amazonaws_guardduty

@datafire/amazonaws_guardduty

Client library for Amazon GuardDuty

Installation and Usage

npm install --save @datafire/amazonaws_guardduty

let amazonaws_guardduty = require('@datafire/amazonaws_guardduty').create({
  accessKeyId: "",
  secretAccessKey: "",
  region: ""
});

.then(data => {
  console.log(data);
});

Description

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following data sources: VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses threat intelligence feeds (such as lists of malicious IPs and domains) and machine learning to identify unexpected, potentially unauthorized, and malicious activity within your AWS environment. This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IPs, URLs, or domains. For example, GuardDuty can detect compromised EC2 instances that serve malware or mine bitcoin.

GuardDuty also monitors AWS account access behavior for signs of compromise. Some examples of this are unauthorized infrastructure deployments such as EC2 instances deployed in a Region that has never been used, or unusual API calls like a password policy change to reduce password strength.

GuardDuty informs you of the status of your AWS environment by producing security findings that you can view in the GuardDuty console or through Amazon CloudWatch events. For more information, see the Amazon GuardDuty User Guide .

Actions

ListOrganizationAdminAccounts

amazonaws_guardduty.ListOrganizationAdminAccounts({}, context)

Input

• input object
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListOrganizationAdminAccountsResponse

DisableOrganizationAdminAccount

amazonaws_guardduty.DisableOrganizationAdminAccount({
  "adminAccountId": ""
}, context)

Input

• input object
  • adminAccountId required string: The AWS Account ID for the organizations account to be disabled as a GuardDuty delegated administrator.

Output

• output DisableOrganizationAdminAccountResponse

EnableOrganizationAdminAccount

amazonaws_guardduty.EnableOrganizationAdminAccount({
  "adminAccountId": ""
}, context)

Input

• input object
  • adminAccountId required string: The AWS Account ID for the organization account to be enabled as a GuardDuty delegated administrator.

Output

• output EnableOrganizationAdminAccountResponse

ListDetectors

amazonaws_guardduty.ListDetectors({}, context)

Input

• input object
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListDetectorsResponse

CreateDetector

amazonaws_guardduty.CreateDetector({
  "enable": true
}, context)

Input

• input object
  • tags object: The tags to be added to a new detector resource.
  • clientToken string: The idempotency token for the create request.
  • dataSources object: Contains information about which data sources are enabled.
    • S3Logs
      • Enable required
  • enable required boolean: A Boolean value that specifies whether the detector is to be enabled.
  • findingPublishingFrequency string (values: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS): A value that specifies how frequently updated findings are exported.

Output

• output CreateDetectorResponse

DeleteDetector

amazonaws_guardduty.DeleteDetector({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string

Output

• output DeleteDetectorResponse

GetDetector

amazonaws_guardduty.GetDetector({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string

Output

• output GetDetectorResponse

UpdateDetector

amazonaws_guardduty.UpdateDetector({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • dataSources object: Contains information about which data sources are enabled.
    • S3Logs
      • Enable required
  • enable boolean: Specifies whether the detector is enabled or not enabled.
  • findingPublishingFrequency string (values: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS): An enum value that specifies how frequently findings are exported, such as to CloudWatch Events.

Output

• output UpdateDetectorResponse

DescribeOrganizationConfiguration

amazonaws_guardduty.DescribeOrganizationConfiguration({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string

Output

• output DescribeOrganizationConfigurationResponse

UpdateOrganizationConfiguration

amazonaws_guardduty.UpdateOrganizationConfiguration({
  "detectorId": "",
  "autoEnable": true
}, context)

Input

• input object
  • detectorId required string
  • autoEnable required boolean: Indicates whether to automatically enable member accounts in the organization.
  • dataSources object: An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.
    • S3Logs
      • AutoEnable required

Output

• output UpdateOrganizationConfigurationResponse

ListFilters

amazonaws_guardduty.ListFilters({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListFiltersResponse

