| Column Name | Column Data Type |
|---|
detector_id Required Input Column
The unique ID of the GuardDuty detector associated with the resource. | VARCHAR |
filter_criteria Input Column
Represents the criteria used to filter the coverage details. | STRUCT(
"filter_criterion" STRUCT(
"criterion_key" VARCHAR,
"filter_condition" STRUCT(
"equals" VARCHAR[],
"not_equals" VARCHAR[]
)
)[]
) |
Show child fields- filter_criteria.filter_criterion[]
Show child fields- filter_criteria.filter_criterion[].criterion_key
An enum value representing possible filter fields. Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME. CLUSTER_NAME has been deprecated. - filter_criteria.filter_criterion[].filter_condition
Contains information about the condition. Show child fields- filter_criteria.filter_criterion[].filter_condition.equals[]
- filter_criteria.filter_criterion[].filter_condition.not_equals[]
|
sort_criteria Input Column
Represents the criteria used to sort the coverage details. | STRUCT(
"attribute_name" VARCHAR,
"order_by" VARCHAR
) |
Show child fields- sort_criteria.attribute_name
Represents the field name used to sort the coverage details. Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME. CLUSTER_NAME has been deprecated. - sort_criteria.order_by
The order in which the sorted findings are to be displayed.
|
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
account_id
The unique ID of the Amazon Web Services account. | VARCHAR |
coverage_status
Represents the status of the EKS cluster coverage. | VARCHAR |
issue
Represents the reason why a coverage status was UNHEALTHY for the EKS cluster. | VARCHAR |
resource_details
Information about the resource for which the coverage statistics are retrieved. | STRUCT(
"eks_cluster_details" STRUCT(
"cluster_name" VARCHAR,
"covered_nodes" BIGINT,
"compatible_nodes" BIGINT,
"addon_details" STRUCT(
"addon_version" VARCHAR,
"addon_status" VARCHAR
),
"management_type" VARCHAR
),
"resource_type" VARCHAR,
"ecs_cluster_details" STRUCT(
"cluster_name" VARCHAR,
"fargate_details" STRUCT(
"issues" VARCHAR[],
"management_type" VARCHAR
),
"container_instance_details" STRUCT(
"covered_container_instances" BIGINT,
"compatible_container_instances" BIGINT
)
),
"ec2_instance_details" STRUCT(
"instance_id" VARCHAR,
"instance_type" VARCHAR,
"cluster_arn" VARCHAR,
"agent_details" STRUCT(
"version" VARCHAR
),
"management_type" VARCHAR
)
) |
Show child fields- resource_details.ec2_instance_details
Information about the Amazon EC2 instance assessed for runtime coverage. Show child fields- resource_details.ec2_instance_details.agent_details
Information about the installed security agent. Show child fields- resource_details.ec2_instance_details.agent_details.version
Version of the installed GuardDuty security agent.
- resource_details.ec2_instance_details.cluster_arn
The cluster ARN of the Amazon ECS cluster running on the Amazon EC2 instance. - resource_details.ec2_instance_details.instance_id
The Amazon EC2 instance ID. - resource_details.ec2_instance_details.instance_type
The instance type of the Amazon EC2 instance. - resource_details.ec2_instance_details.management_type
Indicates how the GuardDuty security agent is managed for this resource. -
AUTO_MANAGED indicates that GuardDuty deploys and manages updates for this resource. -
MANUAL indicates that you are responsible to deploy, update, and manage the GuardDuty security agent updates for this resource. The DISABLED status doesn't apply to Amazon EC2 instances and Amazon EKS clusters.
- resource_details.ecs_cluster_details
Information about the Amazon ECS cluster that is assessed for runtime coverage. Show child fields- resource_details.ecs_cluster_details.cluster_name
The name of the Amazon ECS cluster. - resource_details.ecs_cluster_details.container_instance_details
Information about the Amazon ECS container running on Amazon EC2 instance. Show child fields- resource_details.ecs_cluster_details.container_instance_details.compatible_container_instances
Represents total number of nodes in the Amazon ECS cluster. - resource_details.ecs_cluster_details.container_instance_details.covered_container_instances
Represents the nodes in the Amazon ECS cluster that has a HEALTHY coverage status.
- resource_details.ecs_cluster_details.fargate_details
Information about the Fargate details associated with the Amazon ECS cluster. Show child fields- resource_details.ecs_cluster_details.fargate_details.issues[]
- resource_details.ecs_cluster_details.fargate_details.management_type
Indicates how the GuardDuty security agent is managed for this resource. The MANUAL status doesn't apply to the Amazon Web Services Fargate (Amazon ECS only) woprkloads.
- resource_details.eks_cluster_details
EKS cluster details involved in the coverage statistics. Show child fields- resource_details.eks_cluster_details.addon_details
Information about the installed EKS add-on. Show child fields- resource_details.eks_cluster_details.addon_details.addon_status
Status of the installed EKS add-on. - resource_details.eks_cluster_details.addon_details.addon_version
Version of the installed EKS add-on.
- resource_details.eks_cluster_details.cluster_name
Name of the EKS cluster. - resource_details.eks_cluster_details.compatible_nodes
Represents all the nodes within the EKS cluster in your account. - resource_details.eks_cluster_details.covered_nodes
Represents the nodes within the EKS cluster that have a HEALTHY coverage status. - resource_details.eks_cluster_details.management_type
Indicates how the Amazon EKS add-on GuardDuty agent is managed for this EKS cluster. AUTO_MANAGED indicates GuardDuty deploys and manages updates for this resource. MANUAL indicates that you are responsible to deploy, update, and manage the Amazon EKS add-on GuardDuty agent for this resource.
- resource_details.resource_type
The type of Amazon Web Services resource.
|
resource_id
The unique ID of the resource. | VARCHAR |
updated_at
The timestamp at which the coverage details for the resource were last updated. This is in UTC format. | TIMESTAMP_S |