucket. `findings[].schema_version` The version of the schema used for the finding. `findings[].service` Contains additional information about the generated finding. Show child fields `findings[].service.action` Information about the activity that is described in a finding. Show child fields `findings[].service.action.action_type` The GuardDuty finding activity type. `findings[].service.action.aws_api_call_action` Information about the AWS_API_CALL action described in this finding. Show child fields `findings[].service.action.aws_api_call_action.affected_resources` The details of the Amazon Web Services account that made the API call. This field identifies the resources that were affected by this API call. `findings[].service.action.aws_api_call_action.api` The Amazon Web Services API name. `findings[].service.action.aws_api_call_action.caller_type` The Amazon Web Services API caller type. `findings[].service.action.aws_api_call_action.domain_details` The domain information for the Amazon Web Services API call. Show child fields `findings[].service.action.aws_api_call_action.domain_details.domain` The domain information for the Amazon Web Services API call. `findings[].service.action.aws_api_call_action.error_code` The error code of the failed Amazon Web Services API action. `findings[].service.action.aws_api_call_action.remote_account_details` The details of the Amazon Web Services account that made the API call. This field appears if the call was made from outside your account. Show child fields `findings[].service.action.aws_api_call_action.remote_account_details.account_id` The Amazon Web Services account ID of the remote API caller. `findings[].service.action.aws_api_call_action.remote_account_details.affiliated` Details on whether the Amazon Web Services account of the remote API caller is related to your GuardDuty environment. If this value is `True` the API caller is affiliated to your account in some way. If it is `False` the API caller is from outside your environment. `findings[].service.action.aws_api_call_action.remote_ip_details` The remote IP information of the connection that initiated the Amazon Web Services API call. Show child fields `findings[].service.action.aws_api_call_action.remote_ip_details.city` The city information of the remote IP address. Show child fields `findings[].service.action.aws_api_call_action.remote_ip_details.city.city_name` The city name of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.country` The country code of the remote IP address. Show child fields `findings[].service.action.aws_api_call_action.remote_ip_details.country.country_code` The country code of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.country.country_name` The country name of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.geo_location` The location information of the remote IP address. Show child fields `findings[].service.action.aws_api_call_action.remote_ip_details.geo_location.lat` The latitude information of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.geo_location.lon` The longitude information of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.ip_address_v4` The IPv4 remote address of the connection. `findings[].service.action.aws_api_call_action.remote_ip_details.ip_address_v6` The IPv6 remote address of the connection. `findings[].service.action.aws_api_call_action.remote_ip_details.organization` The ISP organization information of the remote IP address. Show child fields `findings[].service.action.aws_api_call_action.remote_ip_details.organization.asn` The Autonomous System Number (ASN) of the internet provider of the remote IP address. `findings[].service.action.aws_api_call_action.remote_ip_details.organization.asn_org` The organization that registered this ASN. `findings[].service.action.aws_api_call_action.remote_ip_details.organization.isp` The ISP information for the internet provider. `findings[].service.action.aws_api_call_action.remote_ip_details.organization.org` The name of the internet provider. `findings[].service.action.aws_api_call_action.service_name` The Amazon Web Services service name whose API was invoked. `findings[].service.action.aws_api_call_action.user_agent` The agent through which the API request was made. `findings[].service.action.dns_request_action` Information about the DNS_REQUEST action described in this finding. Show child fields `findings[].service.action.dns_request_action.blocked` Indicates whether the targeted port is blocked. `findings[].service.action.dns_request_action.domain` The domain information for the DNS query. `findings[].service.action.dns_request_action.domain_with_suffix` The second and top level domain involved in the activity that potentially prompted GuardDuty to generate this finding. For a list of top-level and second-level domains, see public suffix list. `findings[].service.action.dns_request_action.protocol` The network connection protocol observed in the activity that prompted GuardDuty to generate the finding. `findings[].service.action.kubernetes_api_call_action` Information about the Kubernetes API call action described in this finding. Show child fields `findings[].service.action.kubernetes_api_call_action.namespace` The name of the namespace where the Kubernetes API call action takes place. `findings[].service.action.kubernetes_api_call_action.parameters` Parameters related to the Kubernetes API call action. `findings[].service.action.kubernetes_api_call_action.remote_ip_details` Contains information about the remote IP address of the connection. Show child fields `findings[].service.action.kubernetes_api_call_action.remote_ip_details.city` The city information of the remote IP address. Show child fields `findings[].service.action.kubernetes_api_call_action.remote_ip_details.city.city_name` The city name of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.country` The country code of the remote IP address. Show child fields `findings[].service.action.kubernetes_api_call_action.remote_ip_details.country.country_code` The country code of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.country.country_name` The country name of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.geo_location` The location information of the remote IP address. Show child fields `findings[].service.action.kubernetes_api_call_action.remote_ip_details.geo_location.lat` The latitude information of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.geo_location.lon` The longitude information of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.ip_address_v4` The IPv4 remote address of the connection. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.ip_address_v6` The IPv6 remote address of the connection. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.organization` The ISP organization information of the remote IP address. Show child fields `findings[].service.action.kubernetes_api_call_action.remote_ip_details.organization.asn` The Autonomous System Number (ASN) of the internet provider of the remote IP address. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.organization.asn_org` The organization that registered this ASN. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.organization.isp` The ISP information for the internet provider. `findings[].service.action.kubernetes_api_call_action.remote_ip_details.organization.org` The name of the internet provider. `findings[].service.action.kubernetes_api_call_action.request_uri` The Kubernetes API request URI. `findings[].service.action.kubernetes_api_call_action.resource` The resource component in the Kubernetes API call action. `findings[].service.action.kubernetes_api_call_action.resource_name` The name of the resource in the Kubernetes API call action. `findings[].service.action.kubernetes_api_call_action.source_ips[]` `findings[].service.action.kubernetes_api_call_action.status_code` The resulting HTTP response code of the Kubernetes API call action. `findings[].service.action.kubernetes_api_call_action.subresource` The name of the sub-resource in the Kubernetes API call action. `findings[].service.action.kubernetes_api_call_action.user_agent` The user agent of the caller of the Kubernetes API. `findings[].service.action.kubernetes_api_call_action.verb` The Kubernetes API request HTTP verb. `findings[].service.action.kubernetes_permission_checked_details` Information whether the user has the permission to use a specific Kubernetes API. Show child fields `findings[].service.action.kubernetes_permission_checked_details.allowed` Information whether the user has the permission to call the Kubernetes API. `findings[].service.action.kubernetes_permission_checked_details.namespace` The namespace where the Kubernetes API action will take place. `findings[].service.action.kubernetes_permission_checked_details.resource` The Kubernetes resource with which your Kubernetes API call will interact. `findings[].service.action.kubernetes_permission_checked_details.verb` The verb component of the Kubernetes API call. For example, when you check whether or not you have the permission to call the `CreatePod` API, the verb component will be `Create`. `findings[].service.action.kubernetes_role_binding_details` Information about the role binding that grants the permission defined in a Kubernetes role. Show child fields `findings[].service.action.kubernetes_role_binding_details.kind` The kind of the role. For role binding, this value will be `RoleBinding`. `findings[].service.action.kubernetes_role_binding_details.name` The name of the `RoleBinding`. `findings[].service.action.kubernetes_role_binding_details.role_ref_kind` The type of the role being referenced. This could be either `Role` or `ClusterRole`. `findings[].service.action.kubernetes_role_binding_details.role_ref_name` The name of the role being referenced. This must match the name of the `Role` or `ClusterRole` that you want to bind to. `findings[].service.action.kubernetes_role_binding_details.uid` The unique identifier of the role binding. `findings[].service.action.kubernetes_role_details` Information about the Kubernetes role name and role type. Show child fields `findings[].service.action.kubernetes_role_details.kind` The kind of role. For this API, the value of `kind` will be `Role`. `findings[].service.action.kubernetes_role_details.name` The name of the Kubernetes role. `findings[].service.action.kubernetes_role_details.uid` The unique identifier of the Kubernetes role name. `findings[].service.action.network_connection_action` Information about the NETWORK_CONNECTION action described in this finding. Show child fields `findings[].service.action.network_connection_action.blocked` Indicates whether EC2 blocked the network connection to your instance. `findings[].service.action.network_connection_action.connection_direction` The network connection direction. `findings[].service.action.network_connection_action.local_ip_details` The local IP information of the connection. Show child fields `findings[].service.action.network_connection_action.local_ip_details.ip_address_v4` The IPv4 local address of the connection. `findings[].service.action.network_connection_action.local_ip_details.ip_address_v6` The IPv6 local address of the connection. `findings[].service.action.network_connection_action.local_port_details` The local port information of the connection. Show child fields `findings[].service.action.network_connection_action.local_port_details.port` The port number of the local connection. `findings[].service.action.network_connection_action.local_port_details.port_name` The port name of the local connection. `findings[].service.action.network_connection_action.protocol` The network connection protocol. `findings[].service.action.network_connection_action.remote_ip_details` The remote IP information of the connection. Show child fields `findings[].service.action.network_connection_action.remote_ip_details.city` The city information of the remote IP address. Show child fields `findings[].service.action.network_connection_action.remote_ip_details.city.city_name` The city name of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.country` The country code of the remote IP address. Show child fields `findings[].service.action.network_connection_action.remote_ip_details.country.country_code` The country code