Guard Duty Findings, which ingested from Sentinel’s connector, represents a potential security issue detected within your network. GuardDuty generates a finding whenever it detects unexpected and potentially malicious activity in your AWS environment.
Sentinel
Schema
Name
Description
Type
_BilledSize
Double
_IsBillable
String
AccountId
An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.
String
ActivityType
Type of activity that triggered the event
String
Arn
Amazon resource name of the finding.
String
Description
Description of the information gathered
String
Id
Unique id of the activity log
String
Partition
The AWS partition in which the finding was generated.
String
Region
The AWS region in which the finding was generated.
String
ResourceDetails
Gives details on the AWS resource that was targeted by the trigger activity. The information available varies based on resource type and action typ.
Object
SchemaVersion
The Guard Duty finding version.
String
ServiceDetails
Gives details on the AWS service that was related to the finding, including Action, Actor/Target, Evidence, Anomalous behavior and Additional information.
Object
Severity
Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert
Int32
SourceSystem
String
TenantId
Unique identifier of the tenant into which the data connector ingests data.
String
TimeCreated
The time and date when this finding was first created. If this value differs from Updated at (TimeGenerated), it indicates that the activity has occurred multiple times and is an ongoing issue.
DateTime
TimeGenerated
The timestamp (UTC) of when the event was generated, The last time this finding was updated with new activity matching the pattern that prompted GuardDuty to generate this finding.
DateTime
Title
Title of the alert
String
Type
The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other