The Amazon Detective API contains several data types that various actions use. This section describes each data type in detail.
Note
The order of each element in a data type structure is not guaranteed. Applications should not assume a particular order.
The following data types are supported:
• Account (p. 70)
• Administrator (p. 71)
• Graph (p. 72)
• MemberDetail (p. 73)
• UnprocessedAccount (p. 77)
Account
Account
An AWS account that is the administrator account of or a member of a behavior graph.
Contents
AccountId
The account identifier of the AWS account.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: Yes EmailAddress
The AWS account root user email address for the AWS account.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern: ^.+@.+$
Required: Yes
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for Ruby V3
Administrator
Administrator
Information about the Detective administrator account for an organization.
Contents
AccountId
The AWS account identifier of the Detective administrator account for the organization.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: No DelegationTime
The date and time when the Detective administrator account was enabled. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
Type: Timestamp Required: No GraphArn
The ARN of the organization behavior graph.
Type: String
Pattern: ^arn:aws[-\w]{0,10}?:detective:[-\w]{2,20}?:\d{12}?:graph:[abcdef\d]
{32}?$
Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for Ruby V3
Graph
Graph
A behavior graph in Detective.
Contents
Arn
The ARN of the behavior graph.
Type: String
Pattern: ^arn:aws[-\w]{0,10}?:detective:[-\w]{2,20}?:\d{12}?:graph:[abcdef\d]
{32}?$
Required: No CreatedTime
The date and time that the behavior graph was created. The value is an ISO8601 formatted string.
For example, 2021-08-18T16:35:56.284Z.
Type: Timestamp Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for Ruby V3
MemberDetail
MemberDetail
Details about a member account in a behavior graph.
Contents
AccountId
The AWS account identifier for the member account.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: No AdministratorId
The AWS account identifier of the administrator account for the behavior graph.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: No DisabledReason
For member accounts with a status of ACCEPTED_BUT_DISABLED, the reason that the member account is not enabled.
The reason can have one of the following values:
• VOLUME_TOO_HIGH - Indicates that adding the member account would cause the data volume for the behavior graph to be too high.
• VOLUME_UNKNOWN - Indicates that Detective is unable to verify the data volume for the member account. This is usually because the member account is not enrolled in Amazon GuardDuty.
Type: String
Valid Values: VOLUME_TOO_HIGH | VOLUME_UNKNOWN Required: No
EmailAddress
The AWS account root user email address for the member account.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern: ^.+@.+$
Required: No GraphArn
The ARN of the behavior graph.
Contents
The type of behavior graph membership.
For an organization account in the organization behavior graph, the type is ORGANIZATION.
For an account that was invited to a behavior graph, the type is INVITATION.
Type: String
Valid Values: INVITATION | ORGANIZATION Required: No
InvitedTime
For invited accounts, the date and time that Detective sent the invitation to the account. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
Type: Timestamp Required: No MasterId
This member has been deprecated.
The AWS account identifier of the administrator account for the behavior graph.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: No
PercentOfGraphUtilization
This member has been deprecated.
The member account data volume as a percentage of the maximum allowed data volume. 0 indicates 0 percent, and 100 indicates 100 percent.
Note that this is not the percentage of the behavior graph data volume.
For example, the data volume for the behavior graph is 80 GB per day. The maximum data volume is 160 GB per day. If the data volume for the member account is 40 GB per day, then PercentOfGraphUtilization is 25. It represents 25% of the maximum allowed data volume.
Type: Double Required: No
PercentOfGraphUtilizationUpdatedTime This member has been deprecated.
The date and time when the graph utilization percentage was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
Contents
Type: Timestamp Required: No Status
The current membership status of the member account. The status can have one of the following values:
• INVITED - For invited accounts only. Indicates that the member was sent an invitation but has not yet responded.
• VERIFICATION_IN_PROGRESS - For invited accounts only, indicates that Detective is verifying that the account identifier and email address provided for the member account match. If they do match, then Detective sends the invitation. If the email address and account identifier don't match, then the member cannot be added to the behavior graph.
For organization accounts in the organization behavior graph, indicates that Detective is verifying that the account belongs to the organization.
• VERIFICATION_FAILED - For invited accounts only. Indicates that the account and email address provided for the member account do not match, and Detective did not send an invitation to the account.
• ENABLED - Indicates that the member account currently contributes data to the behavior graph.
For invited accounts, the member account accepted the invitation. For organization accounts in the organization behavior graph, the Detective administrator account enabled the organization account as a member account.
• ACCEPTED_BUT_DISABLED - The account accepted the invitation, or was enabled by the Detective administrator account, but is prevented from contributing data to the behavior graph.
DisabledReason provides the reason why the member account is not enabled.
Invited accounts that declined an invitation or that were removed from the behavior graph are not included. In the organization behavior graph, organization accounts that the Detective administrator account did not enable are not included.
Type: String
Valid Values: INVITED | VERIFICATION_IN_PROGRESS | VERIFICATION_FAILED | ENABLED | ACCEPTED_BUT_DISABLED
Required: No UpdatedTime
The date and time that the member account was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
Type: Timestamp Required: No VolumeUsageInBytes
The data volume in bytes per day for the member account.
Type: Long Required: No
VolumeUsageUpdatedTime
The data and time when the member account data volume was last updated. The value is an ISO8601 formatted string. For example, 2021-08-18T16:35:56.284Z.
Type: Timestamp
See Also
Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for Ruby V3
UnprocessedAccount
UnprocessedAccount
A member account that was included in a request but for which the request could not be processed.
Contents
AccountId
The AWS account identifier of the member account that was not processed.
Type: String
Length Constraints: Fixed length of 12.
Pattern: ^[0-9]+$
Required: No Reason
The reason that the member account request could not be processed.
Type: String Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for Ruby V3