| Column Name | Column Data Type |
|---|
detector_id Required Input Column
The unique ID of the detector of the GuardDuty member account. | VARCHAR |
account_ids Input Column
A list of account identifiers of the GuardDuty member account. | VARCHAR[] |
Show child fields- account_ids[]
|
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
accounts
The member accounts which were included in a request and were processed successfully. | STRUCT(
"account_id" VARCHAR,
"data_sources" STRUCT(
"cloud_trail" STRUCT(
"free_trial_days_remaining" BIGINT
),
"dns_logs" STRUCT(
"free_trial_days_remaining" BIGINT
),
"flow_logs" STRUCT(
"free_trial_days_remaining" BIGINT
),
"s3_logs" STRUCT(
"free_trial_days_remaining" BIGINT
),
"kubernetes" STRUCT(
"audit_logs" STRUCT(
"free_trial_days_remaining" BIGINT
)
),
"malware_protection" STRUCT(
"scan_ec2_instance_with_findings" STRUCT(
"free_trial_days_remaining" BIGINT
)
)
),
"features" STRUCT(
"name" VARCHAR,
"free_trial_days_remaining" BIGINT
)[]
)[] |
Show child fields- accounts[]
Show child fields- accounts[].account_id
The account identifier of the GuardDuty member account. - accounts[].data_sources
Describes the data source enabled for the GuardDuty member account. Show child fields- accounts[].data_sources.cloud_trail
Describes whether any Amazon Web Services CloudTrail management event logs are enabled as data sources. Show child fields- accounts[].data_sources.cloud_trail.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].data_sources.dns_logs
Describes whether any DNS logs are enabled as data sources. Show child fields- accounts[].data_sources.dns_logs.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].data_sources.flow_logs
Describes whether any VPC Flow logs are enabled as data sources. Show child fields- accounts[].data_sources.flow_logs.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].data_sources.kubernetes
Describes whether any Kubernetes logs are enabled as data sources. Show child fields- accounts[].data_sources.kubernetes.audit_logs
Describes whether Kubernetes audit logs are enabled as a data source. Show child fields- accounts[].data_sources.kubernetes.audit_logs.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].data_sources.malware_protection
Describes whether Malware Protection is enabled as a data source. Show child fields- accounts[].data_sources.malware_protection.scan_ec2_instance_with_findings
Describes whether Malware Protection for EC2 instances with findings is enabled as a data source. Show child fields- accounts[].data_sources.malware_protection.scan_ec2_instance_with_findings.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].data_sources.s3_logs
Describes whether any S3 data event logs are enabled as data sources. Show child fields- accounts[].data_sources.s3_logs.free_trial_days_remaining
A value that specifies the number of days left to use each enabled data source.
- accounts[].features[]
Show child fields- accounts[].features[].free_trial_days_remaining
The number of the remaining free trial days for the feature. - accounts[].features[].name
The name of the feature for which the free trial is configured.
|
unprocessed_accounts
The member account that was included in a request but for which the request could not be processed. | STRUCT(
"account_id" VARCHAR,
"result" VARCHAR
)[] |
Show child fields- unprocessed_accounts[]
Show child fields- unprocessed_accounts[].account_id
The Amazon Web Services account ID. - unprocessed_accounts[].result
A reason why the account hasn't been processed.
|