Report an AWS IoT Device Defender custom metric from a device and evaluate it in a Security Profile behavior

Steps

1. Create the custom metric definition with the CreateCustomMetric API/CLI (create-custom-metric), specifying a metric-name and metric-type of number, number-list, string-list, or ip-address-list
2. Add the custom metric to a Security Profile's Additional Metrics to retain (console) or include it in a behavior in create-security-profile / update-security-profile (CLI), defining a comparisonOperator and threshold value against it
3. From the device, publish a metrics report to the reserved topic $aws/things/thingName/defender/metrics/payload-format (JSON or CBOR), including a custom_metrics block keyed by your metric name with a value object matching its type (e.g. {"number": 1}, {"number_list": [...]},{"string_list": [...]}, {"ip_list": [...]})
4. Confirm ingestion by subscribing to the corresponding .../accepted and .../rejected response topics; a rejected report includes an error message describing the parsing problem
5. Attach an alarm to the Security Profile behavior so consecutive datapoints breaching the custom metric's criteria trigger a Device Defender alert