{
"data": [
{
"attributes": {
"accountIds": [
"222233334444",
"3333333555555"
],
"configRisks": {
"hasIdentityRisk": false,
"hasMisconfiguration": true,
"hasPrivilegedRole": true,
"isPrivileged": false,
"isProduction": true,
"isPubliclyAccessible": true
},
"entityMetadata": {
"accountID": "123456789012",
"environments": [
"production",
"us-east-1"
],
"mitreTactics": [
"Credential Access",
"Privilege Escalation"
],
"mitreTechniques": [
"T1078",
"T1098"
],
"projectID": "my-gcp-project",
"services": [
"api-gateway",
"lambda"
],
"sources": [
"cloudtrail",
"cloud-security-posture-management"
],
"subscriptionID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
},
"entityName": "john.doe",
"entityProviders": [
"AWS"
],
"entityRoles": [
[]
],
"entitySubTypes": [
"Root"
],
"entityType": "aws_iam_user",
"entityTypes": [
"Root",
"User Name"
],
"firstDetected": 1778876604661,
"lastActivityTitle": "Suspicious API call detected",
"lastDetected": 1780064607093,
"riskScore": 85,
"riskScoreEvolution": 12,
"severity": "critical",
"signalsDetected": 15
},
"id": "arn:aws:iam::123456789012:user/john.doe",
"type": "SecurityEntityRiskScore"
}
],
"meta": {
"pageNumber": 1,
"pageSize": 10,
"queryId": "abc123def456",
"totalRowCount": 150
}
}