aws-guardduty-finding-resource-evidence
GuardDuty findings contain access-key IDs, principal names, network endpoints, process/file details, Kubernetes identities, and sampled activity evidence.
Where it sits
| location | GetFindings.Findings[] |
|---|
| location kind | data_record |
|---|
| data kinds | access_key pii sensitive_data customer_data |
|---|
| emits edge | CanReadData |
|---|
| service | GuardDuty (aws:guardduty) |
|---|
Collection recipe
| access mode | read_api |
|---|
| operation | GetFindings |
|---|
| response path | Findings[] |
|---|
| encoding | json |
|---|
| params | {"DetectorId": "\u003cdetector-id\u003e", "FindingIds": ["\u003cfinding-id\u003e"]} |
|---|
Required permissions
guardduty:GetFindings
References