of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.country.country_name` The country name of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.geo_location` The location information of the remote IP address. Show child fields `findings[].service.action.network_connection_action.remote_ip_details.geo_location.lat` The latitude information of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.geo_location.lon` The longitude information of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.ip_address_v4` The IPv4 remote address of the connection. `findings[].service.action.network_connection_action.remote_ip_details.ip_address_v6` The IPv6 remote address of the connection. `findings[].service.action.network_connection_action.remote_ip_details.organization` The ISP organization information of the remote IP address. Show child fields `findings[].service.action.network_connection_action.remote_ip_details.organization.asn` The Autonomous System Number (ASN) of the internet provider of the remote IP address. `findings[].service.action.network_connection_action.remote_ip_details.organization.asn_org` The organization that registered this ASN. `findings[].service.action.network_connection_action.remote_ip_details.organization.isp` The ISP information for the internet provider. `findings[].service.action.network_connection_action.remote_ip_details.organization.org` The name of the internet provider. `findings[].service.action.network_connection_action.remote_port_details` The remote port information of the connection. Show child fields `findings[].service.action.network_connection_action.remote_port_details.port` The port number of the remote connection. `findings[].service.action.network_connection_action.remote_port_details.port_name` The port name of the remote connection. `findings[].service.action.port_probe_action` Information about the PORT_PROBE action described in this finding. Show child fields `findings[].service.action.port_probe_action.blocked` Indicates whether EC2 blocked the port probe to the instance, such as with an ACL. `findings[].service.action.port_probe_action.port_probe_details[]` Show child fields `findings[].service.action.port_probe_action.port_probe_details[].local_ip_details` The local IP information of the connection. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].local_ip_details.ip_address_v4` The IPv4 local address of the connection. `findings[].service.action.port_probe_action.port_probe_details[].local_ip_details.ip_address_v6` The IPv6 local address of the connection. `findings[].service.action.port_probe_action.port_probe_details[].local_port_details` The local port information of the connection. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].local_port_details.port` The port number of the local connection. `findings[].service.action.port_probe_action.port_probe_details[].local_port_details.port_name` The port name of the local connection. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details` The remote IP information of the connection. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.city` The city information of the remote IP address. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.city.city_name` The city name of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.country` The country code of the remote IP address. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.country.country_code` The country code of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.country.country_name` The country name of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.geo_location` The location information of the remote IP address. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.geo_location.lat` The latitude information of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.geo_location.lon` The longitude information of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.ip_address_v4` The IPv4 remote address of the connection. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.ip_address_v6` The IPv6 remote address of the connection. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.organization` The ISP organization information of the remote IP address. Show child fields `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.organization.asn` The Autonomous System Number (ASN) of the internet provider of the remote IP address. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.organization.asn_org` The organization that registered this ASN. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.organization.isp` The ISP information for the internet provider. `findings[].service.action.port_probe_action.port_probe_details[].remote_ip_details.organization.org` The name of the internet provider. `findings[].service.action.rds_login_attempt_action` Information about `RDS_LOGIN_ATTEMPT` action described in this finding. Show child fields `findings[].service.action.rds_login_attempt_action.login_attributes[]` Show child fields `findings[].service.action.rds_login_attempt_action.login_attributes[].application` Indicates the application name used to attempt log in. `findings[].service.action.rds_login_attempt_action.login_attributes[].failed_login_attempts` Represents the sum of failed (unsuccessful) login attempts made to establish a connection to the database instance. `findings[].service.action.rds_login_attempt_action.login_attributes[].successful_login_attempts` Represents the sum of successful connections (a correct combination of login attributes) made to the database instance by the actor. `findings[].service.action.rds_login_attempt_action.login_attributes[].user` Indicates the user name which attempted to log in. `findings[].service.action.rds_login_attempt_action.remote_ip_details` Contains information about the remote IP address of the connection. Show child fields `findings[].service.action.rds_login_attempt_action.remote_ip_details.city` The city information of the remote IP address. Show child fields `findings[].service.action.rds_login_attempt_action.remote_ip_details.city.city_name` The city name of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.country` The country code of the remote