list_indicators ¶

def list_indicators(
    self,
    graph_arn: "capo_detective.types.graph_arn.GraphArn",
    investigation_id: "capo_detective.types.investigation_id.InvestigationId",
    *,
    config_overrides: Optional[DetectiveClientConfig] = None,
    indicator_type: Optional[
        "capo_detective.types.indicator_type.IndicatorType"
    ] = None,
    next_token: Optional[
        "capo_detective.types.ai_pagination_token.AiPaginationToken"
    ] = None,
    max_results: Optional["capo_detective.types.max_results.MaxResults"] = None,
) -> "capo_detective.types.list_indicators_response.ListIndicatorsResponse":
    """<p>Gets the indicators from an investigation. You can use the information from the indicators to determine if an IAM user and/or IAM role is involved in an unusual activity that could indicate malicious behavior and its impact.</p>

    Args:
        graph_arn: <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
        investigation_id: <p>The investigation ID of the investigation report.</p>
        indicator_type: <p>For the list of indicators of compromise that are generated by Detective investigations, see <a href="https://docs.aws.amazon.com/detective/latest/userguide/detective-investigation-about.html">Detective investigations</a>.</p>
        next_token: <p>Lists if there are more results available. The value of nextToken is a unique pagination token for each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.</p> <p>Each pagination token expires after 24 hours. Using an expired pagination token will return a Validation Exception error.</p>
        max_results: <p>Lists the maximum number of indicators in a page.</p>

    Raises:
        capo_detective.errors.access_denied_exception.AccessDeniedException: <p>The request issuer does not have permission to access this resource or perform this operation.</p>
        capo_detective.errors.internal_server_exception.InternalServerException: <p>The request was valid but failed because of a problem with the service.</p>
        capo_detective.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request refers to a nonexistent resource.</p>
        capo_detective.errors.too_many_requests_exception.TooManyRequestsException: <p>The request cannot be completed because too many other requests are occurring at the same time.</p>
        capo_detective.errors.validation_exception.ValidationException: <p>The request parameters are invalid.</p>
        capo_detective.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_detective.types.list_indicators_request.ListIndicatorsRequest]",
    ) -> OperationResponse[
        "capo_detective.types.list_indicators_response.ListIndicatorsResponse"
    ]:
        import capo_detective._operations.amazon_detective.list_indicators

        output, http_response = (
            capo_detective._operations.amazon_detective.list_indicators.list_indicators(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ListIndicators")
    )
    input_: capo_detective.types.list_indicators_request.ListIndicatorsRequest = {
        "graph_arn": graph_arn,
        "investigation_id": investigation_id,
    }
    if indicator_type is not None:
        input_["indicator_type"] = indicator_type
    if next_token is not None:
        input_["next_token"] = next_token
    if max_results is not None:
        input_["max_results"] = max_results

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output