| Column Name | Column Data Type |
|---|
end_time Required Input Column
The end of the time period for which ML Detect mitigation actions tasks are returned. | TIMESTAMP_S |
start_time Required Input Column
A filter to limit results to those found after the specified time. You must specify either the startTime and endTime or the taskId, but not both. | TIMESTAMP_S |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
actions_definition
The definition of the actions. | STRUCT(
"name" VARCHAR,
"id" VARCHAR,
"role_arn" VARCHAR,
"action_params" STRUCT(
"update_device_certificate_params" STRUCT(
"action" VARCHAR
),
"update_ca_certificate_params" STRUCT(
"action" VARCHAR
),
"add_things_to_thing_group_params" STRUCT(
"thing_group_names" VARCHAR[],
"override_dynamic_groups" BOOLEAN
),
"replace_default_policy_version_params" STRUCT(
"template_name" VARCHAR
),
"enable_io_t_logging_params" STRUCT(
"role_arn_for_logging" VARCHAR,
"log_level" VARCHAR
),
"publish_finding_to_sns_params" STRUCT(
"topic_arn" VARCHAR
)
)
)[] |
Show child fields- actions_definition[]
Show child fields- actions_definition[].action_params
The set of parameters for this mitigation action. The parameters vary, depending on the kind of action you apply. Show child fields- actions_definition[].action_params.add_things_to_thing_group_params
Parameters to define a mitigation action that moves devices associated with a certificate to one or more specified thing groups, typically for quarantine. Show child fields- actions_definition[].action_params.add_things_to_thing_group_params.override_dynamic_groups
Specifies if this mitigation action can move the things that triggered the mitigation action even if they are part of one or more dynamic thing groups. - actions_definition[].action_params.add_things_to_thing_group_params.thing_group_names[]
- actions_definition[].action_params.enable_io_t_logging_params
Parameters to define a mitigation action that enables Amazon Web Services IoT Core logging at a specified level of detail. Show child fields- actions_definition[].action_params.enable_io_t_logging_params.log_level
Specifies the type of information to be logged. - actions_definition[].action_params.enable_io_t_logging_params.role_arn_for_logging
The Amazon Resource Name (ARN) of the IAM role used for logging.
- actions_definition[].action_params.publish_finding_to_sns_params
Parameters to define a mitigation action that publishes findings to Amazon Simple Notification Service (Amazon SNS. You can implement your own custom actions in response to the Amazon SNS messages. Show child fields- actions_definition[].action_params.publish_finding_to_sns_params.topic_arn
The ARN of the topic to which you want to publish the findings.
- actions_definition[].action_params.replace_default_policy_version_params
Parameters to define a mitigation action that adds a blank policy to restrict permissions. Show child fields- actions_definition[].action_params.replace_default_policy_version_params.template_name
The name of the template to be applied. The only supported value is BLANK_POLICY.
- actions_definition[].action_params.update_ca_certificate_params
Parameters to define a mitigation action that changes the state of the CA certificate to inactive. Show child fields- actions_definition[].action_params.update_ca_certificate_params.action
The action that you want to apply to the CA certificate. The only supported value is DEACTIVATE.
- actions_definition[].action_params.update_device_certificate_params
Parameters to define a mitigation action that changes the state of the device certificate to inactive. Show child fields- actions_definition[].action_params.update_device_certificate_params.action
The action that you want to apply to the device certificate. The only supported value is DEACTIVATE.
- actions_definition[].id
A unique identifier for the mitigation action. - actions_definition[].name
A user-friendly name for the mitigation action. - actions_definition[].role_arn
The IAM role ARN used to apply this mitigation action.
|
only_active_violations_included
Includes only active violations. | BOOLEAN |
suppressed_alerts_included
Includes suppressed alerts. | BOOLEAN |
target
Specifies the ML Detect findings to which the mitigation actions are applied. | STRUCT(
"violation_ids" VARCHAR[],
"security_profile_name" VARCHAR,
"behavior_name" VARCHAR
) |
Show child fields- target.behavior_name
The name of the behavior. - target.security_profile_name
The name of the security profile. - target.violation_ids[]
|
task_end_time
The date the task ended. | TIMESTAMP_S |
task_id
The unique identifier of the task. | VARCHAR |
task_start_time
The date the task started. | TIMESTAMP_S |
task_statistics
The statistics of a mitigation action task. | STRUCT(
"actions_executed" BIGINT,
"actions_skipped" BIGINT,
"actions_failed" BIGINT
) |
Show child fields- task_statistics.actions_executed
The actions that were performed. - task_statistics.actions_failed
The actions that failed. - task_statistics.actions_skipped
The actions that were skipped.
|
task_status
The status of the task. | VARCHAR |
violation_event_occurrence_range
Specifies the time period of which violation events occurred between. | STRUCT(
"start_time" TIMESTAMP_S,
"end_time" TIMESTAMP_S
) |
Show child fields- violation_event_occurrence_range.end_time
The end date and time of a time period in which violation events occurred. - violation_event_occurrence_range.start_time
The start date and time of a time period in which violation events occurred.
|