CreateFilter

amazonaws_guardduty.CreateFilter({
  "detectorId": "",
  "name": "",
  "findingCriteria": {}
}, context)

Input

• input object
  • detectorId required string
  • tags object: The tags to be added to a new filter resource.
  • action string (values: NOOP, ARCHIVE): Specifies the action that is to be applied to the findings that match the filter.
  • clientToken string: The idempotency token for the create request.
  • description string: The description of the filter.
  • findingCriteria required object: Contains information about the criteria used for querying findings.
    • Criterion
  • name required string: The name of the filter. Minimum length of 3. Maximum length of 64. Valid characters include alphanumeric characters, dot (.), underscore (_), and dash (-). Spaces are not allowed.
  • rank integer: Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.

Output

• output CreateFilterResponse

DeleteFilter

amazonaws_guardduty.DeleteFilter({
  "detectorId": "",
  "filterName": ""
}, context)

Input

• input object
  • detectorId required string
  • filterName required string

Output

• output DeleteFilterResponse

GetFilter

amazonaws_guardduty.GetFilter({
  "detectorId": "",
  "filterName": ""
}, context)

Input

• input object
  • detectorId required string
  • filterName required string

Output

• output GetFilterResponse

UpdateFilter

amazonaws_guardduty.UpdateFilter({
  "detectorId": "",
  "filterName": ""
}, context)

Input

• input object
  • detectorId required string
  • filterName required string
  • action string (values: NOOP, ARCHIVE): Specifies the action that is to be applied to the findings that match the filter.
  • description string: The description of the filter.
  • findingCriteria object: Contains information about the criteria used for querying findings.
    • Criterion
  • rank integer: Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.

Output

• output UpdateFilterResponse

ListFindings

amazonaws_guardduty.ListFindings({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • MaxResults string
  • NextToken string
  • findingCriteria object: Contains information about the criteria used for querying findings.
    • Criterion
  • maxResults integer: You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.
  • nextToken string: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
  • sortCriteria object: Contains information about the criteria used for sorting findings.
    • AttributeName
    • OrderBy

Output

• output ListFindingsResponse

ArchiveFindings

amazonaws_guardduty.ArchiveFindings({
  "detectorId": "",
  "findingIds": []
}, context)

Input

• input object
  • detectorId required string
  • findingIds required array: The IDs of the findings that you want to archive.
    • items FindingId

Output

• output ArchiveFindingsResponse

CreateSampleFindings

amazonaws_guardduty.CreateSampleFindings({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • findingTypes array: The types of sample findings to generate.
    • items FindingType

Output

• output CreateSampleFindingsResponse

UpdateFindingsFeedback

amazonaws_guardduty.UpdateFindingsFeedback({
  "detectorId": "",
  "findingIds": [],
  "feedback": ""
}, context)

Input

• input object
  • detectorId required string
  • comments string: Additional feedback about the GuardDuty findings.
  • feedback required string (values: USEFUL, NOT_USEFUL): The feedback for the finding.
  • findingIds required array: The IDs of the findings that you want to mark as useful or not useful.
    • items FindingId

Output

• output UpdateFindingsFeedbackResponse

GetFindings

amazonaws_guardduty.GetFindings({
  "detectorId": "",
  "findingIds": []
}, context)

Input

• input object
  • detectorId required string
  • findingIds required array: The IDs of the findings that you want to retrieve.
    • items FindingId
  • sortCriteria object: Contains information about the criteria used for sorting findings.
    • AttributeName
    • OrderBy

Output

• output GetFindingsResponse

GetFindingsStatistics

amazonaws_guardduty.GetFindingsStatistics({
  "detectorId": "",
  "findingStatisticTypes": []
}, context)

Input

• input object
  • detectorId required string
  • findingCriteria object: Contains information about the criteria used for querying findings.
    • Criterion
  • findingStatisticTypes required array: The types of finding statistics to retrieve.
    • items FindingStatisticType