IP address. Show child fields `findings[].service.action.rds_login_attempt_action.remote_ip_details.country.country_code` The country code of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.country.country_name` The country name of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.geo_location` The location information of the remote IP address. Show child fields `findings[].service.action.rds_login_attempt_action.remote_ip_details.geo_location.lat` The latitude information of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.geo_location.lon` The longitude information of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.ip_address_v4` The IPv4 remote address of the connection. `findings[].service.action.rds_login_attempt_action.remote_ip_details.ip_address_v6` The IPv6 remote address of the connection. `findings[].service.action.rds_login_attempt_action.remote_ip_details.organization` The ISP organization information of the remote IP address. Show child fields `findings[].service.action.rds_login_attempt_action.remote_ip_details.organization.asn` The Autonomous System Number (ASN) of the internet provider of the remote IP address. `findings[].service.action.rds_login_attempt_action.remote_ip_details.organization.asn_org` The organization that registered this ASN. `findings[].service.action.rds_login_attempt_action.remote_ip_details.organization.isp` The ISP information for the internet provider. `findings[].service.action.rds_login_attempt_action.remote_ip_details.organization.org` The name of the internet provider. `findings[].service.additional_info` Contains additional information about the generated finding. Show child fields `findings[].service.additional_info.type` Describes the type of the additional information. `findings[].service.additional_info.value` This field specifies the value of the additional information. `findings[].service.archived` Indicates whether this finding is archived. `findings[].service.count` The total count of the occurrences of this finding type. `findings[].service.detection` Contains information about the detected unusual behavior. Show child fields `findings[].service.detection.anomaly` The details about the anomalous activity that caused GuardDuty to generate the finding. Show child fields `findings[].service.detection.anomaly.profiles` Information about the types of profiles. `findings[].service.detection.anomaly.unusual` Information about the behavior of the anomalies. Show child fields `findings[].service.detection.anomaly.unusual.behavior` The behavior of the anomalous activity that caused GuardDuty to generate the finding. `findings[].service.detector_id` The detector ID for the GuardDuty service. `findings[].service.ebs_volume_scan_details` Returns details from the malware scan that created a finding. Show child fields `findings[].service.ebs_volume_scan_details.scan_completed_at` Returns the completion date and time of the malware scan. `findings[].service.ebs_volume_scan_details.scan_detections` Contains a complete view providing malware scan result details. Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details` Details of the highest severity threat detected during malware scan and number of infected files. Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.count` Total number of infected files with the highest severity threat detected. `findings[].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.severity` Severity level of the highest severity threat detected. `findings[].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.threat_name` Threat name of the highest severity threat detected as part of the malware scan. `findings[].service.ebs_volume_scan_details.scan_detections.scanned_item_count` Total number of scanned files. Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.scanned_item_count.files` Number of files scanned. `findings[].service.ebs_volume_scan_details.scan_detections.scanned_item_count.total_gb` Total GB of files scanned for malware. `findings[].service.ebs_volume_scan_details.scan_detections.scanned_item_count.volumes` Total number of scanned volumes. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name` Contains details about identified threats organized by threat name. Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.item_count` Total number of infected files identified. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.shortened` Flag to determine if the finding contains every single infected file-path and/or every threat. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[]` Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].file_paths[]` Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].file_paths[].file_name` File name of the infected file. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].file_paths[].file_path` The file path of the infected file. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].file_paths[].hash` The hash value of the infected file. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].file_paths[].volume_arn` EBS volume ARN details of the infected file. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].item_count` Total number of files infected with given threat. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].name` The name of the identified threat. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[].severity` Severity of threat identified as part of the malware scan. `findings[].