---
title: Getting Started with Datadog
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog
---

# aws_shield_attack{% #aws_shield_attack %}

## `account_id`{% #account_id %}

**Type**: `STRING`

## `attack_counters`{% #attack_counters %}

**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `AttackCounters`**Description**: List of counters that describe the attack for the specified time period.

- `average`**Type**: `DOUBLE`**Provider name**: `Average`**Description**: The average value of the counter for a specified time period.
- `max`**Type**: `DOUBLE`**Provider name**: `Max`**Description**: The maximum value of the counter for a specified time period.
- `n`**Type**: `INT32`**Provider name**: `N`**Description**: The number of counters for a specified time period.
- `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The counter name.
- `sum`**Type**: `DOUBLE`**Provider name**: `Sum`**Description**: The total of counter values for a specified time period.
- `unit`**Type**: `STRING`**Provider name**: `Unit`**Description**: The unit of the counters.

## `attack_id`{% #attack_id %}

**Type**: `STRING`**Provider name**: `AttackId`**Description**: The unique identifier (ID) of the attack.

## `attack_properties`{% #attack_properties %}

**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `AttackProperties`**Description**: The array of objects that provide details of the Shield event. For infrastructure layer events (L3 and L4 events), you can view metrics for top contributors in Amazon CloudWatch metrics. For more information, see [Shield metrics and alarms](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#set-ddos-alarms) in the WAF Developer Guide.

- `attack_layer`**Type**: `STRING`**Provider name**: `AttackLayer`**Description**: The type of Shield event that was observed. `NETWORK` indicates layer 3 and layer 4 events and `APPLICATION` indicates layer 7 events. For infrastructure layer events (L3 and L4 events), you can view metrics for top contributors in Amazon CloudWatch metrics. For more information, see [Shield metrics and alarms](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#set-ddos-alarms) in the WAF Developer Guide.
- `attack_property_identifier`**Type**: `STRING`**Provider name**: `AttackPropertyIdentifier`**Description**: Defines the Shield event property information that is provided. The `WORDPRESS_PINGBACK_REFLECTOR` and `WORDPRESS_PINGBACK_SOURCE` values are valid only for WordPress reflective pingback events.
- `top_contributors`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `TopContributors`**Description**: Contributor objects for the top five contributors to a Shield event. A contributor is a source of traffic that Shield Advanced identifies as responsible for some or all of an event.
  - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the contributor. The type of name that you'll find here depends on the `AttackPropertyIdentifier` setting in the `AttackProperty` where this contributor is defined. For example, if the `AttackPropertyIdentifier` is `SOURCE_COUNTRY`, the `Name` could be `United States`.
  - `value`**Type**: `INT64`**Provider name**: `Value`**Description**: The contribution of this contributor expressed in Protection units. For example `10,000`.
- `total`**Type**: `INT64`**Provider name**: `Total`**Description**: The total contributions made to this Shield event by all contributors.
- `unit`**Type**: `STRING`**Provider name**: `Unit`**Description**: The unit used for the `Contributor` `Value` property.

## `end_time`{% #end_time %}

**Type**: `TIMESTAMP`**Provider name**: `EndTime`**Description**: The time the attack ended, in Unix time in seconds.

## `mitigations`{% #mitigations %}

**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Mitigations`**Description**: List of mitigation actions taken for the attack.

- `mitigation_name`**Type**: `STRING`**Provider name**: `MitigationName`**Description**: The name of the mitigation taken for this attack.

## `resource_arn`{% #resource_arn %}

**Type**: `STRING`**Provider name**: `ResourceArn`**Description**: The ARN (Amazon Resource Name) of the resource that was attacked.

## `start_time`{% #start_time %}

**Type**: `TIMESTAMP`**Provider name**: `StartTime`**Description**: The time the attack started, in Unix time in seconds.

## `sub_resources`{% #sub_resources %}

**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `SubResources`**Description**: If applicable, additional detail about the resource being attacked, for example, IP address or URL.

- `attack_vectors`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `AttackVectors`**Description**: The list of attack types and associated counters.
  - `vector_counters`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `VectorCounters`**Description**: The list of counters that describe the details of the attack.
    - `average`**Type**: `DOUBLE`**Provider name**: `Average`**Description**: The average value of the counter for a specified time period.
    - `max`**Type**: `DOUBLE`**Provider name**: `Max`**Description**: The maximum value of the counter for a specified time period.
    - `n`**Type**: `INT32`**Provider name**: `N`**Description**: The number of counters for a specified time period.
    - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The counter name.
    - `sum`**Type**: `DOUBLE`**Provider name**: `Sum`**Description**: The total of counter values for a specified time period.
    - `unit`**Type**: `STRING`**Provider name**: `Unit`**Description**: The unit of the counters.
  - `vector_type`**Type**: `STRING`**Provider name**: `VectorType`**Description**: The attack type, for example, SNMP reflection or SYN flood.
- `counters`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Counters`**Description**: The counters that describe the details of the attack.
  - `average`**Type**: `DOUBLE`**Provider name**: `Average`**Description**: The average value of the counter for a specified time period.
  - `max`**Type**: `DOUBLE`**Provider name**: `Max`**Description**: The maximum value of the counter for a specified time period.
  - `n`**Type**: `INT32`**Provider name**: `N`**Description**: The number of counters for a specified time period.
  - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The counter name.
  - `sum`**Type**: `DOUBLE`**Provider name**: `Sum`**Description**: The total of counter values for a specified time period.
  - `unit`**Type**: `STRING`**Provider name**: `Unit`**Description**: The unit of the counters.
- `id`**Type**: `STRING`**Provider name**: `Id`**Description**: The unique identifier (ID) of the `SubResource`.
- `type`**Type**: `STRING`**Provider name**: `Type`**Description**: The `SubResource` type.

## `tags`{% #tags %}

**Type**: `UNORDERED_LIST_STRING`