---
title: "Gem Security"
slug: "gem-security"
updated: 2026-02-26T08:16:30Z
published: 2026-02-26T08:16:30Z
canonical: "docs.hunters.ai/gem-security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Gem Security

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Gem Inventory Logs |  |  | ✅ |  | gem_security_inventory | NDJSON | API |
| Gem Threats (Alerts) | ✅ |  |  |  | gem_security_threats | NDJSON | API |

---

## Overview

![Gem Security Logo](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image-1739283581082.png)Gem Security is a cybersecurity company that provides advanced threat detection and response solutions, specifically focusing on securing cloud environments and APIs. The platform uses AI-driven analytics to identify vulnerabilities, misconfigurations, and malicious activity in real-time. Gem Security offers continuous monitoring to protect cloud-based applications and services, helping organizations secure their infrastructure and data from evolving threats. It provides security teams with detailed insights and automated remediation capabilities, allowing for faster incident response and reducing the risk of data breaches or attacks.

## Supported data types

### Gem Inventory Logs

**Table name:** `gem_security_inventory`

Gem Security's platform includes an advanced feature for cloud inventory logging, which provides comprehensive, real-time visibility into cloud assets. It automatically collects telemetry from multiple cloud services (like AWS, GCP, and Azure) and security tools, identifying gaps in visibility and ranking them by severity. This helps organizations detect potential risks efficiently by logging activity and offering actionable insights for incident response​.

### Gem Threats (Alerts)

**Table name:** `gem_security_threats`

Gem Security's platform generates alerts by automatically identifying and ranking security visibility gaps across cloud environments. It uses pre-configured detection rules to flag malicious activities and creates timelines that outline the order of events during an attack.

## Send data to Hunters

Hunters support the ingestion of Gem Security logs using API.

**To connect Gem Security logs:**

1. Retrieve the following information items from Gem Security:
  - Client ID
  - Client Secret
  - URL
2. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source).

## Expected format

Logs are expected in JSON format.

### Gem Inventory Logs

```JSON
{
    "id": 100000001,
    "account_id": 0000,
    "region": "provider/global",
    "resource_id": "RESOURCE_ID_PLACEHOLDER",
    "resource_type": "provider/Resource Type",
    "created_at": "2019-10-31T14:50:13Z",
    "identifiers": [
        {
            "name": "name",
            "value": "RESOURCE_NAME_PLACEHOLDER"
        },
        {
            "name": "id",
            "value": "RESOURCE_ID_PLACEHOLDER"
        }
    ],
    "external_url": "https://example.okta.com/api/v1/apps/APP_ID_PLACEHOLDER",
    "tags": {},
    "triage_entity": {
        "id": "RESOURCE_ID_PLACEHOLDER",
        "type": "provider_resource_type",
        "metadata": {
            "name": "RESOURCE_NAME_PLACEHOLDER"
        },
        "resource_id": "RESOURCE_ID_PLACEHOLDER",
        "name": null,
        "is_main_entity": false,
        "is_secondary_entity": false,
        "activity_by_provider": null,
        "cloud_provider": "provider"
    },
    "deleted": false
}
```

