---
title: "POST /detector/{detectorId}/findings/get"
method: POST
path: "/detector/{detectorId}/findings/get"
---

# POST /detector/{detectorId}/findings/get

`POST /detector/{detectorId}/findings/get`

Describes Amazon GuardDuty findings specified by finding IDs.

## Path parameters

- `detectorId` string, required

## Request body

- object
  - `findingIds` FindingId[], required — The IDs of the findings that you want to retrieve.
  - `sortCriteria` object — Contains information about the criteria used for sorting findings.
    - `AttributeName` string — Represents the finding attribute, such as <code>accountId</code>, that sorts the findings.
    - `OrderBy` 'ASC' | 'DESC' — The order by which the sorted findings are to be displayed.

## Response `200`

Success

- GetFindingsResponse
  - `Findings` Finding[], required — A list of findings.
    - `AccountId` string, required — The ID of the account in which the finding was generated.
    - `Arn` string, required — The ARN of the finding.
    - `Confidence` number, double — The confidence score for the finding.
    - `CreatedAt` string, required — The time and date when the finding was created.
    - `Description` string — The description of the finding.
    - `Id` string, required — The ID of the finding.
    - `Partition` string — The partition associated with the finding.
    - `Region` string, required — The Region where the finding was generated.
    - `Resource` object, required — Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.
      - `AccessKeyDetails` object — The IAM access key details (user information) of a user that engaged in the activity that prompted GuardDuty to generate a finding.
        - `AccessKeyId` string — The access key ID of the user.
        - `PrincipalId` string — The principal ID of the user.
        - `UserName` string — The name of the user.
        - `UserType` string — The type of the user.
      - `S3BucketDetails` S3BucketDetail[] — Contains information on the S3 bucket.
        - `Arn` string — The Amazon Resource Name (ARN) of the S3 bucket.
        - `Name` string — The name of the S3 bucket.
        - `Type` string — Describes whether the bucket is a source or destination bucket.
        - `CreatedAt` string, date-time — The date and time the bucket was created at.
        - `Owner` object — The owner of the S3 bucket.
          - `Id` string — The canonical user ID of the bucket owner. For information about locating your canonical user ID see <a href="https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId">Finding Your Account Canonical User ID.</a>
        - `Tags` Tag[] — All tags attached to the S3 bucket
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
        - `DefaultServerSideEncryption` object — Describes the server side encryption method used in the S3 bucket.
          - `EncryptionType` string — The type of encryption used for objects within the S3 bucket.
          - `KmsMasterKeyArn` string — The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the bucket <code>EncryptionType</code> is <code>aws:kms</code>.
        - `PublicAccess` object — Describes the public access policies that apply to the S3 bucket.
          - `PermissionConfiguration` object — Contains information about how permissions are configured for the S3 bucket.
            - `BucketLevelPermissions` object — Contains information about the bucket level permissions for the S3 bucket.
              - …
            - `AccountLevelPermissions` object — Contains information about the account level permissions on the S3 bucket.
              - …
          - `EffectivePermission` string — Describes the effective permission on this bucket after factoring all attached policies.
      - `InstanceDetails` object — The information about the EC2 instance associated with the activity that prompted GuardDuty to generate a finding.
        - `AvailabilityZone` string — The Availability Zone of the EC2 instance.
        - `IamInstanceProfile` object — The profile information of the EC2 instance.
          - `Arn` string — The profile ARN of the EC2 instance.
          - `Id` string — The profile ID of the EC2 instance.
        - `ImageDescription` string — The image description of the EC2 instance.
        - `ImageId` string — The image ID of the EC2 instance.
        - `InstanceId` string — The ID of the EC2 instance.
        - `InstanceState` string — The state of the EC2 instance.
        - `InstanceType` string — The type of the EC2 instance.
        - `OutpostArn` string — The Amazon Resource Name (ARN) of the Amazon Web Services Outpost. Only applicable to Amazon Web Services Outposts instances.
        - `LaunchTime` string — The launch time of the EC2 instance.
        - `NetworkInterfaces` NetworkInterface[] — The elastic network interface information of the EC2 instance.
          - `Ipv6Addresses` String[] — A list of IPv6 addresses for the EC2 instance.
          - `NetworkInterfaceId` string — The ID of the network interface.
          - `PrivateDnsName` string — The private DNS name of the EC2 instance.
          - `PrivateIpAddress` string — The private IP address of the EC2 instance.
          - `PrivateIpAddresses` PrivateIpAddressDetails[] — Other private IP address information of the EC2 instance.
            - `PrivateDnsName` string — The private DNS name of the EC2 instance.
            - `PrivateIpAddress` string — The private IP address of the EC2 instance.
          - `PublicDnsName` string — The public DNS name of the EC2 instance.
          - `PublicIp` string — The public IP address of the EC2 instance.
          - `SecurityGroups` SecurityGroup[] — The security groups associated with the EC2 instance.
            - `GroupId` string — The security group ID of the EC2 instance.
            - `GroupName` string — The security group name of the EC2 instance.
          - `SubnetId` string — The subnet ID of the EC2 instance.
          - `VpcId` string — The VPC ID of the EC2 instance.
        - `Platform` string — The platform of the EC2 instance.
        - `ProductCodes` ProductCode[] — The product code of the EC2 instance.
          - `Code` string — The product code information.
          - `ProductType` string — The product code type.
        - `Tags` Tag[] — The tags of the EC2 instance.
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
      - `EksClusterDetails` object — Details about the EKS cluster involved in a Kubernetes finding.
        - `Name` string — EKS cluster name.
        - `Arn` string — EKS cluster ARN.
        - `VpcId` string — The VPC ID to which the EKS cluster is attached.
        - `Status` string — The EKS cluster status.
        - `Tags` Tag[] — The EKS cluster tags.
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
        - `CreatedAt` string, date-time — The timestamp when the EKS cluster was created.
      - `KubernetesDetails` object — Details about the Kubernetes user and workload involved in a Kubernetes finding.
        - `KubernetesUserDetails` object — Details about the Kubernetes user involved in a Kubernetes finding.
          - `Username` string — The username of the user who called the Kubernetes API.
          - `Uid` string — The user ID of the user who called the Kubernetes API.
          - `Groups` String[] — The groups that include the user who called the Kubernetes API.
        - `KubernetesWorkloadDetails` object — Details about the Kubernetes workload involved in a Kubernetes finding.
          - `Name` string — Kubernetes workload name.
          - `Type` string — Kubernetes workload type (e.g. Pod, Deployment, etc.).
          - `Uid` string — Kubernetes workload ID.
          - `Namespace` string — Kubernetes namespace that the workload is part of.
          - `HostNetwork` boolean — Whether the hostNetwork flag is enabled for the pods included in the workload.
          - `Containers` Container[] — Containers running as part of the Kubernetes workload.
            - `ContainerRuntime` string — The container runtime (such as, Docker or containerd) used to run the container.
            - `Id` string — Container ID.
            - `Name` string — Container name.
            - `Image` string — Container image.
            - `ImagePrefix` string — Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty.
            - `VolumeMounts` VolumeMount[] — Container volume mounts.
              - …
            - `SecurityContext` object — Container security context.
              - …
          - `Volumes` Volume[] — Volumes used by the Kubernetes workload.
            - `Name` string — Volume name.
            - `HostPath` object — Represents a pre-existing file or directory on the host machine that the volume maps to.
              - …
      - `ResourceType` string — The type of Amazon Web Services resource.
      - `EbsVolumeDetails` object — Contains list of scanned and skipped EBS volumes with details.
        - `ScannedVolumeDetails` VolumeDetail[] — List of EBS volumes that were scanned.
          - `VolumeArn` string — EBS volume Arn information.
          - `VolumeType` string — The EBS volume type.
          - `DeviceName` string — The device name for the EBS volume.
          - `VolumeSizeInGB` integer — EBS volume size in GB.
          - `EncryptionType` string — EBS volume encryption type.
          - `SnapshotArn` string — Snapshot Arn of the EBS volume.
          - `KmsKeyArn` string — KMS key Arn used to encrypt the EBS volume.
        - `SkippedVolumeDetails` VolumeDetail[] — List of EBS volumes that were skipped from the malware scan.
          - `VolumeArn` string — EBS volume Arn information.
          - `VolumeType` string — The EBS volume type.
          - `DeviceName` string — The device name for the EBS volume.
          - `VolumeSizeInGB` integer — EBS volume size in GB.
          - `EncryptionType` string — EBS volume encryption type.
