Service Configuration Events Schema

Events emitted from Stax Events follow a defined schema. For generic guidance, see Event Schemas.

ServiceConfiguration:GuardDutyUpdateEvent

An event where GuardDuty has been modified.

{
    "version": "0",
    "id": "7845a0a1-f292-65db-69f2-816befb7885f",
    "detail-type": "ServiceConfiguration: GuardDutyUpdateEvent",
    "source": "stax.organisation",
    "account": "123456789012",
    "time": "2023-08-18T00:30:32Z",
    "region": "string",
    "resources": [],
    "detail": {
        "configuration": {
            "Features": {
                "EBS_MALWARE_PROTECTION": {
                    "EbsSnapshotPreservation": null,
                    "Enable": false,
                    "ScanResourceCriteria": null
                },
                "EKS_AUDIT_LOGS": {
                    "Enable": false
                },
                "EKS_RUNTIME_MONITORING": {
                    "EKS_ADDON_MANAGEMENT": null,
                    "Enable": false
                },
                "LAMBDA_NETWORK_LOGS": {
                    "Enable": false
                },
                "RDS_LOGIN_EVENTS": {
                    "Enable": false
                },
                "S3_DATA_EVENTS": {
                    "Enable": false
                }
            },
            "FindingPublishingFrequency": "SIX_HOURS"
        },
        "meta": {
            "customer": {
                "id": "string",
                "name": "string"
            },
            "organization": {
                "alias": "string",
                "id": "string",
                "name": "string"
            },
            "timings": {
                "eventPublishTime": "2023-08-18T00:30:32.607971Z",
                "processorReceiveTime": "2023-08-18T00:30:33.269361634Z",
                "processorDispatchTime": "2023-08-18T00:30:33.4038438Z"
            },
            "traceContext": {
                "hc": "string"
            },
            "user": {
                "email": "string",
                "id": "string",
                "username": "string"
            }
        },
        "state": "ACTIVE",
        "status": "SUCCESS",
        "staxEventID": "string",
        "staxEventName": "GuardDutyUpdateEvent",
        "staxEventSource": "stax.organisation",
        "staxEventTime": "2023-08-18T00:30:32.607971Z",
        "staxEventType": "ServiceConfiguration",
        "staxEventVersion": "1"
    }
}

This event contains the following unique properties in the detail object:

ServiceConfiguration:SecurityHubUpdateEvent

An event where Security Hub has been modified.

{
    "version": "0",
    "id": "cca9c740-2374-b9f2-b556-7a4de4cca0ce",
    "detail-type": "ServiceConfiguration: SecurityHubUpdateEvent",
    "source": "stax.organisation",
    "account": "123456789012",
    "time": "2023-08-18T00:10:04Z",
    "region": "string",
    "resources": [],
    "detail": {
        "configuration": {
            "Standards": {
                "AWS_FOUNDATIONAL_SECURITY_BEST_PRACTICES_1_0_0": false,
                "AWS_REGIONS": [
                    "string"
                ],
                "CIS_AWS_FOUNDATIONS_BENCHMARK_1_2_0": false,
                "CIS_AWS_FOUNDATIONS_BENCHMARK_1_4_0": false,
                "PCI_DSS_3_2_1": false
            }
        },
        "meta": {
            "customer": {
                "id": "string",
                "name": "string"
            },
            "organization": {
                "alias": "string",
                "id": "string",
                "name": "string"
            },
            "timings": {
                "eventPublishTime": "2023-08-18T00:10:04.752312Z",
                "processorReceiveTime": "2023-08-18T00:10:05.282495055Z",
                "processorDispatchTime": "2023-08-18T00:10:05.436555506Z"
            },
            "traceContext": {
                "hc": "string"
            },
            "user": {
                "email": "string",
                "id": "string",
                "username": "string"
            }
        },
        "state": "ACTIVE",
        "status": "SUCCESS",
        "staxEventID": "string",
        "staxEventName": "SecurityHubUpdateEvent",
        "staxEventSource": "stax.organisation",
        "staxEventTime": "2023-08-18T00:10:04.752312Z",
        "staxEventType": "ServiceConfiguration",
        "staxEventVersion": "1"
    }
}

This event contains the following unique properties in the detail object: