Investigation ¶

class Investigation(TypedDict, closed=True):
    investigation_id: NotRequired[
        "capo_guardduty.types.investigation_id.InvestigationId"
    ]
    """<p>The unique identifier of the investigation.</p>"""
    status: NotRequired["capo_guardduty.types.investigation_status.InvestigationStatus"]
    """<p>The current status of the investigation. Possible values are <code>RUNNING</code>, <code>COMPLETED</code>, and <code>FAILED</code>.</p>"""
    trigger_prompt: NotRequired["capo_guardduty.types.trigger_prompt.TriggerPrompt"]
    """<p>The natural-language prompt that initiated this investigation.</p>"""
    triggered_by: NotRequired["capo_guardduty.types.triggered_by.TriggeredBy"]
    """<p>The account that initiated the investigation.</p>"""
    metadata: NotRequired[
        "capo_guardduty.types.investigation_metadata.InvestigationMetadata"
    ]
    """<p>Metadata about the product and version that produced the investigation.</p>"""
    cloud: NotRequired["capo_guardduty.types.cloud_details.CloudDetails"]
    """<p>Details about the cloud environment in which the investigation was performed, including the provider, region, and account.</p>"""
    risk_level: NotRequired["capo_guardduty.types.risk_level.RiskLevel"]
    """<p>The assessed risk level of the investigated threat. Possible values are <code>Info</code>, <code>Low</code>, <code>Medium</code>, <code>High</code>, and <code>Critical</code>.</p>"""
    risk: NotRequired["capo_guardduty.types.risk_details.RiskDetails"]
    """<p>A human-readable description of the assessed risk.</p>"""
    confidence: NotRequired["capo_guardduty.types.confidence.Confidence"]
    """<p>The confidence level of the investigation's assessment. Possible values are <code>Unknown</code>, <code>Low</code>, <code>Medium</code>, and <code>High</code>.</p>"""
    summary: NotRequired["capo_guardduty.types.string.String"]
    """<p>A structured summary of the investigation findings, including affected resources, threat assessment, and recommended remediation steps.</p>"""
    start_time: NotRequired["capo_guardduty.types.timestamp.Timestamp"]
    """<p>The timestamp at which the investigation started.</p>"""
    end_time: NotRequired["capo_guardduty.types.timestamp.Timestamp"]
    """<p>The timestamp at which the investigation completed.</p>"""
    error: NotRequired[
        "capo_guardduty.types.investigation_error_details.InvestigationErrorDetails"
    ]
    """<p>Details about the error if the investigation status is <code>FAILED</code>.</p>"""