Package-level declarations

Detective uses machine learning and purpose-built visualizations to help you to analyze and investigate security issues across your Amazon Web Services (Amazon Web Services) workloads. Detective automatically extracts time-based events such as login attempts, API calls, and network traffic from CloudTrail and Amazon Virtual Private Cloud (Amazon VPC) flow logs. It also extracts findings detected by Amazon GuardDuty.

Accepts an invitation for the member account to contribute data to a behavior graph. This operation can only be called by an invited member account.

Gets data source package information for the behavior graph.

Gets information on the data source package history for an account.

Creates a new behavior graph for the calling account, and sets that account as the administrator account. This operation is called by the account that is enabling Detective.

CreateMembers is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses CreateMembers to enable organization accounts as member accounts.

Disables the specified behavior graph and queues it to be deleted. This operation removes the behavior graph from each member account's list of behavior graphs.

Removes the specified member accounts from the behavior graph. The removed accounts no longer contribute data to the behavior graph. This operation can only be called by the administrator account for the behavior graph.

Returns information about the configuration for the organization behavior graph. Currently indicates whether to automatically enable new organization accounts as member accounts.

Removes the Detective administrator account in the current Region. Deletes the organization behavior graph.

Removes the member account from the specified behavior graph. This operation can only be called by an invited member account that has the ENABLED status.

Designates the Detective administrator account for the organization in the current Region.

Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. GetInvestigation returns the investigation results of an investigation for a behavior graph.

Returns the membership details for specified member accounts for a behavior graph.

Lists data source packages in the behavior graph.

Returns the list of behavior graphs that the calling account is an administrator account of. This operation can only be called by an administrator account.

Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.

Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. ListInvestigations lists all active Detective investigations.

Retrieves the list of open and accepted behavior graph invitations for the member account. This operation can only be called by an invited member account.

Retrieves the list of member accounts for a behavior graph.

Returns information about the Detective administrator account for an organization. Can only be called by the organization management account.

Returns the tag values that are assigned to a behavior graph.

Rejects an invitation to contribute the account data to a behavior graph. This operation must be called by an invited member account that has the INVITED status.

Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. StartInvestigation initiates an investigation on an entity in a behavior graph.

Sends a request to enable data ingest for a member account that has a status of ACCEPTED_BUT_DISABLED.

Applies tag values to a behavior graph.

Removes tags from a behavior graph.

Starts a data source packages for the behavior graph.

Updates the state of an investigation.

Updates the configuration for the Organizations integration in the current Region. Can only be called by the Detective administrator account for the organization.

Create a copy of the client with one or more configuration values overridden. This method allows the caller to perform scoped config overrides for one or more client operations.