Struct Sequence

#[non_exhaustive]
pub struct Sequence {
    pub uid: Option<String>,
    pub actors: Option<Vec<Actor>>,
    pub endpoints: Option<Vec<NetworkEndpoint>>,
    pub signals: Option<Vec<Signal>>,
    pub sequence_indicators: Option<Vec<Indicator>>,
}

Contains information about an Amazon GuardDuty Extended Threat Detection attack sequence finding. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

uid: Option<String>

Unique identifier of the attack sequence.

actors: Option<Vec<Actor>>

Provides information about the actors involved in the attack sequence.

endpoints: Option<Vec<NetworkEndpoint>>

Contains information about the network endpoints that were used in the attack sequence.

signals: Option<Vec<Signal>>

Contains information about the signals involved in the attack sequence.

sequence_indicators: Option<Vec<Indicator>>

Contains information about the indicators observed in the attack sequence. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.

Implementations

impl Sequence

pub fn uid(&self) -> Option<&str>

Unique identifier of the attack sequence.

pub fn actors(&self) -> &[Actor]

Provides information about the actors involved in the attack sequence.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .actors.is_none().

pub fn endpoints(&self) -> &[NetworkEndpoint]

Contains information about the network endpoints that were used in the attack sequence.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .endpoints.is_none().

pub fn signals(&self) -> &[Signal]

Contains information about the signals involved in the attack sequence.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .signals.is_none().

pub fn sequence_indicators(&self) -> &[Indicator]

Contains information about the indicators observed in the attack sequence. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .sequence_indicators.is_none().

impl Sequence

pub fn builder() -> SequenceBuilder

Creates a new builder-style object to manufacture Sequence.

Trait Implementations

impl Clone for Sequence

fn clone(&self) -> Sequence

Returns a duplicate of the value.

const fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sequence

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Sequence

fn eq(&self, other: &Sequence) -> bool

Tests for self and other values to be equal, and is used by ==.

const fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Sequence