start_investigation ¶

def start_investigation(
    self,
    graph_arn: "capo_detective.types.graph_arn.GraphArn",
    entity_arn: "capo_detective.types.entity_arn.EntityArn",
    scope_start_time: "capo_detective.types.timestamp.Timestamp",
    scope_end_time: "capo_detective.types.timestamp.Timestamp",
    *,
    config_overrides: Optional[DetectiveClientConfig] = None,
) -> "capo_detective.types.start_investigation_response.StartInvestigationResponse":
    """<p>Detective investigations lets you investigate IAM users and IAM roles using indicators of compromise. An indicator of compromise (IOC) is an artifact observed in or on a network, system, or environment that can (with a high level of confidence) identify malicious activity or a security incident. <code>StartInvestigation</code> initiates an investigation on an entity in a behavior graph. </p>

    Args:
        graph_arn: <p>The Amazon Resource Name (ARN) of the behavior graph.</p>
        entity_arn: <p>The unique Amazon Resource Name (ARN) of the IAM user and IAM role.</p>
        scope_start_time: <p>The data and time when the investigation began. The value is an UTC ISO8601 formatted string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>
        scope_end_time: <p>The data and time when the investigation ended. The value is an UTC ISO8601 formatted string. For example, <code>2021-08-18T16:35:56.284Z</code>.</p>

    Raises:
        capo_detective.errors.access_denied_exception.AccessDeniedException: <p>The request issuer does not have permission to access this resource or perform this operation.</p>
        capo_detective.errors.internal_server_exception.InternalServerException: <p>The request was valid but failed because of a problem with the service.</p>
        capo_detective.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request refers to a nonexistent resource.</p>
        capo_detective.errors.too_many_requests_exception.TooManyRequestsException: <p>The request cannot be completed because too many other requests are occurring at the same time.</p>
        capo_detective.errors.validation_exception.ValidationException: <p>The request parameters are invalid.</p>
        capo_detective.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_detective.types.start_investigation_request.StartInvestigationRequest]",
    ) -> OperationResponse[
        "capo_detective.types.start_investigation_response.StartInvestigationResponse"
    ]:
        import capo_detective._operations.amazon_detective.start_investigation

        output, http_response = (
            capo_detective._operations.amazon_detective.start_investigation.start_investigation(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("StartInvestigation")
    )
    input_: capo_detective.types.start_investigation_request.StartInvestigationRequest = {
        "graph_arn": graph_arn,
        "entity_arn": entity_arn,
        "scope_start_time": scope_start_time,
        "scope_end_time": scope_end_time,
    }

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output