Output

• output GetFindingsStatisticsResponse

UnarchiveFindings

amazonaws_guardduty.UnarchiveFindings({
  "detectorId": "",
  "findingIds": []
}, context)

Input

• input object
  • detectorId required string
  • findingIds required array: The IDs of the findings to unarchive.
    • items FindingId

Output

• output UnarchiveFindingsResponse

ListIPSets

amazonaws_guardduty.ListIPSets({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListIPSetsResponse

CreateIPSet

amazonaws_guardduty.CreateIPSet({
  "detectorId": "",
  "name": "",
  "format": "",
  "location": "",
  "activate": true
}, context)

Input

• input object
  • detectorId required string
  • tags object: The tags to be added to a new IP set resource.
  • activate required boolean: A Boolean value that indicates whether GuardDuty is to start using the uploaded IPSet.
  • clientToken string: The idempotency token for the create request.
  • format required string (values: TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE): The format of the file that contains the IPSet.
  • location required string: The URI of the file that contains the IPSet. For example: https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key.
  • name required string:

    The user-friendly name to identify the IPSet.

    Allowed characters are alphanumerics, spaces, hyphens (-), and underscores (_).

Output

• output CreateIPSetResponse

DeleteIPSet

amazonaws_guardduty.DeleteIPSet({
  "detectorId": "",
  "ipSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • ipSetId required string

Output

• output DeleteIPSetResponse

GetIPSet

amazonaws_guardduty.GetIPSet({
  "detectorId": "",
  "ipSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • ipSetId required string

Output

• output GetIPSetResponse

UpdateIPSet

amazonaws_guardduty.UpdateIPSet({
  "detectorId": "",
  "ipSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • ipSetId required string
  • activate boolean: The updated Boolean value that specifies whether the IPSet is active or not.
  • location string: The updated URI of the file that contains the IPSet. For example: https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key.
  • name string: The unique ID that specifies the IPSet that you want to update.

Output

• output UpdateIPSetResponse

GetMasterAccount

amazonaws_guardduty.GetMasterAccount({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string

Output

• output GetMasterAccountResponse

AcceptInvitation

amazonaws_guardduty.AcceptInvitation({
  "detectorId": "",
  "masterId": "",
  "invitationId": ""
}, context)

Input

• input object
  • detectorId required string
  • invitationId required string: The value that is used to validate the administrator account to the member account.
  • masterId required string: The account ID of the GuardDuty administrator account whose invitation you're accepting.

Output

• output AcceptInvitationResponse

DisassociateFromMasterAccount

amazonaws_guardduty.DisassociateFromMasterAccount({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string

Output

• output DisassociateFromMasterAccountResponse

ListMembers

amazonaws_guardduty.ListMembers({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • maxResults integer
  • nextToken string
  • onlyAssociated string
  • MaxResults string
  • NextToken string

Output

• output ListMembersResponse

CreateMembers

amazonaws_guardduty.CreateMembers({
  "detectorId": "",
  "accountDetails": []
}, context)

Input

• input object
  • detectorId required string
  • accountDetails required array: A list of account ID and email address pairs of the accounts that you want to associate with the GuardDuty administrator account.
    • items AccountDetail

Output

• output CreateMembersResponse

DeleteMembers

amazonaws_guardduty.DeleteMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs of the GuardDuty member accounts that you want to delete.
    • items AccountId

Output

• output DeleteMembersResponse

GetMemberDetectors

amazonaws_guardduty.GetMemberDetectors({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: The account ID of the member account.
    • items AccountId

Output

• output GetMemberDetectorsResponse

UpdateMemberDetectors

amazonaws_guardduty.UpdateMemberDetectors({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of member account IDs to be updated.
    • items AccountId
  • dataSources object: Contains information about which data sources are enabled.
    • S3Logs
      • Enable required

Output

• output UpdateMemberDetectorsResponse

DisassociateMembers

amazonaws_guardduty.DisassociateMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs of the GuardDuty member accounts that you want to disassociate from the administrator account.
    • items AccountId

