RuntimeContext ¶

class RuntimeContext(TypedDict, closed=True):
    modifying_process: NotRequired[
        "capo_guardduty.types.process_details.ProcessDetails"
    ]
    """<p>Information about the process that modified the current process. This is available for multiple finding types.</p>"""
    modified_at: NotRequired["capo_guardduty.types.timestamp.Timestamp"]
    """<p>The timestamp at which the process modified the current process. The timestamp is in UTC date string format.</p>"""
    script_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the script that was executed.</p>"""
    library_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the new library that was loaded.</p>"""
    ld_preload_value: NotRequired["capo_guardduty.types.string.String"]
    """<p>The value of the LD_PRELOAD environment variable.</p>"""
    socket_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the docket socket that was accessed.</p>"""
    runc_binary_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the leveraged <code>runc</code> implementation.</p>"""
    release_agent_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path in the container that modified the release agent file.</p>"""
    mount_source: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path on the host that is mounted by the container.</p>"""
    mount_target: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path in the container that is mapped to the host directory.</p>"""
    file_system_type: NotRequired["capo_guardduty.types.string.String"]
    """<p>Represents the type of mounted fileSystem.</p>"""
    flags: NotRequired["capo_guardduty.types.flags_list.FlagsList"]
    """<p>Represents options that control the behavior of a runtime operation or action. For example, a filesystem mount operation may contain a read-only flag.</p>"""
    module_name: NotRequired["capo_guardduty.types.string.String"]
    """<p>The name of the module loaded into the kernel.</p>"""
    module_file_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the module loaded into the kernel.</p>"""
    module_sha256: NotRequired["capo_guardduty.types.string.String"]
    """<p>The <code>SHA256</code> hash of the module.</p>"""
    shell_history_file_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path to the modified shell history file.</p>"""
    target_process: NotRequired["capo_guardduty.types.process_details.ProcessDetails"]
    """<p>Information about the process that had its memory overwritten by the current process.</p>"""
    address_family: NotRequired["capo_guardduty.types.string.String"]
    """<p>Represents the communication protocol associated with the address. For example, the address family <code>AF_INET</code> is used for IP version of 4 protocol.</p>"""
    iana_protocol_number: NotRequired["capo_guardduty.types.integer.Integer"]
    """<p>Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family <code>AF_INET</code> only has the IP protocol.</p>"""
    memory_regions: NotRequired[
        "capo_guardduty.types.memory_regions_list.MemoryRegionsList"
    ]
    """<p>Specifies the Region of a process's address space such as stack and heap.</p>"""
    tool_name: NotRequired["capo_guardduty.types.string.String"]
    """<p>Name of the potentially suspicious tool.</p>"""
    tool_category: NotRequired["capo_guardduty.types.string.String"]
    """<p>Category that the tool belongs to. Some of the examples are Backdoor Tool, Pentest Tool, Network Scanner, and Network Sniffer.</p>"""
    service_name: NotRequired["capo_guardduty.types.string.String"]
    """<p>Name of the security service that has been potentially disabled.</p>"""
    command_line_example: NotRequired["capo_guardduty.types.string.String"]
    """<p>Example of the command line involved in the suspicious activity.</p>"""
    threat_file_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The suspicious file path for which the threat intelligence details were found.</p>"""
    file_operation: NotRequired["capo_guardduty.types.string.String"]
    """<p>Represents the type of file operation that triggered the finding, such as Write, Delete, Rename, Link, or Symlink.</p>"""
    file_path: NotRequired["capo_guardduty.types.string.String"]
    """<p>The path of the sensitive file that was modified. Modification includes write, delete, rename, link, or symlink operations. This field is indexed for filtering.</p>"""
    related_file_paths: NotRequired[
        "capo_guardduty.types.related_file_paths_list.RelatedFilePathsList"
    ]
    """<p>All file paths modified by the same process that triggered the finding, up to a maximum of 25 paths.</p>"""