Struct Indicator

#[non_exhaustive]
pub struct Indicator {
    pub key: Option<String>,
    pub values: Option<Vec<String>>,
    pub title: Option<String>,
    pub type: Option<String>,
}

Contains information about the indicators observed in an Amazon GuardDuty Extended Threat Detection attack sequence. Indicators include a set of signals, which can be API activities or findings that GuardDuty uses to detect an attack sequence finding. GuardDuty generates an attack sequence finding when multiple signals align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub, you must have GuardDuty and GuardDuty S3 Protection enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

key: Option<String>

The name of the indicator that’s present in the attack sequence finding.

values: Option<Vec<String>>

Values associated with each indicator key. For example, if the indicator key is SUSPICIOUS_NETWORK, then the value will be the name of the network. If the indicator key is ATTACK_TACTIC, then the value will be one of the MITRE tactics.

title: Option<String>

The title describing the indicator.

type: Option<String>

The type of indicator.

Implementations

impl Indicator

pub fn key(&self) -> Option<&str>

The name of the indicator that’s present in the attack sequence finding.

pub fn values(&self) -> &[String]

Values associated with each indicator key. For example, if the indicator key is SUSPICIOUS_NETWORK, then the value will be the name of the network. If the indicator key is ATTACK_TACTIC, then the value will be one of the MITRE tactics.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .values.is_none().

pub fn title(&self) -> Option<&str>

The title describing the indicator.

pub fn type(&self) -> Option<&str>

The type of indicator.

impl Indicator

pub fn builder() -> IndicatorBuilder

Creates a new builder-style object to manufacture Indicator.

Trait Implementations

impl Clone for Indicator

fn clone(&self) -> Indicator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Indicator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Indicator

fn eq(&self, other: &Indicator) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Indicator