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.unique_threat_name_count` Total number of unique threats by name identified, as part of the malware scan. `findings[].service.ebs_volume_scan_details.scan_detections.threats_detected_item_count` Total number of infected files. Show child fields `findings[].service.ebs_volume_scan_details.scan_detections.threats_detected_item_count.files` Total number of infected files. `findings[].service.ebs_volume_scan_details.scan_id` Unique Id of the malware scan that generated the finding. `findings[].service.ebs_volume_scan_details.scan_started_at` Returns the start date and time of the malware scan. `findings[].service.ebs_volume_scan_details.scan_type` Specifies the scan type that invoked the malware scan. `findings[].service.ebs_volume_scan_details.sources[]` `findings[].service.ebs_volume_scan_details.trigger_finding_id` GuardDuty finding ID that triggered a malware scan. `findings[].service.event_first_seen` The first-seen timestamp of the activity that prompted GuardDuty to generate this finding. `findings[].service.event_last_seen` The last-seen timestamp of the activity that prompted GuardDuty to generate this finding. `findings[].service.evidence` An evidence object associated with the service. Show child fields `findings[].service.evidence.threat_intelligence_details[]` Show child fields `findings[].service.evidence.threat_intelligence_details[].threat_file_sha256` SHA256 of the file that generated the finding. `findings[].service.evidence.threat_intelligence_details[].threat_list_name` The name of the threat intelligence list that triggered the finding. `findings[].service.evidence.threat_intelligence_details[].threat_names[]` `findings[].service.feature_name` The name of the feature that generated a finding. `findings[].service.malware_scan_details` Returns details from the malware scan that generated a GuardDuty finding. Show child fields `findings[].service.malware_scan_details.threats[]` Show child fields `findings[].service.malware_scan_details.threats[].item_paths[]` Show child fields `findings[].service.malware_scan_details.threats[].item_paths[].hash` The hash value of the infected resource. `findings[].service.malware_scan_details.threats[].item_paths[].nested_item_path` The nested item path where the infected file was found. `findings[].service.malware_scan_details.threats[].name` Name of the detected threat that caused GuardDuty to generate this finding. `findings[].service.malware_scan_details.threats[].source` Source of the threat that generated this finding. `findings[].service.resource_role` The resource role information for this finding. `findings[].service.runtime_details` Information about the process and any required context values for a specific finding Show child fields `findings[].service.runtime_details.context` Additional information about the suspicious activity. Show child fields `findings[].service.runtime_details.context.address_family` Represents the communication protocol associated with the address. For example, the address family `AF_INET` is used for IP version of 4 protocol. `findings[].service.runtime_details.context.command_line_example` Example of the command line involved in the suspicious activity. `findings[].service.runtime_details.context.file_system_type` Represents the type of mounted fileSystem. `findings[].service.runtime_details.context.flags[]` `findings[].service.runtime_details.context.iana_protocol_number` Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family `AF_INET` only has the IP protocol. `findings[].service.runtime_details.context.ld_preload_value` The value of the LD_PRELOAD environment variable. `findings[].service.runtime_details.context.library_path` The path to the new library that was loaded. `findings[].service.runtime_details.context.memory_regions[]` `findings[].service.runtime_details.context.modified_at` The timestamp at which the process modified the current process. The timestamp is in UTC date string format. `findings[].service.runtime_details.context.modifying_process` Information about the process that modified the current process. This is available for multiple finding types. Show child fields `findings[].service.runtime_details.context.modifying_process.euid` The effective user ID of the user that executed the process. `findings[].service.runtime_details.context.modifying_process.executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.context.modifying_process.executable_sha256` The `SHA256` hash of the process executable. `findings[].service.runtime_details.context.modifying_process.lineage[]` Show child fields `findings[].service.runtime_details.context.modifying_process.lineage[].euid` The effective user ID that was used to execute the process. `findings[].service.runtime_details.context.modifying_process.lineage[].executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.context.modifying_process.lineage[].name` The name of the process. `findings[].service.runtime_details.context.modifying_process.lineage[].namespace_pid` The process ID of the child process. `findings[].service.runtime_details.context.modifying_process.lineage[].parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.context.modifying_process.lineage[].pid` The ID of the process. `findings[].service.runtime_details.context.modifying_process.lineage[].start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.context.modifying_process.lineage[].user_id` The user ID of the user that executed the process. `findings[].service.runtime_details.context.modifying_process.lineage[].uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.runtime_details.context.modifying_process.name` The name of the process. `findings[].service.runtime_details.context.modifying_process.namespace_pid` The ID of the child process. `findings[].service.runtime_details.context.modifying_process.parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.context.modifying_process.pid` The ID of the process. `findings[].service.runtime_details.context.modifying_process.pwd` The present working directory of the process. `findings[].service.runtime_details.context.modifying_process.start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.context.modifying_process.user` The user that executed the process. `findings[].service.runtime_details.context.modifying_process.user_id` The unique ID of the user that executed the process. `findings[].service.runtime_details.context.modifying_process.uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.runtime_details.context.module_file_path` The path to the module loaded into the kernel. `findings[].service.runtime_details.context.module_name` The name of the module loaded into the kernel. `findings[].service.runtime_details.context.module_sha256` The `SHA256` hash of the module. `findings[].service.runtime_details.context.mount_source` The path on the host that is mounted