Output

• output DisassociateMembersResponse

GetMembers

amazonaws_guardduty.GetMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs of the GuardDuty member accounts that you want to describe.
    • items AccountId

Output

• output GetMembersResponse

InviteMembers

amazonaws_guardduty.InviteMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs of the accounts that you want to invite to GuardDuty as members.
    • items AccountId
  • disableEmailNotification boolean: A Boolean value that specifies whether you want to disable email notification to the accounts that you are inviting to GuardDuty as members.
  • message string: The invitation message that you want to send to the accounts that you're inviting to GuardDuty as members.

Output

• output InviteMembersResponse

StartMonitoringMembers

amazonaws_guardduty.StartMonitoringMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs of the GuardDuty member accounts to start monitoring.
    • items AccountId

Output

• output StartMonitoringMembersResponse

StopMonitoringMembers

amazonaws_guardduty.StopMonitoringMembers({
  "detectorId": "",
  "accountIds": []
}, context)

Input

• input object
  • detectorId required string
  • accountIds required array: A list of account IDs for the member accounts to stop monitoring.
    • items AccountId

Output

• output StopMonitoringMembersResponse

ListPublishingDestinations

amazonaws_guardduty.ListPublishingDestinations({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListPublishingDestinationsResponse

CreatePublishingDestination

amazonaws_guardduty.CreatePublishingDestination({
  "detectorId": "",
  "destinationType": "",
  "destinationProperties": {}
}, context)

Input

• input object
  • detectorId required string
  • clientToken string: The idempotency token for the request.
  • destinationProperties required object: Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
    • DestinationArn
    • KmsKeyArn
  • destinationType required string (values: S3): The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.

Output

• output CreatePublishingDestinationResponse

DeletePublishingDestination

amazonaws_guardduty.DeletePublishingDestination({
  "detectorId": "",
  "destinationId": ""
}, context)

Input

• input object
  • detectorId required string
  • destinationId required string

Output

• output DeletePublishingDestinationResponse

DescribePublishingDestination

amazonaws_guardduty.DescribePublishingDestination({
  "detectorId": "",
  "destinationId": ""
}, context)

Input

• input object
  • detectorId required string
  • destinationId required string

Output

• output DescribePublishingDestinationResponse

UpdatePublishingDestination

amazonaws_guardduty.UpdatePublishingDestination({
  "detectorId": "",
  "destinationId": ""
}, context)

Input

• input object
  • detectorId required string
  • destinationId required string
  • destinationProperties object: Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
    • DestinationArn
    • KmsKeyArn

Output

• output UpdatePublishingDestinationResponse

ListThreatIntelSets

amazonaws_guardduty.ListThreatIntelSets({
  "detectorId": ""
}, context)

Input

• input object
  • detectorId required string
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListThreatIntelSetsResponse

CreateThreatIntelSet

amazonaws_guardduty.CreateThreatIntelSet({
  "detectorId": "",
  "name": "",
  "format": "",
  "location": "",
  "activate": true
}, context)

Input

• input object
  • detectorId required string
  • tags object: The tags to be added to a new threat list resource.
  • activate required boolean: A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
  • clientToken string: The idempotency token for the create request.
  • format required string (values: TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE): The format of the file that contains the ThreatIntelSet.
  • location required string: The URI of the file that contains the ThreatIntelSet. For example: https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key.
  • name required string: A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

Output

• output CreateThreatIntelSetResponse

DeleteThreatIntelSet

amazonaws_guardduty.DeleteThreatIntelSet({
  "detectorId": "",
  "threatIntelSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • threatIntelSetId required string

Output

• output DeleteThreatIntelSetResponse

GetThreatIntelSet

amazonaws_guardduty.GetThreatIntelSet({
  "detectorId": "",
  "threatIntelSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • threatIntelSetId required string

Output

• output GetThreatIntelSetResponse

UpdateThreatIntelSet

amazonaws_guardduty.UpdateThreatIntelSet({
  "detectorId": "",
  "threatIntelSetId": ""
}, context)

Input

• input object
  • detectorId required string
  • threatIntelSetId required string
  • activate boolean: The updated Boolean value that specifies whether the ThreateIntelSet is active or not.
  • location string: The updated URI of the file that contains the ThreateIntelSet.
  • name string: The unique ID that specifies the ThreatIntelSet that you want to update.

