NetworkFirewall / Client / get_analysis_report_results

get_analysis_report_results

NetworkFirewall.Client.get_analysis_report_results(**kwargs)

The results of a COMPLETED analysis report generated with StartAnalysisReport.

For more information, see AnalysisTypeReportResult.

See also: AWS API Documentation

Request Syntax

response = client.get_analysis_report_results(
    FirewallName='string',
    AnalysisReportId='string',
    FirewallArn='string',
    NextToken='string',
    MaxResults=123
)

Parameters:

• FirewallName (string) –

  The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

  You must specify the ARN or the name, and you can specify both.

• AnalysisReportId (string) –

  [REQUIRED]

  The unique ID of the query that ran when you requested an analysis report.

• FirewallArn (string) –

  The Amazon Resource Name (ARN) of the firewall.

  You must specify the ARN or the name, and you can specify both.

• NextToken (string) – When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

• MaxResults (integer) – The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in a subsequent call to get the next batch of objects.

Return type:

dict

Returns:

Response Syntax

{
    'Status': 'string',
    'StartTime': datetime(2015, 1, 1),
    'EndTime': datetime(2015, 1, 1),
    'ReportTime': datetime(2015, 1, 1),
    'AnalysisType': 'TLS_SNI'|'HTTP_HOST',
    'NextToken': 'string',
    'AnalysisReportResults': [
        {
            'Protocol': 'string',
            'FirstAccessed': datetime(2015, 1, 1),
            'LastAccessed': datetime(2015, 1, 1),
            'Domain': 'string',
            'Hits': {
                'Count': 123
            },
            'UniqueSources': {
                'Count': 123
            }
        },
    ]
}

Response Structure

• (dict) –

  • Status (string) –

    The status of the analysis report you specify. Statuses include RUNNING, COMPLETED, or FAILED.

  • StartTime (datetime) –

    The date and time within the last 30 days from which to start retrieving analysis data, in UTC format (for example, YYYY-MM-DDTHH:MM:SSZ.

  • EndTime (datetime) –

    The date and time, up to the current date, from which to stop retrieving analysis data, in UTC format (for example, YYYY-MM-DDTHH:MM:SSZ).

  • ReportTime (datetime) –

    The date and time the analysis report was ran.

  • AnalysisType (string) –

    The type of traffic that will be used to generate a report.

  • NextToken (string) –

    When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

  • AnalysisReportResults (list) –

    Retrieves the results of a traffic analysis report.

    • (dict) –

      The results of a COMPLETED analysis report generated with StartAnalysisReport.

      For an example of traffic analysis report results, see the response syntax of GetAnalysisReportResults.

      • Protocol (string) –

        The type of traffic captured by the analysis report.

      • FirstAccessed (datetime) –

        The date and time any domain was first accessed (within the last 30 day period).

      • LastAccessed (datetime) –

        The date and time any domain was last accessed (within the last 30 day period).

      • Domain (string) –

        The most frequently accessed domains.

      • Hits (dict) –

        The number of attempts made to access a observed domain.

        • Count (integer) –

          The number of attempts made to access a domain.

      • UniqueSources (dict) –

        The number of unique source IP addresses that connected to a domain.

        • Count (integer) –

          The number of unique source IP addresses that connected to a domain.

Exceptions

• NetworkFirewall.Client.exceptions.InvalidRequestException

• NetworkFirewall.Client.exceptions.InternalServerError

• NetworkFirewall.Client.exceptions.ResourceNotFoundException

• NetworkFirewall.Client.exceptions.ThrottlingException