by the container. `findings[].service.runtime_details.context.mount_target` The path in the container that is mapped to the host directory. `findings[].service.runtime_details.context.release_agent_path` The path in the container that modified the release agent file. `findings[].service.runtime_details.context.runc_binary_path` The path to the leveraged `runc` implementation. `findings[].service.runtime_details.context.script_path` The path to the script that was executed. `findings[].service.runtime_details.context.service_name` Name of the security service that has been potentially disabled. `findings[].service.runtime_details.context.shell_history_file_path` The path to the modified shell history file. `findings[].service.runtime_details.context.socket_path` The path to the docket socket that was accessed. `findings[].service.runtime_details.context.target_process` Information about the process that had its memory overwritten by the current process. Show child fields `findings[].service.runtime_details.context.target_process.euid` The effective user ID of the user that executed the process. `findings[].service.runtime_details.context.target_process.executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.context.target_process.executable_sha256` The `SHA256` hash of the process executable. `findings[].service.runtime_details.context.target_process.lineage[]` Show child fields `findings[].service.runtime_details.context.target_process.lineage[].euid` The effective user ID that was used to execute the process. `findings[].service.runtime_details.context.target_process.lineage[].executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.context.target_process.lineage[].name` The name of the process. `findings[].service.runtime_details.context.target_process.lineage[].namespace_pid` The process ID of the child process. `findings[].service.runtime_details.context.target_process.lineage[].parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.context.target_process.lineage[].pid` The ID of the process. `findings[].service.runtime_details.context.target_process.lineage[].start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.context.target_process.lineage[].user_id` The user ID of the user that executed the process. `findings[].service.runtime_details.context.target_process.lineage[].uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.runtime_details.context.target_process.name` The name of the process. `findings[].service.runtime_details.context.target_process.namespace_pid` The ID of the child process. `findings[].service.runtime_details.context.target_process.parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.context.target_process.pid` The ID of the process. `findings[].service.runtime_details.context.target_process.pwd` The present working directory of the process. `findings[].service.runtime_details.context.target_process.start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.context.target_process.user` The user that executed the process. `findings[].service.runtime_details.context.target_process.user_id` The unique ID of the user that executed the process. `findings[].service.runtime_details.context.target_process.uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.runtime_details.context.threat_file_path` The suspicious file path for which the threat intelligence details were found. `findings[].service.runtime_details.context.tool_category` Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer. `findings[].service.runtime_details.context.tool_name` Name of the potentially suspicious tool. `findings[].service.runtime_details.process` Information about the observed process. Show child fields `findings[].service.runtime_details.process.euid` The effective user ID of the user that executed the process. `findings[].service.runtime_details.process.executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.process.executable_sha256` The `SHA256` hash of the process executable. `findings[].service.runtime_details.process.lineage[]` Show child fields `findings[].service.runtime_details.process.lineage[].euid` The effective user ID that was used to execute the process. `findings[].service.runtime_details.process.lineage[].executable_path` The absolute path of the process executable file. `findings[].service.runtime_details.process.lineage[].name` The name of the process. `findings[].service.runtime_details.process.lineage[].namespace_pid` The process ID of the child process. `findings[].service.runtime_details.process.lineage[].parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.process.lineage[].pid` The ID of the process. `findings[].service.runtime_details.process.lineage[].start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.process.lineage[].user_id` The user ID of the user that executed the process. `findings[].service.runtime_details.process.lineage[].uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.runtime_details.process.name` The name of the process. `findings[].service.runtime_details.process.namespace_pid` The ID of the child process. `findings[].service.runtime_details.process.parent_uuid` The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty. `findings[].service.runtime_details.process.pid` The ID of the process. `findings[].service.runtime_details.process.pwd` The present working directory of the process. `findings[].service.runtime_details.process.start_time` The time when the process started. This is in UTC format. `findings[].service.runtime_details.process.user` The user that executed the process. `findings[].service.runtime_details.process.user_id` The unique ID of the user that executed the process. `findings[].service.runtime_details.process.uuid` The unique ID assigned to the process by GuardDuty. `findings[].service.service_name` The name of the Amazon Web Services service (GuardDuty) that generated a finding. `findings[].service.user_feedback` Feedback that was submitted about the finding. `findings[].severity` The severity of the finding. `findings[].title` The title of the finding. `findings[].type` The type of finding. `findings[].updated_at` The time and date when the finding was last updated.