### Gem Threats (Alerts)

```JSON
{
  "id": "UUID_PRIMARY",
  "alert_id": "UUID_MAIN_ALERT",
  "main_alert_id": "UUID_MAIN_ALERT",
  "organization_id": "ORG_ID_PLACEHOLDER",
  "datetime": "2024-08-01T16:08:14.333000Z",
  "title": "GuardDuty | Execution:Kubernetes/AnomalousBehavior.WorkloadDeployed",
  "text": "The user system:serviceaccount:NAMESPACE_A:SERVICE_ACCOUNT_A has launched a Workload (Container Name: container-name, Workload Name: POD_NAME_A, Workload ID: WORKLOAD_UUID_A) in an unusual way in namespace NAMESPACE_A and cluster CLUSTER_NAME_A.",
  "entities": [
    {
      "id": "arn:aws:eks:REGION:AWS_ACCOUNT_ID:cluster/CLUSTER_NAME_A",
      "type": "eks_cluster",
      "metadata": {
        "name": "CLUSTER_NAME_A",
        "region": "REGION",
        "account_id": "AWS_ACCOUNT_ID",
        "context_from_event": null,
        "arn": "arn:aws:eks:REGION:AWS_ACCOUNT_ID:cluster/CLUSTER_NAME_A",
        "arn_id": "CLUSTER_NAME_A"
      },
      "resource_id": "arn:aws:eks:REGION:AWS_ACCOUNT_ID:cluster/CLUSTER_NAME_A",
      "name": null,
      "is_main_entity": false,
      "is_secondary_entity": true,
      "activity_by_provider": null,
      "cloud_provider": "aws"
    },
    {
      "id": "POD_NAME_A",
      "type": "eks_pod",
      "metadata": {
        "name": "POD_NAME_A",
        "cluster_name": "CLUSTER_NAME_A",
        "workload_type": "pods",
        "workload_namespace": "NAMESPACE_A"
      },
      "resource_id": null,
      "name": null,
      "is_main_entity": false,
      "is_secondary_entity": true,
      "activity_by_provider": null,
      "cloud_provider": "aws"
    },
    {
      "id": "system:serviceaccount:NAMESPACE_B:SERVICE_ACCOUNT_B",
      "type": "eks_service_account",
      "metadata": {
        "name": "system:serviceaccount:NAMESPACE_B:SERVICE_ACCOUNT_B",
        "cluster_name": "CLUSTER_NAME_A",
        "user_name": "system:serviceaccount:NAMESPACE_B:SERVICE_ACCOUNT_B",
        "groups": [
          "system:serviceaccounts",
          "system:serviceaccounts:NAMESPACE_B",
          "system:authenticated"
        ]
      },
      "resource_id": null,
      "name": null,
      "is_main_entity": true,
      "is_secondary_entity": false,
      "activity_by_provider": null,
      "cloud_provider": "aws"
    }
  ],
  "account_details": [
    {
      "id": 0000,
      "display_name": "AWS-ACCOUNT-PLACEHOLDER",
      "organization_name": "ORG_NAME_PLACEHOLDER",
      "identifier": "AWS_ACCOUNT_ID",
      "hierarchy_path": [
        { "id": "ROOT_ID", "name": "Root" },
        { "id": "OU_ID", "name": "OU_NAME" }
      ],
      "account_status": "accessible",
      "account_id": "AWS_ACCOUNT_ID",
      "cloudtrails": [],
      "aws_organization_id": "AWS_ORG_ID",
      "ou_path_list": [
        { "id": "ROOT_ID", "name": "Root" },
        { "id": "OU_ID", "name": "OU_NAME" }
      ],
      "supports_forensics_acquisition": false,
      "cloud_provider": "aws"
    }
  ],
  "severity": 2,
  "alert_severity": 2,
  "status": "open",
  "mitre_techniques": [],
  "ttp_id": "Execution:Kubernetes/AnomalousBehavior.WorkloadDeployed",
  "type": "threat",
  "alert_source": "GuardDuty",
  "alert_source_id": "GUARDDUTY_FINDING_ID_A",
  "alert_source_url": "https://console.aws.amazon.com/guardduty/home?region=REGION#/findings?fId=GUARDDUTY_FINDING_ID_A",
  "category": null,
  "is_visible": true,
  "assignees": [],
  "status_change_time": null,
  "plain_text_description": "The user system:serviceaccount:NAMESPACE_A:SERVICE_ACCOUNT_A has launched a Workload (Container Name: container-name, Workload Name: POD_NAME_A, Workload ID: WORKLOAD_UUID_A) in an unusual way in namespace NAMESPACE_A and cluster CLUSTER_NAME_A."
}
```