Skip to content
AWS for Query.Farm

aws.iot.list_violation_events

Example SQL Queries

SELECT * FROM
aws.iot.list_violation_events
WHERE
"start_time" = 'VALUE'
AND "end_time" = 'VALUE';

Description

Lists the Device Defender security profile violations discovered during the given time period. You can use filters to limit the results to those alerts issued for a particular security profile, behavior, or thing (device).

Requires permission to access the ListViolationEvents action.

Table Definition

Column NameColumn Data Type
end_time Required Input Column

The end time for the alerts to be listed.

TIMESTAMP_S
start_time Required Input Column

The start time for the alerts to be listed.

TIMESTAMP_S
behavior_criteria_type Input Column

The criteria for a behavior. 

VARCHAR
list_suppressed_alerts Input Column

A list of all suppressed alerts. 

BOOLEAN
security_profile_name Input Column

The name of the security profile whose behavior was violated.

VARCHAR
thing_name Input Column

The name of the thing responsible for the violation event.

VARCHAR
verification_state Input Column

The verification state of the violation (detect alarm).

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
behavior

The behavior that was violated.

STRUCT(
    "name" VARCHAR,
    "metric" VARCHAR,
    "metric_dimension" STRUCT(
        "dimension_name" VARCHAR,
        "operator" VARCHAR
    ),
    "criteria" STRUCT(
        "comparison_operator" VARCHAR,
        "value" STRUCT(
            "count" BIGINT,
            "cidrs" VARCHAR[],
            "ports" BIGINT[],
            "number" DOUBLE,
            "numbers" DOUBLE[],
            "strings" VARCHAR[]
        ),
        "duration_seconds" BIGINT,
        "consecutive_datapoints_to_alarm" BIGINT,
        "consecutive_datapoints_to_clear" BIGINT,
        "statistical_threshold" STRUCT(
            "statistic" VARCHAR
        ),
        "ml_detection_config" STRUCT(
            "confidence_level" VARCHAR
        )
    ),
    "suppress_alerts" BOOLEAN,
    "export_metric" BOOLEAN
)
Show child fields
behavior.criteria

The criteria that determine if a device is behaving normally in regard to the metric.

In the IoT console, you can choose to be sent an alert through Amazon SNS when IoT Device Defender detects that a device is behaving anomalously.

Show child fields
behavior.criteria.comparison_operator

The operator that relates the thing measured (metric) to the criteria (containing a value or statisticalThreshold). Valid operators include:

  • string-list: in-set and not-in-set

  • number-list: in-set and not-in-set

  • ip-address-list: in-cidr-set and not-in-cidr-set

  • number: less-than, less-than-equals, greater-than, and greater-than-equals

behavior.criteria.consecutive_datapoints_to_alarm

If a device is in violation of the behavior for the specified number of consecutive datapoints, an alarm occurs. If not specified, the default is 1.

behavior.criteria.consecutive_datapoints_to_clear

If an alarm has occurred and the offending device is no longer in violation of the behavior for the specified number of consecutive datapoints, the alarm is cleared. If not specified, the default is 1.

behavior.criteria.duration_seconds

Use this to specify the time duration over which the behavior is evaluated, for those criteria that have a time dimension (for example, NUM_MESSAGES_SENT). For a statisticalThreshhold metric comparison, measurements from all devices are accumulated over this time duration before being used to calculate percentiles, and later, measurements from an individual device are also accumulated over this time duration before being given a percentile rank. Cannot be used with list-based metric datatypes.

behavior.criteria.ml_detection_config

The configuration of an ML Detect

Show child fields
behavior.criteria.ml_detection_config.confidence_level

The sensitivity of anomalous behavior evaluation. Can be Low, Medium, or High.

behavior.criteria.statistical_threshold

A statistical ranking (percentile)that indicates a threshold value by which a behavior is determined to be in compliance or in violation of the behavior.

Show child fields
behavior.criteria.statistical_threshold.statistic

The percentile that resolves to a threshold value by which compliance with a behavior is determined. Metrics are collected over the specified period (durationSeconds) from all reporting devices in your account and statistical ranks are calculated. Then, the measurements from a device are collected over the same period. If the accumulated measurements from the device fall above or below (comparisonOperator) the value associated with the percentile specified, then the device is considered to be in compliance with the behavior, otherwise a violation occurs.

behavior.criteria.value

The value to be compared with the metric.

Show child fields
behavior.criteria.value.cidrs[]
behavior.criteria.value.count

If the comparisonOperator calls for a numeric value, use this to specify that numeric value to be compared with the metric.

behavior.criteria.value.number

The numeral value of a metric.

behavior.criteria.value.numbers[]
behavior.criteria.value.ports[]
behavior.criteria.value.strings[]
behavior.export_metric

Value indicates exporting metrics related to the behavior when it is true.

behavior.metric

What is measured by the behavior.

behavior.metric_dimension

The dimension for a metric in your behavior. For example, using a TOPIC_FILTER dimension, you can narrow down the scope of the metric to only MQTT topics where the name matches the pattern specified in the dimension. This can't be used with custom metrics.

Show child fields
behavior.metric_dimension.dimension_name

A unique identifier for the dimension.

behavior.metric_dimension.operator

Defines how the dimensionValues of a dimension are interpreted. For example, for dimension type TOPIC_FILTER, the IN operator, a message will be counted only if its topic matches one of the topic filters. With NOT_IN operator, a message will be counted only if it doesn't match any of the topic filters. The operator is optional: if it's not provided (is null), it will be interpreted as IN.

behavior.name

The name you've given to the behavior.

behavior.suppress_alerts

Suppresses alerts.

metric_value

The value of the metric (the measurement).

STRUCT(
    "count" BIGINT,
    "cidrs" VARCHAR[],
    "ports" BIGINT[],
    "number" DOUBLE,
    "numbers" DOUBLE[],
    "strings" VARCHAR[]
)
Show child fields
metric_value.cidrs[]
metric_value.count

If the comparisonOperator calls for a numeric value, use this to specify that numeric value to be compared with the metric.

metric_value.number

The numeral value of a metric.

metric_value.numbers[]
metric_value.ports[]
metric_value.strings[]
verification_state_description

The description of the verification state of the violation.

VARCHAR
violation_event_additional_info

The details of a violation event. 

STRUCT(
    "confidence_level" VARCHAR
)
Show child fields
violation_event_additional_info.confidence_level

The sensitivity of anomalous behavior evaluation. Can be Low, Medium, or High.

violation_event_time

The time the violation event occurred.

TIMESTAMP_S
violation_event_type

The type of violation event.

VARCHAR
violation_id

The ID of the violation event.

VARCHAR