Class: AWSCDK::GuardDuty::CfnFilter::FindingCriteriaProperty

Inherits:

Jsii::Struct

• Object
• Jsii::Struct
• AWSCDK::GuardDuty::CfnFilter::FindingCriteriaProperty

Defined in:

guard_duty/cfn_filter.rb

Overview

Represents a map of finding properties that match specified conditions and values when querying findings.

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-guardduty-filter-findingcriteria.html

Instance Attribute Summary

• #criterion ⇒ Object^? readonly

  Represents a map of finding properties that match specified conditions and values when querying findings.

• #item_type ⇒ AWSCDK::IResolvable, ... readonly

Class Method Summary

• .jsii_properties ⇒ Object

Instance Method Summary

• #initialize(criterion: nil, item_type: nil) ⇒ FindingCriteriaProperty constructor

  A new instance of FindingCriteriaProperty.

• #to_jsii ⇒ Object

Constructor Details

#initialize(criterion: nil, item_type: nil) ⇒ FindingCriteriaProperty

Returns a new instance of FindingCriteriaProperty.

Parameters:

• criterion (Object, nil) (defaults to: nil) —

  Represents a map of finding properties that match specified conditions and values when querying findings.

• item_type (AWSCDK::IResolvable, AWSCDK::GuardDuty::CfnFilter::ConditionProperty, nil) (defaults to: nil)

# File 'guard_duty/cfn_filter.rb', line 725

def initialize(criterion: nil, item_type: nil)
  @criterion = criterion
  Jsii::Type.check_type(@criterion, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJhbnkifQ==")), "criterion") unless @criterion.nil?
  @item_type = item_type.is_a?(Hash) ? ::AWSCDK::GuardDuty::CfnFilter::ConditionProperty.new(**item_type.transform_keys(&:to_sym)) : item_type
  Jsii::Type.check_type(@item_type, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19ndWFyZGR1dHkuQ2ZuRmlsdGVyLkNvbmRpdGlvblByb3BlcnR5In1dfX0=")), "itemType") unless @item_type.nil?
end

Instance Attribute Details

#criterion ⇒ Object^? (readonly)

Represents a map of finding properties that match specified conditions and values when querying findings.

For information about JSON criterion mapping to their console equivalent, see Finding criteria . The following are the available criterion:

• accountId
• id
• region
• severity

To filter on the basis of severity, the API and AWS CLI use the following input list for the FindingCriteria condition:

• Low : ["1", "2", "3"]
• Medium : ["4", "5", "6"]
• High : ["7", "8", "9"]

For more information, see Severity levels for GuardDuty findings in the Amazon GuardDuty User Guide .

