Amazon Detective · Schema
GetInvestigationResponse
Response from getting investigation details
AWSForensicsInvestigationSecurity
Properties
| Name | Type | Description |
|---|---|---|
| GraphArn | string | The ARN of the behavior graph. |
| InvestigationId | string | The investigation ID of the investigation report. |
| EntityArn | string | The unique Amazon Resource Name (ARN) of the IAM user and IAM role. |
| EntityType | string | Type of entity. For example, IAM_ROLE or IAM_USER. |
| CreatedTime | string | The creation time of the investigation report in UTC time stamp format. |
| ScopeStartTime | string | The start date and time used to set the scope time within which you want Detective to investigate. |
| ScopeEndTime | string | The end date and time used to set the scope time within which you want Detective to investigate. |
| Status | string | The status based on the completion status of the investigation. |
| Severity | string | The severity assigned is based on the likelihood and impact of the indicators of compromise discovered in the investigation. |
| State | string | The current state of the investigation. An archived investigation indicates you have completed reviewing the investigation. |