          - `SnapshotArn` string — Snapshot Arn of the EBS volume.
          - `KmsKeyArn` string — KMS key Arn used to encrypt the EBS volume.
      - `EcsClusterDetails` object — Contains information about the details of the ECS Cluster.
        - `Name` string — The name of the ECS Cluster.
        - `Arn` string — The Amazon Resource Name (ARN) that identifies the cluster.
        - `Status` string — The status of the ECS cluster.
        - `ActiveServicesCount` integer — The number of services that are running on the cluster in an ACTIVE state.
        - `RegisteredContainerInstancesCount` integer — The number of container instances registered into the cluster.
        - `RunningTasksCount` integer — The number of tasks in the cluster that are in the RUNNING state.
        - `Tags` Tag[] — The tags of the ECS Cluster.
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
        - `TaskDetails` object — Contains information about the details of the ECS Task.
          - `Arn` string — The Amazon Resource Name (ARN) of the task.
          - `DefinitionArn` string — The ARN of the task definition that creates the task.
          - `Version` string — The version counter for the task.
          - `TaskCreatedAt` string, date-time — The Unix timestamp for the time when the task was created.
          - `StartedAt` string, date-time — The Unix timestamp for the time when the task started.
          - `StartedBy` string — Contains the tag specified when a task is started.
          - `Tags` Tag[] — The tags of the ECS Task.
            - `Key` string — The EC2 instance tag key.
            - `Value` string — The EC2 instance tag value.
          - `Volumes` Volume[] — The list of data volume definitions for the task.
            - `Name` string — Volume name.
            - `HostPath` object — Represents a pre-existing file or directory on the host machine that the volume maps to.
              - …
          - `Containers` Container[] — The containers that's associated with the task.
            - `ContainerRuntime` string — The container runtime (such as, Docker or containerd) used to run the container.
            - `Id` string — Container ID.
            - `Name` string — Container name.
            - `Image` string — Container image.
            - `ImagePrefix` string — Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty.
            - `VolumeMounts` VolumeMount[] — Container volume mounts.
              - …
            - `SecurityContext` object — Container security context.
              - …
          - `Group` string — The name of the task group that's associated with the task.
      - `ContainerDetails` object — Details of a container.
        - `ContainerRuntime` string — The container runtime (such as, Docker or containerd) used to run the container.
        - `Id` string — Container ID.
        - `Name` string — Container name.
        - `Image` string — Container image.
        - `ImagePrefix` string — Part of the image name before the last slash. For example, imagePrefix for public.ecr.aws/amazonlinux/amazonlinux:latest would be public.ecr.aws/amazonlinux. If the image name is relative and does not have a slash, this field is empty.
        - `VolumeMounts` VolumeMount[] — Container volume mounts.
          - `Name` string — Volume mount name.
          - `MountPath` string — Volume mount path.
        - `SecurityContext` object — Container security context.
          - `Privileged` boolean — Whether the container is privileged.
      - `RdsDbInstanceDetails` object — Contains information about the database instance to which an anomalous login attempt was made.
        - `DbInstanceIdentifier` string — The identifier associated to the database instance that was involved in the finding.
        - `Engine` string — The database engine of the database instance involved in the finding.
        - `EngineVersion` string — The version of the database engine that was involved in the finding.
        - `DbClusterIdentifier` string — The identifier of the database cluster that contains the database instance ID involved in the finding.
        - `DbInstanceArn` string — The Amazon Resource Name (ARN) that identifies the database instance involved in the finding.
        - `Tags` Tag[] — Instance tag key-value pairs associated with the database instance ID.
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
      - `RdsDbUserDetails` object — Contains information about the user details through which anomalous login attempt was made.
        - `User` string — The user name used in the anomalous login attempt.
        - `Application` string — The application name used in the anomalous login attempt.
        - `Database` string — The name of the database instance involved in the anomalous login attempt.
        - `Ssl` string — The version of the Secure Socket Layer (SSL) used for the network.
        - `AuthMethod` string — The authentication method used by the user involved in the finding.
