#[non_exhaustive]pub struct Signal {Show 15 fields
pub type: Option<String>,
pub id: Option<String>,
pub title: Option<String>,
pub product_arn: Option<String>,
pub resource_ids: Option<Vec<String>>,
pub signal_indicators: Option<Vec<Indicator>>,
pub name: Option<String>,
pub created_at: Option<i64>,
pub updated_at: Option<i64>,
pub first_seen_at: Option<i64>,
pub last_seen_at: Option<i64>,
pub severity: Option<f64>,
pub count: Option<i32>,
pub actor_ids: Option<Vec<String>>,
pub endpoint_ids: Option<Vec<String>>,
}Expand description
Contains information about the signals involved in an Amazon GuardDuty Extended Threat Detection attack sequence. An attack sequence is a type of threat detected by GuardDuty. GuardDuty generates an attack sequence finding when multiple events, or signals, align to a potentially suspicious activity. When GuardDuty and Security Hub are integrated, GuardDuty sends attack sequence findings to Security Hub.
A signal can be an API activity or a finding that GuardDuty uses to detect an attack sequence finding.
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.type: Option<String>The type of the signal used to identify an attack sequence.
Signals can be GuardDuty findings or activities observed in data sources that GuardDuty monitors. For more information, see GuardDuty foundational data sources in the Amazon GuardDuty User Guide.
A signal type can be one of the following values. Here are the related descriptions:
-
FINDING- Individually generated GuardDuty finding. -
CLOUD_TRAIL- Activity observed from CloudTrail logs -
S3_DATA_EVENTS- Activity observed from CloudTrail data events for Amazon Simple Storage Service (S3). Activities associated with this type will show up only when you have enabled GuardDuty S3 Protection feature in your account. For more information about S3 Protection and the steps to enable it, see S3 Protection in the Amazon GuardDuty User Guide.
id: Option<String>The identifier of the signal.
title: Option<String>The description of the GuardDuty finding.
product_arn: Option<String>The Amazon Resource Name (ARN) of the product that generated the signal.
resource_ids: Option<Vec<String>>The ARN or ID of the Amazon Web Services resource associated with the signal.
signal_indicators: Option<Vec<Indicator>>Contains information about the indicators associated with the signals in this attack sequence finding. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.
name: Option<String>The name of the GuardDuty signal. For example, when signal type is FINDING, the signal name is the name of the finding.
created_at: Option<i64>The timestamp when the first finding or activity related to this signal was observed.
updated_at: Option<i64>The timestamp when this signal was last observed.
first_seen_at: Option<i64>The timestamp when the first finding or activity related to this signal was observed.
last_seen_at: Option<i64>The timestamp when the last finding or activity related to this signal was observed.
severity: Option<f64>The severity associated with the signal. For more information about severity, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide.
count: Option<i32>The number of times this signal was observed.
actor_ids: Option<Vec<String>>The IDs of the threat actors involved in the signal.
endpoint_ids: Option<Vec<String>>Information about the endpoint IDs associated with this signal.
Implementations§
Source§impl Signal
impl Signal
Sourcepub fn type(&self) -> Option<&str>
pub fn type(&self) -> Option<&str>
The type of the signal used to identify an attack sequence.
Signals can be GuardDuty findings or activities observed in data sources that GuardDuty monitors. For more information, see GuardDuty foundational data sources in the Amazon GuardDuty User Guide.
A signal type can be one of the following values. Here are the related descriptions:
-
FINDING- Individually generated GuardDuty finding. -
CLOUD_TRAIL- Activity observed from CloudTrail logs -
S3_DATA_EVENTS- Activity observed from CloudTrail data events for Amazon Simple Storage Service (S3). Activities associated with this type will show up only when you have enabled GuardDuty S3 Protection feature in your account. For more information about S3 Protection and the steps to enable it, see S3 Protection in the Amazon GuardDuty User Guide.
Sourcepub fn product_arn(&self) -> Option<&str>
pub fn product_arn(&self) -> Option<&str>
The Amazon Resource Name (ARN) of the product that generated the signal.
Sourcepub fn resource_ids(&self) -> &[String]
pub fn resource_ids(&self) -> &[String]
The ARN or ID of the Amazon Web Services resource associated with the signal.
If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .resource_ids.is_none().
Sourcepub fn signal_indicators(&self) -> &[Indicator]
pub fn signal_indicators(&self) -> &[Indicator]
Contains information about the indicators associated with the signals in this attack sequence finding. The values for SignalIndicators are a subset of the values for SequenceIndicators, but the values for these fields don't always match 1:1.
If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .signal_indicators.is_none().
Sourcepub fn name(&self) -> Option<&str>
pub fn name(&self) -> Option<&str>
The name of the GuardDuty signal. For example, when signal type is FINDING, the signal name is the name of the finding.
Sourcepub fn created_at(&self) -> Option<i64>
pub fn created_at(&self) -> Option<i64>
The timestamp when the first finding or activity related to this signal was observed.
Sourcepub fn updated_at(&self) -> Option<i64>
pub fn updated_at(&self) -> Option<i64>
The timestamp when this signal was last observed.
Sourcepub fn first_seen_at(&self) -> Option<i64>
pub fn first_seen_at(&self) -> Option<i64>
The timestamp when the first finding or activity related to this signal was observed.
Sourcepub fn last_seen_at(&self) -> Option<i64>
pub fn last_seen_at(&self) -> Option<i64>
The timestamp when the last finding or activity related to this signal was observed.
Sourcepub fn severity(&self) -> Option<f64>
pub fn severity(&self) -> Option<f64>
The severity associated with the signal. For more information about severity, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide.
Sourcepub fn actor_ids(&self) -> &[String]
pub fn actor_ids(&self) -> &[String]
The IDs of the threat actors involved in the signal.
