| Column Name | Column Data Type |
|---|
account_ids Required Input Column
The account ID of the member account. | VARCHAR[] |
Show child fields- account_ids[]
|
detector_id Required Input Column
The detector ID for the administrator account. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
member_data_source_configurations
An object that describes which data sources are enabled for a member account. | STRUCT(
"account_id" VARCHAR,
"data_sources" STRUCT(
"cloud_trail" STRUCT(
"status" VARCHAR
),
"dns_logs" STRUCT(
"status" VARCHAR
),
"flow_logs" STRUCT(
"status" VARCHAR
),
"s3_logs" STRUCT(
"status" VARCHAR
),
"kubernetes" STRUCT(
"audit_logs" STRUCT(
"status" VARCHAR
)
),
"malware_protection" STRUCT(
"scan_ec2_instance_with_findings" STRUCT(
"ebs_volumes" STRUCT(
"status" VARCHAR,
"reason" VARCHAR
)
),
"service_role" VARCHAR
)
),
"features" STRUCT(
"name" VARCHAR,
"status" VARCHAR,
"updated_at" TIMESTAMP_S,
"additional_configuration" STRUCT(
"name" VARCHAR,
"status" VARCHAR,
"updated_at" TIMESTAMP_S
)[]
)[]
)[] |
Show child fields- member_data_source_configurations[]
Show child fields- member_data_source_configurations[].account_id
The account ID for the member account. - member_data_source_configurations[].data_sources
Contains information on the status of data sources for the account. Show child fields- member_data_source_configurations[].data_sources.cloud_trail
An object that contains information on the status of CloudTrail as a data source. Show child fields- member_data_source_configurations[].data_sources.cloud_trail.status
Describes whether CloudTrail is enabled as a data source for the detector.
- member_data_source_configurations[].data_sources.dns_logs
An object that contains information on the status of DNS logs as a data source. Show child fields- member_data_source_configurations[].data_sources.dns_logs.status
Denotes whether DNS logs is enabled as a data source.
- member_data_source_configurations[].data_sources.flow_logs
An object that contains information on the status of VPC flow logs as a data source. Show child fields- member_data_source_configurations[].data_sources.flow_logs.status
Denotes whether VPC flow logs is enabled as a data source.
- member_data_source_configurations[].data_sources.kubernetes
An object that contains information on the status of all Kubernetes data sources. Show child fields- member_data_source_configurations[].data_sources.kubernetes.audit_logs
Describes whether Kubernetes audit logs are enabled as a data source. Show child fields- member_data_source_configurations[].data_sources.kubernetes.audit_logs.status
A value that describes whether Kubernetes audit logs are enabled as a data source.
- member_data_source_configurations[].data_sources.malware_protection
Describes the configuration of Malware Protection data sources. Show child fields- member_data_source_configurations[].data_sources.malware_protection.scan_ec2_instance_with_findings
Describes the configuration of Malware Protection for EC2 instances with findings. Show child fields- member_data_source_configurations[].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes
Describes the configuration of scanning EBS volumes as a data source. Show child fields- member_data_source_configurations[].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason
Specifies the reason why scanning EBS volumes (Malware Protection) was not enabled as a data source. - member_data_source_configurations[].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status
Describes whether scanning EBS volumes is enabled as a data source.
- member_data_source_configurations[].data_sources.malware_protection.service_role
The GuardDuty Malware Protection service role.
- member_data_source_configurations[].data_sources.s3_logs
An object that contains information on the status of S3 Data event logs as a data source. Show child fields- member_data_source_configurations[].data_sources.s3_logs.status
A value that describes whether S3 data event logs are automatically enabled for new members of the organization.
- member_data_source_configurations[].features[]
Show child fields- member_data_source_configurations[].features[].additional_configuration[]
Show child fields- member_data_source_configurations[].features[].additional_configuration[].name
Indicates the name of the additional configuration that is set for the member account. - member_data_source_configurations[].features[].additional_configuration[].status
Indicates the status of the additional configuration that is set for the member account. - member_data_source_configurations[].features[].additional_configuration[].updated_at
The timestamp at which the additional configuration was set for the member account. This is in UTC format.
- member_data_source_configurations[].features[].name
Indicates the name of the feature that is enabled for the detector. - member_data_source_configurations[].features[].status
Indicates the status of the feature that is enabled for the detector. - member_data_source_configurations[].features[].updated_at
The timestamp at which the feature object was updated.
|
unprocessed_accounts
A list of member account IDs that were unable to be processed along with an explanation for why they were not processed. | STRUCT(
"account_id" VARCHAR,
"result" VARCHAR
)[] |
Show child fields- unprocessed_accounts[]
Show child fields- unprocessed_accounts[].account_id
The Amazon Web Services account ID. - unprocessed_accounts[].result
A reason why the account hasn't been processed.
|