Struct ActorSession

#[non_exhaustive]
pub struct ActorSession {
    pub uid: Option<String>,
    pub mfa_status: Option<ActorSessionMfaStatus>,
    pub created_time: Option<i64>,
    pub issuer: Option<String>,
}

Contains information about the authenticated session used by the threat actor identified in an Amazon GuardDuty Extended Threat Detection attack sequence. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in Security Hub, you must have GuardDuty enabled. For more information, see GuardDuty Extended Threat Detection in the Amazon GuardDuty User Guide.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

uid: Option<String>

Unique identifier of the session.

mfa_status: Option<ActorSessionMfaStatus>

Indicates whether multi-factor authentication (MFA) was used for authentication during the session.

In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.mfaAuthenticated.

created_time: Option<i64>

The timestamp for when the session was created.

In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.creationDate.

issuer: Option<String>

The issuer of the session.

In CloudTrail, you can find this value as userIdentity.sessionContext.sessionIssuer.arn.

Implementations

impl ActorSession

pub fn uid(&self) -> Option<&str>

Unique identifier of the session.

pub fn mfa_status(&self) -> Option<&ActorSessionMfaStatus>

Indicates whether multi-factor authentication (MFA) was used for authentication during the session.

In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.mfaAuthenticated.

pub fn created_time(&self) -> Option<i64>

The timestamp for when the session was created.

In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.creationDate.

pub fn issuer(&self) -> Option<&str>

The issuer of the session.

In CloudTrail, you can find this value as userIdentity.sessionContext.sessionIssuer.arn.

impl ActorSession

pub fn builder() -> ActorSessionBuilder

Creates a new builder-style object to manufacture ActorSession.

Trait Implementations

impl Clone for ActorSession

fn clone(&self) -> ActorSession

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ActorSession

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for ActorSession

fn eq(&self, other: &ActorSession) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ActorSession