Skip to content
AWS for Query.Farm

aws.iot.describe_security_profile

Example SQL Queries

SELECT * FROM
aws.iot.describe_security_profile
WHERE
"security_profile_name" = 'VALUE';

Description

Gets information about a Device Defender security profile.

Requires permission to access the DescribeSecurityProfile action.

Table Definition

Column NameColumn Data Type
security_profile_name Required Input Column

The name of the security profile.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
additional_metrics_to_retain

Please use DescribeSecurityProfileResponse$additionalMetricsToRetainV2 instead.

A list of metrics whose data is retained (stored). By default, data is retained for any metric used in the profile's behaviors, but it is also retained for any metric specified here.

VARCHAR[]
Show child fields
additional_metrics_to_retain[]
additional_metrics_to_retain_v2

A list of metrics whose data is retained (stored). By default, data is retained for any metric used in the profile's behaviors, but it is also retained for any metric specified here.

STRUCT(
    "metric" VARCHAR,
    "metric_dimension" STRUCT(
        "dimension_name" VARCHAR,
        "operator" VARCHAR
    ),
    "export_metric" BOOLEAN
)[]
Show child fields
additional_metrics_to_retain_v2[]
Show child fields
additional_metrics_to_retain_v2[].export_metric

The value indicates exporting metrics related to the MetricToRetain when it's true.

additional_metrics_to_retain_v2[].metric

What is measured by the behavior.

additional_metrics_to_retain_v2[].metric_dimension

The dimension of a metric. This can't be used with custom metrics.

Show child fields
additional_metrics_to_retain_v2[].metric_dimension.dimension_name

A unique identifier for the dimension.

additional_metrics_to_retain_v2[].metric_dimension.operator

Defines how the dimensionValues of a dimension are interpreted. For example, for dimension type TOPIC_FILTER, the IN operator, a message will be counted only if its topic matches one of the topic filters. With NOT_IN operator, a message will be counted only if it doesn't match any of the topic filters. The operator is optional: if it's not provided (is null), it will be interpreted as IN.

alert_targets

Where the alerts are sent. (Alerts are always sent to the console.)

MAP(VARCHAR, STRUCT(
        "alert_target_arn" VARCHAR,
        "role_arn" VARCHAR
    ))
behaviors

Specifies the behaviors that, when violated by a device (thing), cause an alert.

STRUCT(
    "name" VARCHAR,
    "metric" VARCHAR,
    "metric_dimension" STRUCT(
        "dimension_name" VARCHAR,
        "operator" VARCHAR
    ),
    "criteria" STRUCT(
        "comparison_operator" VARCHAR,
        "value" STRUCT(
            "count" BIGINT,
            "cidrs" VARCHAR[],
            "ports" BIGINT[],
            "number" DOUBLE,
            "numbers" DOUBLE[],
            "strings" VARCHAR[]
        ),
        "duration_seconds" BIGINT,
        "consecutive_datapoints_to_alarm" BIGINT,
        "consecutive_datapoints_to_clear" BIGINT,
        "statistical_threshold" STRUCT(
            "statistic" VARCHAR
        ),
        "ml_detection_config" STRUCT(
            "confidence_level" VARCHAR
        )
    ),
    "suppress_alerts" BOOLEAN,
    "export_metric" BOOLEAN
)[]
Show child fields
behaviors[]
Show child fields
behaviors[].criteria

The criteria that determine if a device is behaving normally in regard to the metric.

In the IoT console, you can choose to be sent an alert through Amazon SNS when IoT Device Defender detects that a device is behaving anomalously.