      - `LambdaDetails` object — Contains information about the Lambda function that was involved in a finding.
        - `FunctionArn` string — Amazon Resource Name (ARN) of the Lambda function.
        - `FunctionName` string — Name of the Lambda function.
        - `Description` string — Description of the Lambda function.
        - `LastModifiedAt` string, date-time — The timestamp when the Lambda function was last modified. This field is in the UTC date string format <code>(2023-03-22T19:37:20.168Z)</code>.
        - `RevisionId` string — The revision ID of the Lambda function version.
        - `FunctionVersion` string — The version of the Lambda function.
        - `Role` string — The execution role of the Lambda function.
        - `VpcConfig` object — Amazon Virtual Private Cloud configuration details associated with your Lambda function.
          - `SubnetIds` String[] — The identifiers of the subnets that are associated with your Lambda function.
          - `VpcId` string — The identifier of the Amazon Virtual Private Cloud.
          - `SecurityGroups` SecurityGroup[] — The identifier of the security group attached to the Lambda function.
            - `GroupId` string — The security group ID of the EC2 instance.
            - `GroupName` string — The security group name of the EC2 instance.
        - `Tags` Tag[] — A list of tags attached to this resource, listed in the format of <code>key</code>:<code>value</code> pair.
          - `Key` string — The EC2 instance tag key.
          - `Value` string — The EC2 instance tag value.
    - `SchemaVersion` string, required — The version of the schema used for the finding.
    - `Service` object — Contains additional information about the generated finding.
      - `Action` object — Information about the activity that is described in a finding.
        - `ActionType` string — The GuardDuty finding activity type.
        - `AwsApiCallAction` object — Information about the AWS_API_CALL action described in this finding.
          - `Api` string — The Amazon Web Services API name.
          - `CallerType` string — The Amazon Web Services API caller type.
          - `DomainDetails` object — The domain information for the Amazon Web Services API call.
            - `Domain` string — The domain information for the Amazon Web Services API call.
          - `ErrorCode` string — The error code of the failed Amazon Web Services API action.
          - `UserAgent` string — The agent through which the API request was made.
          - `RemoteIpDetails` object — The remote IP information of the connection that initiated the Amazon Web Services API call.
            - `City` object — The city information of the remote IP address.
              - …
            - `Country` object — The country code of the remote IP address.
              - …
            - `GeoLocation` object — The location information of the remote IP address.
              - …
            - `IpAddressV4` string — The IPv4 remote address of the connection.
            - `Organization` object — The ISP organization information of the remote IP address.
              - …
          - `ServiceName` string — The Amazon Web Services service name whose API was invoked.
          - `RemoteAccountDetails` object — The details of the Amazon Web Services account that made the API call. This field appears if the call was made from outside your account.
            - `AccountId` string — The Amazon Web Services account ID of the remote API caller.
            - `Affiliated` boolean — Details on whether the Amazon Web Services account of the remote API caller is related to your GuardDuty environment. If this value is <code>True</code> the API caller is affiliated to your account in some way. If it is <code>False</code> the API caller is from outside your environment.
          - `AffectedResources` object — The details of the Amazon Web Services account that made the API call. This field identifies the resources that were affected by this API call.
        - `DnsRequestAction` object — Information about the DNS_REQUEST action described in this finding.
          - `Domain` string — The domain information for the API request.
          - `Protocol` string — The network connection protocol observed in the activity that prompted GuardDuty to generate the finding.
          - `Blocked` boolean — Indicates whether the targeted port is blocked.
        - `NetworkConnectionAction` object — Information about the NETWORK_CONNECTION action described in this finding.
          - `Blocked` boolean — Indicates whether EC2 blocked the network connection to your instance.
          - `ConnectionDirection` string — The network connection direction.
          - `LocalPortDetails` object — The local port information of the connection.
            - `Port` integer — The port number of the local connection.
