Service Configuration Events Schema

Events emitted from Stax Events follow a defined schema. For generic guidance, see Event Schemas.

ServiceConfiguration:GuardDutyUpdateEvent

An event where GuardDuty has been modified.

{
   "version": "0",
   "id": "7845a0a1-f292-65db-69f2-816befb7885f",
   "detail-type": "ServiceConfiguration: GuardDutyUpdateEvent",
   "source": "stax.organisation",
   "account": "123456789012",
   "time": "2023-08-18T00:30:32Z",
   "region": "string",
   "resources": [],
   "detail": {
       "configuration": {
           "Features": {
               "EBS_MALWARE_PROTECTION": {
                   "EbsSnapshotPreservation": null,
                   "Enable": false,
                   "ScanResourceCriteria": null
               },
               "EKS_AUDIT_LOGS": {
                   "Enable": false
               },
               "EKS_RUNTIME_MONITORING": {
                   "EKS_ADDON_MANAGEMENT": null,
                   "Enable": false
               },
               "LAMBDA_NETWORK_LOGS": {
                   "Enable": false
               },
               "RDS_LOGIN_EVENTS": {
                   "Enable": false
               },
               "S3_DATA_EVENTS": {
                   "Enable": false
               }
           },
           "FindingPublishingFrequency": "SIX_HOURS"
       },
       "meta": {
           "customer": {
               "id": "string",
               "name": "string"
           },
           "organization": {
               "alias": "string",
               "id": "string",
               "name": "string"
           },
           "timings": {
               "eventPublishTime": "2023-08-18T00:30:32.607971Z",
               "processorReceiveTime": "2023-08-18T00:30:33.269361634Z",
               "processorDispatchTime": "2023-08-18T00:30:33.4038438Z"
           },
           "traceContext": {
               "hc": "string"
           },
           "user": {
               "email": "string",
               "id": "string",
               "username": "string"
           }
       },
       "state": "ACTIVE",
       "status": "SUCCESS",
       "staxEventID": "string",
       "staxEventName": "GuardDutyUpdateEvent",
       "staxEventSource": "stax.organisation",
       "staxEventTime": "2023-08-18T00:30:32.607971Z",
       "staxEventType": "ServiceConfiguration",
       "staxEventVersion": "1"
   }
}

This event contains the following unique properties in the detail object:

Property	Type	Required	Enum
→ state	string	true	ACTIVE INACTIVE CONFIGURING ERROR
→ status	string	true	SUCCESS FAILED
→ errorCode	string	false
→ message	string	false

ServiceConfiguration:SecurityHubUpdateEvent

An event where Security Hub has been modified.

{
   "version": "0",
   "id": "cca9c740-2374-b9f2-b556-7a4de4cca0ce",
   "detail-type": "ServiceConfiguration: SecurityHubUpdateEvent",
   "source": "stax.organisation",
   "account": "123456789012",
   "time": "2023-08-18T00:10:04Z",
   "region": "string",
   "resources": [],
   "detail": {
       "configuration": {
           "Standards": {
               "AWS_FOUNDATIONAL_SECURITY_BEST_PRACTICES_1_0_0": false,
               "AWS_REGIONS": [
                   "string"
               ],
               "CIS_AWS_FOUNDATIONS_BENCHMARK_1_2_0": false,
               "CIS_AWS_FOUNDATIONS_BENCHMARK_1_4_0": false,
               "PCI_DSS_3_2_1": false
           }
       },
       "meta": {
           "customer": {
               "id": "string",
               "name": "string"
           },
           "organization": {
               "alias": "string",
               "id": "string",
               "name": "string"
           },
           "timings": {
               "eventPublishTime": "2023-08-18T00:10:04.752312Z",
               "processorReceiveTime": "2023-08-18T00:10:05.282495055Z",
               "processorDispatchTime": "2023-08-18T00:10:05.436555506Z"
           },
           "traceContext": {
               "hc": "string"
           },
           "user": {
               "email": "string",
               "id": "string",
               "username": "string"
           }
       },
       "state": "ACTIVE",
       "status": "SUCCESS",
       "staxEventID": "string",
       "staxEventName": "SecurityHubUpdateEvent",
       "staxEventSource": "stax.organisation",
       "staxEventTime": "2023-08-18T00:10:04.752312Z",
       "staxEventType": "ServiceConfiguration",
       "staxEventVersion": "1"
   }
}

This event contains the following unique properties in the detail object:

Property	Type	Required	Enum
→ state	string	true	ACTIVE INACTIVE CONFIGURING ERROR
→ status	string	true	SUCCESS FAILED
→ errorCode	string	false
→ message	string	false