If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .actor_ids.is_none().
Sourcepub fn endpoint_ids(&self) -> &[String]
pub fn endpoint_ids(&self) -> &[String]
Information about the endpoint IDs associated with this signal.
If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .endpoint_ids.is_none().
Trait Implementations§
impl StructuralPartialEq for Signal
Auto Trait Implementations§
impl Freeze for Signal
impl RefUnwindSafe for Signal
impl Send for Signal
impl Sync for Signal
impl Unpin for Signal
impl UnwindSafe for Signal
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§impl<T> Instrument for T
impl<T> Instrument for T
Source§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
Source§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§impl<T> Paint for Twhere
T: ?Sized,
impl<T> Paint for Twhere
T: ?Sized,
Source§fn fg(&self, value: Color) -> Painted<&T>
fn fg(&self, value: Color) -> Painted<&T>
Returns a styled value derived from self with the foreground set to
value.
This method should be used rarely. Instead, prefer to use color-specific
builder methods like red() and
green(), which have the same functionality but are
pithier.
§Example
Set foreground color to white using fg():
use yansi::{Paint, Color};
painted.fg(Color::White);Set foreground color to white using white().
use yansi::Paint;
painted.white();Source§fn bright_black(&self) -> Painted<&T>
fn bright_black(&self) -> Painted<&T>
Source§fn bright_red(&self) -> Painted<&T>
fn bright_red(&self) -> Painted<&T>
Source§fn bright_green(&self) -> Painted<&T>
fn bright_green(&self) -> Painted<&T>
Source§fn bright_yellow(&self) -> Painted<&T>
fn bright_yellow(&self) -> Painted<&T>
Source§fn bright_blue(&self) -> Painted<&T>
fn bright_blue(&self) -> Painted<&T>
Source§fn bright_magenta(&self) -> Painted<&T>
fn bright_magenta(&self) -> Painted<&T>
Source§fn bright_cyan(&self) -> Painted<&T>
fn bright_cyan(&self) -> Painted<&T>
Source§fn bright_white(&self) -> Painted<&T>
fn bright_white(&self) -> Painted<&T>
Source§fn bg(&self, value: Color) -> Painted<&T>
fn bg(&self, value: Color) -> Painted<&T>
Returns a styled value derived from self with the background set to
value.
This method should be used rarely. Instead, prefer to use color-specific
builder methods like on_red() and
on_green(), which have the same functionality but
are pithier.
§Example
Set background color to red using fg():
use yansi::{Paint, Color};
painted.bg(Color::Red);Set background color to red using on_red().
use yansi::Paint;
painted.on_red();Source§fn on_primary(&self) -> Painted<&T>
fn on_primary(&self) -> Painted<&T>
Source§fn on_magenta(&self) -> Painted<&T>
fn on_magenta(&self) -> Painted<&T>
Source§fn on_bright_black(&self) -> Painted<&T>
fn on_bright_black(&self) -> Painted<&T>
Source§fn on_bright_red(&self) -> Painted<&T>
fn on_bright_red(&self) -> Painted<&T>
Source§fn on_bright_green(&self) -> Painted<&T>
fn on_bright_green(&self) -> Painted<&T>
Source§fn on_bright_yellow(&self) -> Painted<&T>
fn on_bright_yellow(&self) -> Painted<&T>
Source§fn on_bright_blue(&self) -> Painted<&T>
fn on_bright_blue(&self) -> Painted<&T>
Source§fn on_bright_magenta(&self) -> Painted<&T>
fn on_bright_magenta(&self) -> Painted<&T>
Source§fn on_bright_cyan(&self) -> Painted<&T>
fn on_bright_cyan(&self) -> Painted<&T>
Source§fn on_bright_white(&self) -> Painted<&T>
fn on_bright_white(&self) -> Painted<&T>
Source§fn attr(&self, value: Attribute) -> Painted<&T>
fn attr(&self, value: Attribute) -> Painted<&T>
Enables the styling Attribute value.
This method should be used rarely. Instead, prefer to use
attribute-specific builder methods like bold() and
underline(), which have the same functionality
but are pithier.
§Example
Make text bold using attr():
use yansi::{Paint, Attribute};
painted.attr(Attribute::Bold);Make text bold using using bold().
use yansi::Paint;
painted.bold();Source§fn rapid_blink(&self) -> Painted<&T>
fn rapid_blink(&self) -> Painted<&T>
Source§fn quirk(&self, value: Quirk) -> Painted<&T>
fn quirk(&self, value: Quirk) -> Painted<&T>
Enables the yansi Quirk value.
This method should be used rarely. Instead, prefer to use quirk-specific
builder methods like mask() and
wrap(), which have the same functionality but are
pithier.
§Example
Enable wrapping using .quirk():
use yansi::{Paint, Quirk};
painted.quirk(Quirk::Wrap);Enable wrapping using wrap().
use yansi::Paint;
painted.wrap();Source§fn clear(&self) -> Painted<&T>
👎Deprecated since 1.0.1: renamed to resetting() due to conflicts with Vec::clear().
The clear() method will be removed in a future release.
fn clear(&self) -> Painted<&T>
resetting() due to conflicts with Vec::clear().
The clear() method will be removed in a future release.Source§fn whenever(&self, value: Condition) -> Painted<&T>
fn whenever(&self, value: Condition) -> Painted<&T>
Conditionally enable styling based on whether the Condition value
applies. Replaces any previous condition.
See the crate level docs for more details.
§Example
Enable styling painted only when both stdout and stderr are TTYs:
use yansi::{Paint, Condition};
painted.red().on_yellow().whenever(Condition::STDOUTERR_ARE_TTY);