            - `PortName` string — The port name of the local connection.
          - `Protocol` string — The network connection protocol.
          - `LocalIpDetails` object — The local IP information of the connection.
            - `IpAddressV4` string — The IPv4 local address of the connection.
          - `RemoteIpDetails` object — The remote IP information of the connection.
            - `City` object — The city information of the remote IP address.
              - …
            - `Country` object — The country code of the remote IP address.
              - …
            - `GeoLocation` object — The location information of the remote IP address.
              - …
            - `IpAddressV4` string — The IPv4 remote address of the connection.
            - `Organization` object — The ISP organization information of the remote IP address.
              - …
          - `RemotePortDetails` object — The remote port information of the connection.
            - `Port` integer — The port number of the remote connection.
            - `PortName` string — The port name of the remote connection.
        - `PortProbeAction` object — Information about the PORT_PROBE action described in this finding.
          - `Blocked` boolean — Indicates whether EC2 blocked the port probe to the instance, such as with an ACL.
          - `PortProbeDetails` PortProbeDetail[] — A list of objects related to port probe details.
            - `LocalPortDetails` object — The local port information of the connection.
              - …
            - `LocalIpDetails` object — The local IP information of the connection.
              - …
            - `RemoteIpDetails` object — The remote IP information of the connection.
              - …
        - `KubernetesApiCallAction` object — Information about the Kubernetes API call action described in this finding.
          - `RequestUri` string — The Kubernetes API request URI.
          - `Verb` string — The Kubernetes API request HTTP verb.
          - `SourceIps` String[] — The IP of the Kubernetes API caller and the IPs of any proxies or load balancers between the caller and the API endpoint.
          - `UserAgent` string — The user agent of the caller of the Kubernetes API.
          - `RemoteIpDetails` object — Contains information about the remote IP address of the connection.
            - `City` object — The city information of the remote IP address.
              - …
            - `Country` object — The country code of the remote IP address.
              - …
            - `GeoLocation` object — The location information of the remote IP address.
              - …
            - `IpAddressV4` string — The IPv4 remote address of the connection.
            - `Organization` object — The ISP organization information of the remote IP address.
              - …
          - `StatusCode` integer — The resulting HTTP response code of the Kubernetes API call action.
          - `Parameters` string — Parameters related to the Kubernetes API call action.
        - `RdsLoginAttemptAction` object — Information about <code>RDS_LOGIN_ATTEMPT</code> action described in this finding.
          - `RemoteIpDetails` object — Contains information about the remote IP address of the connection.
            - `City` object — The city information of the remote IP address.
              - …
            - `Country` object — The country code of the remote IP address.
              - …
            - `GeoLocation` object — The location information of the remote IP address.
              - …
            - `IpAddressV4` string — The IPv4 remote address of the connection.
            - `Organization` object — The ISP organization information of the remote IP address.
              - …
          - `LoginAttributes` LoginAttribute[] — Indicates the login attributes used in the login attempt.
            - `User` string — Indicates the user name which attempted to log in.
            - `Application` string — Indicates the application name used to attempt log in.
            - `FailedLoginAttempts` integer — Represents the sum of failed (unsuccessful) login attempts made to establish a connection to the database instance.
            - `SuccessfulLoginAttempts` integer — Represents the sum of successful connections (a correct combination of login attributes) made to the database instance by the actor.
      - `Evidence` object — An evidence object associated with the service.
        - `ThreatIntelligenceDetails` ThreatIntelligenceDetail[] — A list of threat intelligence details related to the evidence.
          - `ThreatListName` string — The name of the threat intelligence list that triggered the finding.
          - `ThreatNames` String[] — A list of names of the threats in the threat intelligence list that triggered the finding.
      - `Archived` boolean — Indicates whether this finding is archived.
      - `Count` integer — The total count of the occurrences of this finding type.
