list_investigations async ¶

async def list_investigations(
    self,
    graph_arn: "capo_detective.types.graph_arn.GraphArn",
    *,
    config_overrides: Optional[AsyncDetectiveClientConfig] = None,
    next_token: Optional[
        "capo_detective.types.ai_pagination_token.AiPaginationToken"
    ] = None,
    max_results: Optional["capo_detective.types.max_results.MaxResults"] = None,
    filter_criteria: Optional[
        "capo_detective.types.filter_criteria.FilterCriteria"
    ] = None,
    sort_criteria: Optional[
        "capo_detective.types.sort_criteria.SortCriteria"
    ] = None,
) -> "capo_detective.types.list_investigations_response.ListInvestigationsResponse":
    """<p>Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. <code>ListInvestigations</code> lists all active Detective investigations.</p>

    Args:
        graph_arn: <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
        next_token: <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p> <p>Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.</p>
        max_results: <p>Lists the maximum number of investigations in a page.</p>
        filter_criteria: <p>Filters the investigation results based on a criteria.</p>
        sort_criteria: <p>Sorts the investigation results based on a criteria.</p>

    Raises:
        capo_detective.errors.access_denied_exception.AccessDeniedException: <p>The request issuer does not have permission to access this resource or perform this operation.</p>
        capo_detective.errors.internal_server_exception.InternalServerException: <p>The request was valid but failed because of a problem with the service.</p>
        capo_detective.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request refers to a nonexistent resource.</p>
        capo_detective.errors.too_many_requests_exception.TooManyRequestsException: <p>The request cannot be completed because too many other requests are occurring at the same time.</p>
        capo_detective.errors.validation_exception.ValidationException: <p>The request parameters are invalid.</p>
        capo_detective.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_detective.types.list_investigations_request.ListInvestigationsRequest]",
    ) -> AsyncOperationResponse[
        "capo_detective.types.list_investigations_response.ListInvestigationsResponse"
    ]:
        import capo_detective._operations.amazon_detective.list_investigations

        (
            output,
            http_response,
        ) = await capo_detective._operations.amazon_detective.list_investigations.async_list_investigations(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ListInvestigations")
    )
    input_: capo_detective.types.list_investigations_request.ListInvestigationsRequest = {
        "graph_arn": graph_arn
    }
    if next_token is not None:
        input_["next_token"] = next_token
    if max_results is not None:
        input_["max_results"] = max_results
    if filter_criteria is not None:
        input_["filter_criteria"] = filter_criteria
    if sort_criteria is not None:
        input_["sort_criteria"] = sort_criteria

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output