• type
• updatedAt

Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

• resource.accessKeyDetails.accessKeyId
• resource.accessKeyDetails.principalId
• resource.accessKeyDetails.userName
• resource.accessKeyDetails.userType
• resource.instanceDetails.iamInstanceProfile.id
• resource.instanceDetails.imageId
• resource.instanceDetails.instanceId
• resource.instanceDetails.tags.key
• resource.instanceDetails.tags.value
• resource.instanceDetails.networkInterfaces.ipv6Addresses
• resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress
• resource.instanceDetails.networkInterfaces.publicDnsName
• resource.instanceDetails.networkInterfaces.publicIp
• resource.instanceDetails.networkInterfaces.securityGroups.groupId
• resource.instanceDetails.networkInterfaces.securityGroups.groupName
• resource.instanceDetails.networkInterfaces.subnetId
• resource.instanceDetails.networkInterfaces.vpcId
• resource.instanceDetails.outpostArn
• resource.resourceType
• resource.s3BucketDetails.publicAccess.effectivePermissions
• resource.s3BucketDetails.name
• resource.s3BucketDetails.tags.key
• resource.s3BucketDetails.tags.value
• resource.s3BucketDetails.type
• service.action.actionType
• service.action.awsApiCallAction.api
• service.action.awsApiCallAction.callerType
• service.action.awsApiCallAction.errorCode
• service.action.awsApiCallAction.remoteIpDetails.city.cityName
• service.action.awsApiCallAction.remoteIpDetails.country.countryName
• service.action.awsApiCallAction.remoteIpDetails.ipAddressV4
• service.action.awsApiCallAction.remoteIpDetails.ipAddressV6
• service.action.awsApiCallAction.remoteIpDetails.organization.asn
• service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg
• service.action.awsApiCallAction.serviceName
• service.action.dnsRequestAction.domain
• service.action.dnsRequestAction.domainWithSuffix
• service.action.networkConnectionAction.blocked
• service.action.networkConnectionAction.connectionDirection
• service.action.networkConnectionAction.localPortDetails.port
• service.action.networkConnectionAction.protocol
• service.action.networkConnectionAction.remoteIpDetails.city.cityName
• service.action.networkConnectionAction.remoteIpDetails.country.countryName
• service.action.networkConnectionAction.remoteIpDetails.ipAddressV4
• service.action.networkConnectionAction.remoteIpDetails.ipAddressV6
• service.action.networkConnectionAction.remoteIpDetails.organization.asn
• service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg
• service.action.networkConnectionAction.remotePortDetails.port
• service.action.awsApiCallAction.remoteAccountDetails.affiliated
• service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4
• service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6
• service.action.kubernetesApiCallAction.namespace
• service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn
• service.action.kubernetesApiCallAction.requestUri
• service.action.kubernetesApiCallAction.statusCode
• service.action.networkConnectionAction.localIpDetails.ipAddressV4
• service.action.networkConnectionAction.localIpDetails.ipAddressV6
• service.action.networkConnectionAction.protocol
• service.action.awsApiCallAction.serviceName
• service.action.awsApiCallAction.remoteAccountDetails.accountId
• service.additionalInfo.threatListName
• service.resourceRole
• resource.eksClusterDetails.name
• resource.kubernetesDetails.kubernetesWorkloadDetails.name
• resource.kubernetesDetails.kubernetesWorkloadDetails.namespace
• resource.kubernetesDetails.kubernetesUserDetails.username
• resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image
• resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix
• service.ebsVolumeScanDetails.scanId
• service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name
• service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity
• service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash
• service.malwareScanDetails.threats.name
• resource.ecsClusterDetails.name
• resource.ecsClusterDetails.taskDetails.containers.image
• resource.ecsClusterDetails.taskDetails.definitionArn
• resource.containerDetails.image
• resource.rdsDbInstanceDetails.dbInstanceIdentifier
• resource.rdsDbInstanceDetails.dbClusterIdentifier
• resource.rdsDbInstanceDetails.engine
• resource.rdsDbUserDetails.user
• resource.rdsDbInstanceDetails.tags.key
• resource.rdsDbInstanceDetails.tags.value
• service.runtimeDetails.process.executableSha256
• service.runtimeDetails.process.name
• service.runtimeDetails.process.name
• resource.lambdaDetails.functionName
• resource.lambdaDetails.functionArn
• resource.lambdaDetails.tags.key
• resource.lambdaDetails.tags.value

Returns:

• (Object, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-guardduty-filter-findingcriteria.html#cfn-guardduty-filter-findingcriteria-criterion

# File 'guard_duty/cfn_filter.rb', line 847

def criterion
  @criterion
end

#item_type ⇒ AWSCDK::IResolvable, ... (readonly)

Returns:

• (AWSCDK::IResolvable, AWSCDK::GuardDuty::CfnFilter::ConditionProperty, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-guardduty-filter-findingcriteria.html#cfn-guardduty-filter-findingcriteria-itemtype

# File 'guard_duty/cfn_filter.rb', line 850

def item_type
  @item_type
end

Class Method Details

.jsii_properties ⇒ Object

# File 'guard_duty/cfn_filter.rb', line 852

def self.jsii_properties
  {
    :criterion => "criterion",
    :item_type => "itemType",
  }
end

Instance Method Details

#to_jsii ⇒ Object

# File 'guard_duty/cfn_filter.rb', line 859

def to_jsii
  result = {}
  result.merge!({
    "criterion" => @criterion,
    "itemType" => @item_type,
  })
  result.compact
end