      - `DetectorId` string — The detector ID for the GuardDuty service.
      - `EventFirstSeen` string — The first-seen timestamp of the activity that prompted GuardDuty to generate this finding.
      - `EventLastSeen` string — The last-seen timestamp of the activity that prompted GuardDuty to generate this finding.
      - `ResourceRole` string — The resource role information for this finding.
      - `ServiceName` string — The name of the Amazon Web Services service (GuardDuty) that generated a finding.
      - `UserFeedback` string — Feedback that was submitted about the finding.
      - `AdditionalInfo` object — Contains additional information about the generated finding.
        - `Value` string — This field specifies the value of the additional information.
        - `Type` string — Describes the type of the additional information.
      - `FeatureName` string — The name of the feature that generated a finding.
      - `EbsVolumeScanDetails` object — Returns details from the malware scan that created a finding.
        - `ScanId` string — Unique Id of the malware scan that generated the finding.
        - `ScanStartedAt` string, date-time — Returns the start date and time of the malware scan.
        - `ScanCompletedAt` string, date-time — Returns the completion date and time of the malware scan.
        - `TriggerFindingId` string — GuardDuty finding ID that triggered a malware scan.
        - `Sources` String[] — Contains list of threat intelligence sources used to detect threats.
        - `ScanDetections` object — Contains a complete view providing malware scan result details.
          - `ScannedItemCount` object — Total number of scanned files.
            - `TotalGb` integer — Total GB of files scanned for malware.
            - `Files` integer — Number of files scanned.
            - `Volumes` integer — Total number of scanned volumes.
          - `ThreatsDetectedItemCount` object — Total number of infected files.
            - `Files` integer — Total number of infected files.
          - `HighestSeverityThreatDetails` object — Details of the highest severity threat detected during malware scan and number of infected files.
            - `Severity` string — Severity level of the highest severity threat detected.
            - `ThreatName` string — Threat name of the highest severity threat detected as part of the malware scan.
            - `Count` integer — Total number of infected files with the highest severity threat detected.
          - `ThreatDetectedByName` object — Contains details about identified threats organized by threat name.
            - `ItemCount` integer — Total number of infected files identified.
            - `UniqueThreatNameCount` integer — Total number of unique threats by name identified, as part of the malware scan.
            - `Shortened` boolean — Flag to determine if the finding contains every single infected file-path and/or every threat.
            - `ThreatNames` ScanThreatName[] — List of identified threats with details, organized by threat name.
              - …
      - `RuntimeDetails` object — Information about the process and any required context values for a specific finding
        - `Process` object — Information about the observed process.
          - `Name` string — The name of the process.
          - `ExecutablePath` string — The absolute path of the process executable file.
          - `ExecutableSha256` string — The <code>SHA256</code> hash of the process executable.
          - `NamespacePid` integer — The ID of the child process.
          - `Pwd` string — The present working directory of the process.
          - `Pid` integer — The ID of the process.
          - `StartTime` string, date-time — The time when the process started. This is in UTC format.
          - `Uuid` string — The unique ID assigned to the process by GuardDuty.
          - `ParentUuid` string — The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.
          - `User` string — The user that executed the process.
          - `UserId` integer — The unique ID of the user that executed the process.
          - `Euid` integer — The effective user ID of the user that executed the process.
          - `Lineage` LineageObject[] — Information about the process's lineage.
            - `StartTime` string, date-time — The time when the process started. This is in UTC format.
            - `NamespacePid` integer — The process ID of the child process.
            - `UserId` integer — The user ID of the user that executed the process.
            - `Name` string — The name of the process.
            - `Pid` integer — The ID of the process.
            - `Uuid` string — The unique ID assigned to the process by GuardDuty.
            - `ExecutablePath` string — The absolute path of the process executable file.
            - `Euid` integer — The effective user ID that was used to execute the process.