Output

• output UpdateThreatIntelSetResponse

GetUsageStatistics

amazonaws_guardduty.GetUsageStatistics({
  "detectorId": "",
  "usageStatisticsType": "",
  "usageCriteria": {}
}, context)

Input

• input object
  • detectorId required string
  • MaxResults string
  • NextToken string
  • maxResults integer: The maximum number of results to return in the response.
  • nextToken string: A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.
  • unit string: The currency unit you would like to view your usage statistics in. Current valid values are USD.
  • usageCriteria required object: Contains information about the criteria used to query usage statistics.
    • AccountIds
      • items AccountId
    • DataSources
      • items DataSource
    • Resources
      • items String
  • usageStatisticsType required string (values: SUM_BY_ACCOUNT, SUM_BY_DATA_SOURCE, SUM_BY_RESOURCE, TOP_RESOURCES): The type of usage statistics to retrieve.

Output

• output GetUsageStatisticsResponse

ListInvitations

amazonaws_guardduty.ListInvitations({}, context)

Input

• input object
  • maxResults integer
  • nextToken string
  • MaxResults string
  • NextToken string

Output

• output ListInvitationsResponse

GetInvitationsCount

amazonaws_guardduty.GetInvitationsCount({}, context)

Input

• input object

Output

• output GetInvitationsCountResponse

DeclineInvitations

amazonaws_guardduty.DeclineInvitations({
  "accountIds": []
}, context)

Input

• input object
  • accountIds required array: A list of account IDs of the AWS accounts that sent invitations to the current member account that you want to decline invitations from.
    • items AccountId

Output

• output DeclineInvitationsResponse

DeleteInvitations

amazonaws_guardduty.DeleteInvitations({
  "accountIds": []
}, context)

Input

• input object
  • accountIds required array: A list of account IDs of the AWS accounts that sent invitations to the current member account that you want to delete invitations from.
    • items AccountId

Output

• output DeleteInvitationsResponse

ListTagsForResource

amazonaws_guardduty.ListTagsForResource({
  "resourceArn": ""
}, context)

Input

• input object
  • resourceArn required string

Output

• output ListTagsForResourceResponse

TagResource

amazonaws_guardduty.TagResource({
  "resourceArn": "",
  "tags": {}
}, context)

Input

• input object
  • resourceArn required string
  • tags required object: The tags to be added to a resource.

Output

Output schema unknown

UntagResource

amazonaws_guardduty.UntagResource({
  "resourceArn": "",
  "tagKeys": []
}, context)

Input

• input object
  • resourceArn required string
  • tagKeys required array

Output

Output schema unknown

Definitions

AcceptInvitationRequest

• AcceptInvitationRequest object
  • InvitationId required
  • MasterId required

AcceptInvitationResponse

• AcceptInvitationResponse object

AccessControlList

• AccessControlList object: Contains information on the current access control policies for the bucket.
  • AllowsPublicReadAccess
  • AllowsPublicWriteAccess

AccessKeyDetails

• AccessKeyDetails object: Contains information about the access keys.
  • AccessKeyId
  • PrincipalId
  • UserName
  • UserType

AccountDetail

• AccountDetail object: Contains information about the account.
  • AccountId required
  • Email required

AccountDetails

• AccountDetails array
  • items AccountDetail

AccountId

• AccountId string

AccountIds

• AccountIds array
  • items AccountId

AccountLevelPermissions

• AccountLevelPermissions object: Contains information about the account level permissions on the S3 bucket.
  • BlockPublicAccess
    • BlockPublicAcls
    • BlockPublicPolicy
    • IgnorePublicAcls
    • RestrictPublicBuckets

Action

• Action object: Contains information about actions.
  • ActionType
  • AwsApiCallAction
    • Api
    • CallerType
    • DomainDetails
      • Domain
    • ErrorCode
    • RemoteIpDetails
      • City
        • CityName
      • Country
        • CountryCode
        • CountryName
      • GeoLocation
        • Lat
        • Lon
      • IpAddressV4
      • Organization
        • Asn
        • AsnOrg
        • Isp
        • Org
    • ServiceName
  • DnsRequestAction
    • Domain
  • NetworkConnectionAction
    • Blocked
    • ConnectionDirection
    • LocalIpDetails
      • IpAddressV4
    • LocalPortDetails
      • Port
      • PortName
    • Protocol
    • RemoteIpDetails
      • City
        • CityName
      • Country
        • CountryCode
        • CountryName
      • GeoLocation
        • Lat
        • Lon
      • IpAddressV4
      • Organization
        • Asn
        • AsnOrg
        • Isp
        • Org
    • RemotePortDetails
      • Port
      • PortName
  • PortProbeAction
    • Blocked
    • PortProbeDetails
      • items PortProbeDetail

AdminAccount

• AdminAccount object: The account within the organization specified as the GuardDuty delegated administrator.
  • AdminAccountId
  • AdminStatus

AdminAccounts

• AdminAccounts array
  • items AdminAccount

AdminStatus

• AdminStatus string (values: ENABLED, DISABLE_IN_PROGRESS)

ArchiveFindingsRequest

• ArchiveFindingsRequest object
  • FindingIds required
    • items FindingId

ArchiveFindingsResponse

• ArchiveFindingsResponse object

AwsApiCallAction

• AwsApiCallAction object: Contains information about the API action.
  • Api
  • CallerType
  • DomainDetails
    • Domain
  • ErrorCode
  • RemoteIpDetails
    • City
      • CityName
    • Country
      • CountryCode
      • CountryName
    • GeoLocation
      • Lat
      • Lon
    • IpAddressV4
    • Organization
      • Asn
      • AsnOrg
      • Isp
      • Org
  • ServiceName

BadRequestException

BlockPublicAccess

• BlockPublicAccess object: Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access for more information.
  • BlockPublicAcls
  • BlockPublicPolicy
  • IgnorePublicAcls
  • RestrictPublicBuckets

Boolean

• Boolean boolean

BucketLevelPermissions

• BucketLevelPermissions object: Contains information about the bucket level permissions for the S3 bucket.
  • AccessControlList
    • AllowsPublicReadAccess
    • AllowsPublicWriteAccess
  • BlockPublicAccess
    • BlockPublicAcls
    • BlockPublicPolicy
    • IgnorePublicAcls
    • RestrictPublicBuckets
  • BucketPolicy
    • AllowsPublicReadAccess
    • AllowsPublicWriteAccess

BucketPolicy

• BucketPolicy object: Contains information on the current bucket policies for the S3 bucket.
  • AllowsPublicReadAccess
  • AllowsPublicWriteAccess

City

• City object: Contains information about the city associated with the IP address.
  • CityName

ClientToken

• ClientToken string

CloudTrailConfigurationResult

• CloudTrailConfigurationResult object: Contains information on the status of CloudTrail as a data source for the detector.
  • Status required

Condition

• Condition object: Contains information about the condition.
  • Eq
    • items String
  • Equals
    • items String
  • GreaterThan
  • GreaterThanOrEqual
  • Gt
  • Gte
  • LessThan
  • LessThanOrEqual
  • Lt
  • Lte
  • Neq
    • items String
  • NotEquals
    • items String

CountBySeverity

• CountBySeverity object

Country

• Country object: Contains information about the country where the remote IP address is located.
  • CountryCode
  • CountryName