Show child fields
behaviors[].criteria.comparison_operator

The operator that relates the thing measured (metric) to the criteria (containing a value or statisticalThreshold). Valid operators include:

  • string-list: in-set and not-in-set

  • number-list: in-set and not-in-set

  • ip-address-list: in-cidr-set and not-in-cidr-set

  • number: less-than, less-than-equals, greater-than, and greater-than-equals

behaviors[].criteria.consecutive_datapoints_to_alarm

If a device is in violation of the behavior for the specified number of consecutive datapoints, an alarm occurs. If not specified, the default is 1.

behaviors[].criteria.consecutive_datapoints_to_clear

If an alarm has occurred and the offending device is no longer in violation of the behavior for the specified number of consecutive datapoints, the alarm is cleared. If not specified, the default is 1.

behaviors[].criteria.duration_seconds

Use this to specify the time duration over which the behavior is evaluated, for those criteria that have a time dimension (for example, NUM_MESSAGES_SENT). For a statisticalThreshhold metric comparison, measurements from all devices are accumulated over this time duration before being used to calculate percentiles, and later, measurements from an individual device are also accumulated over this time duration before being given a percentile rank. Cannot be used with list-based metric datatypes.

behaviors[].criteria.ml_detection_config

The configuration of an ML Detect

Show child fields
behaviors[].criteria.ml_detection_config.confidence_level

The sensitivity of anomalous behavior evaluation. Can be Low, Medium, or High.

behaviors[].criteria.statistical_threshold

A statistical ranking (percentile)that indicates a threshold value by which a behavior is determined to be in compliance or in violation of the behavior.

Show child fields
behaviors[].criteria.statistical_threshold.statistic

The percentile that resolves to a threshold value by which compliance with a behavior is determined. Metrics are collected over the specified period (durationSeconds) from all reporting devices in your account and statistical ranks are calculated. Then, the measurements from a device are collected over the same period. If the accumulated measurements from the device fall above or below (comparisonOperator) the value associated with the percentile specified, then the device is considered to be in compliance with the behavior, otherwise a violation occurs.

behaviors[].criteria.value

The value to be compared with the metric.

Show child fields
behaviors[].criteria.value.cidrs[]
behaviors[].criteria.value.count

If the comparisonOperator calls for a numeric value, use this to specify that numeric value to be compared with the metric.

behaviors[].criteria.value.number

The numeral value of a metric.

behaviors[].criteria.value.numbers[]
behaviors[].criteria.value.ports[]
behaviors[].criteria.value.strings[]
behaviors[].export_metric

Value indicates exporting metrics related to the behavior when it is true.

behaviors[].metric

What is measured by the behavior.

behaviors[].metric_dimension

The dimension for a metric in your behavior. For example, using a TOPIC_FILTER dimension, you can narrow down the scope of the metric to only MQTT topics where the name matches the pattern specified in the dimension. This can't be used with custom metrics.

Show child fields
behaviors[].metric_dimension.dimension_name

A unique identifier for the dimension.

behaviors[].metric_dimension.operator

Defines how the dimensionValues of a dimension are interpreted. For example, for dimension type TOPIC_FILTER, the IN operator, a message will be counted only if its topic matches one of the topic filters. With NOT_IN operator, a message will be counted only if it doesn't match any of the topic filters. The operator is optional: if it's not provided (is null), it will be interpreted as IN.

behaviors[].name

The name you've given to the behavior.

behaviors[].suppress_alerts

Suppresses alerts.

creation_date

The time the security profile was created.

TIMESTAMP_S
last_modified_date

The time the security profile was last modified.

TIMESTAMP_S
metrics_export_config

Specifies the MQTT topic and role ARN required for metric export.

STRUCT(
    "mqtt_topic" VARCHAR,
    "role_arn" VARCHAR
)
Show child fields
metrics_export_config.mqtt_topic

The MQTT topic that Device Defender Detect should publish messages to for metrics export.

metrics_export_config.role_arn

This role ARN has permission to publish MQTT messages, after which Device Defender Detect can assume the role and publish messages on your behalf.

security_profile_arn

The ARN of the security profile.

VARCHAR
security_profile_description

A description of the security profile (associated with the security profile when it was created or updated).

VARCHAR
version

The version of the security profile. A new version is generated whenever the security profile is updated.

BIGINT