            - `ParentUuid` string — The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.
        - `Context` object — Additional information about the suspicious activity.
          - `ModifyingProcess` object — Information about the process that modified the current process. This is available for multiple finding types.
            - `Name` string — The name of the process.
            - `ExecutablePath` string — The absolute path of the process executable file.
            - `ExecutableSha256` string — The <code>SHA256</code> hash of the process executable.
            - `NamespacePid` integer — The ID of the child process.
            - `Pwd` string — The present working directory of the process.
            - `Pid` integer — The ID of the process.
            - `StartTime` string, date-time — The time when the process started. This is in UTC format.
            - `Uuid` string — The unique ID assigned to the process by GuardDuty.
            - `ParentUuid` string — The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.
            - `User` string — The user that executed the process.
            - `UserId` integer — The unique ID of the user that executed the process.
            - `Euid` integer — The effective user ID of the user that executed the process.
            - `Lineage` LineageObject[] — Information about the process's lineage.
              - …
          - `ModifiedAt` string, date-time — The timestamp at which the process modified the current process. The timestamp is in UTC date string format.
          - `ScriptPath` string — The path to the script that was executed.
          - `LibraryPath` string — The path to the new library that was loaded.
          - `LdPreloadValue` string — The value of the LD_PRELOAD environment variable.
          - `SocketPath` string — The path to the docket socket that was accessed.
          - `RuncBinaryPath` string — The path to the leveraged <code>runc</code> implementation.
          - `ReleaseAgentPath` string — The path in the container that modified the release agent file.
          - `MountSource` string — The path on the host that is mounted by the container.
          - `MountTarget` string — The path in the container that is mapped to the host directory.
          - `FileSystemType` string — Represents the type of mounted fileSystem.
          - `Flags` String[] — Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.
          - `ModuleName` string — The name of the module loaded into the kernel.
          - `ModuleFilePath` string — The path to the module loaded into the kernel.
          - `ModuleSha256` string — The <code>SHA256</code> hash of the module.
          - `ShellHistoryFilePath` string — The path to the modified shell history file.
          - `TargetProcess` object — Information about the process that had its memory overwritten by the current process.
            - `Name` string — The name of the process.
            - `ExecutablePath` string — The absolute path of the process executable file.
            - `ExecutableSha256` string — The <code>SHA256</code> hash of the process executable.
            - `NamespacePid` integer — The ID of the child process.
            - `Pwd` string — The present working directory of the process.
            - `Pid` integer — The ID of the process.
            - `StartTime` string, date-time — The time when the process started. This is in UTC format.
            - `Uuid` string — The unique ID assigned to the process by GuardDuty.
            - `ParentUuid` string — The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.
            - `User` string — The user that executed the process.
            - `UserId` integer — The unique ID of the user that executed the process.
            - `Euid` integer — The effective user ID of the user that executed the process.
            - `Lineage` LineageObject[] — Information about the process's lineage.
              - …
          - `AddressFamily` string — Represents the communication protocol associated with the address. For example, the address family <code>AF_INET</code> is used for IP version of 4 protocol.
          - `IanaProtocolNumber` integer — Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family <code>AF_INET</code> only has the IP protocol.
          - `MemoryRegions` String[] — Specifies the Region of a process's address space such as stack and heap.
    - `Severity` number, double, required — The severity of the finding.
    - `Title` string — The title of the finding.
    - `Type` string, required — The type of finding.
    - `UpdatedAt` string, required — The time and date when the finding was last updated.

## Other responses

- `480` — BadRequestException
- `481` — InternalServerErrorException

---

[API](https://skmtc.net/aws/apis/guardduty.md) · [All operations](https://skmtc.net/aws/apis/guardduty/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/guardduty/versions/d35ef49b25a3/schema)