CreateDetectorRequest

• CreateDetectorRequest object
  • ClientToken
  • DataSources
    • S3Logs
      • Enable required
  • Enable required
  • FindingPublishingFrequency
  • Tags

CreateDetectorResponse

• CreateDetectorResponse object
  • DetectorId

CreateFilterRequest

• CreateFilterRequest object
  • Action
  • ClientToken
  • Description
  • FindingCriteria required
    • Criterion
  • Name required
  • Rank
  • Tags

CreateFilterResponse

• CreateFilterResponse object
  • Name required

CreateIPSetRequest

• CreateIPSetRequest object
  • Activate required
  • ClientToken
  • Format required
  • Location required
  • Name required
  • Tags

CreateIPSetResponse

• CreateIPSetResponse object
  • IpSetId required

CreateMembersRequest

• CreateMembersRequest object
  • AccountDetails required
    • items AccountDetail

CreateMembersResponse

• CreateMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

CreatePublishingDestinationRequest

• CreatePublishingDestinationRequest object
  • ClientToken
  • DestinationProperties required
    • DestinationArn
    • KmsKeyArn
  • DestinationType required

CreatePublishingDestinationResponse

• CreatePublishingDestinationResponse object
  • DestinationId required

CreateSampleFindingsRequest

• CreateSampleFindingsRequest object
  • FindingTypes
    • items FindingType

CreateSampleFindingsResponse

• CreateSampleFindingsResponse object

CreateThreatIntelSetRequest

• CreateThreatIntelSetRequest object
  • Activate required
  • ClientToken
  • Format required
  • Location required
  • Name required
  • Tags

CreateThreatIntelSetResponse

• CreateThreatIntelSetResponse object
  • ThreatIntelSetId required

Criterion

• Criterion object

DNSLogsConfigurationResult

• DNSLogsConfigurationResult object: Contains information on the status of DNS logs as a data source.
  • Status required

DataSource

• DataSource string (values: FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_LOGS)

DataSourceConfigurations

• DataSourceConfigurations object: Contains information about which data sources are enabled.
  • S3Logs
    • Enable required

DataSourceConfigurationsResult

• DataSourceConfigurationsResult object: Contains information on the status of data sources for the detector.
  • CloudTrail required
    • Status required
  • DNSLogs required
    • Status required
  • FlowLogs required
    • Status required
  • S3Logs required
    • Status required

DataSourceList

• DataSourceList array
  • items DataSource

DataSourceStatus

• DataSourceStatus string (values: ENABLED, DISABLED)

DeclineInvitationsRequest

• DeclineInvitationsRequest object
  • AccountIds required
    • items AccountId

DeclineInvitationsResponse

• DeclineInvitationsResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

DefaultServerSideEncryption

• DefaultServerSideEncryption object: Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption for more information.
  • EncryptionType
  • KmsMasterKeyArn

DeleteDetectorRequest

• DeleteDetectorRequest object

DeleteDetectorResponse

• DeleteDetectorResponse object

DeleteFilterRequest

• DeleteFilterRequest object

DeleteFilterResponse

• DeleteFilterResponse object

DeleteIPSetRequest

• DeleteIPSetRequest object

DeleteIPSetResponse

• DeleteIPSetResponse object

DeleteInvitationsRequest

• DeleteInvitationsRequest object
  • AccountIds required
    • items AccountId

DeleteInvitationsResponse

• DeleteInvitationsResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

DeleteMembersRequest

• DeleteMembersRequest object
  • AccountIds required
    • items AccountId

DeleteMembersResponse

• DeleteMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

DeletePublishingDestinationRequest

• DeletePublishingDestinationRequest object

DeletePublishingDestinationResponse

• DeletePublishingDestinationResponse object

DeleteThreatIntelSetRequest

• DeleteThreatIntelSetRequest object

DeleteThreatIntelSetResponse

• DeleteThreatIntelSetResponse object

DescribeOrganizationConfigurationRequest

• DescribeOrganizationConfigurationRequest object

DescribeOrganizationConfigurationResponse

• DescribeOrganizationConfigurationResponse object
  • AutoEnable required
  • DataSources
    • S3Logs required
      • AutoEnable required
  • MemberAccountLimitReached required

DescribePublishingDestinationRequest

• DescribePublishingDestinationRequest object

DescribePublishingDestinationResponse

• DescribePublishingDestinationResponse object
  • DestinationId required
  • DestinationProperties required
    • DestinationArn
    • KmsKeyArn
  • DestinationType required
  • PublishingFailureStartTimestamp required
  • Status required

Destination

• Destination object: Contains information about the publishing destination, including the ID, type, and status.
  • DestinationId required
  • DestinationType required
  • Status required

DestinationProperties

• DestinationProperties object: Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
  • DestinationArn
  • KmsKeyArn

DestinationType

• DestinationType string (values: S3)

Destinations

• Destinations array
  • items Destination

DetectorId

• DetectorId string

DetectorIds

• DetectorIds array
  • items DetectorId

DetectorStatus

• DetectorStatus string (values: ENABLED, DISABLED)

DisableOrganizationAdminAccountRequest

• DisableOrganizationAdminAccountRequest object
  • AdminAccountId required

DisableOrganizationAdminAccountResponse

• DisableOrganizationAdminAccountResponse object

DisassociateFromMasterAccountRequest

• DisassociateFromMasterAccountRequest object

DisassociateFromMasterAccountResponse

• DisassociateFromMasterAccountResponse object

DisassociateMembersRequest

• DisassociateMembersRequest object
  • AccountIds required
    • items AccountId

DisassociateMembersResponse

• DisassociateMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

DnsRequestAction

• DnsRequestAction object: Contains information about the DNS_REQUEST action described in this finding.
  • Domain

DomainDetails

• DomainDetails object: Contains information about the domain.
  • Domain

Double

• Double number

Email

• Email string

EnableOrganizationAdminAccountRequest

• EnableOrganizationAdminAccountRequest object
  • AdminAccountId required

EnableOrganizationAdminAccountResponse

• EnableOrganizationAdminAccountResponse object

Eq

• Eq array
  • items String

Equals

• Equals array
  • items String

Evidence

• Evidence object: Contains information about the reason that the finding was generated.
  • ThreatIntelligenceDetails
    • items ThreatIntelligenceDetail

Feedback

• Feedback string (values: USEFUL, NOT_USEFUL)

FilterAction

• FilterAction string (values: NOOP, ARCHIVE)

FilterDescription

• FilterDescription string

FilterName

• FilterName string

FilterNames

• FilterNames array
  • items FilterName

FilterRank

• FilterRank integer

Finding

• Finding object: Contains information about the finding, which is generated when abnormal or suspicious activity is detected.
  • AccountId required
  • Arn required
  • Confidence
  • CreatedAt required
  • Description
  • Id required
  • Partition
  • Region required
  • Resource required
    • AccessKeyDetails
      • AccessKeyId
      • PrincipalId
      • UserName
      • UserType
    • InstanceDetails
      • AvailabilityZone
      • IamInstanceProfile
        • Arn
        • Id
      • ImageDescription
      • ImageId
      • InstanceId
      • InstanceState
      • InstanceType
      • LaunchTime
      • NetworkInterfaces
        • items NetworkInterface
      • OutpostArn
      • Platform
      • ProductCodes
        • items ProductCode
      • Tags
        • items Tag
    • ResourceType
    • S3BucketDetails
      • items S3BucketDetail
  • SchemaVersion required
  • Service
    • Action
      • ActionType
      • AwsApiCallAction
        • Api
        • CallerType
        • DomainDetails
          • Domain
        • ErrorCode
        • RemoteIpDetails
          • City
          • Country
          • GeoLocation
          • IpAddressV4
          • Organization
        • ServiceName
      • DnsRequestAction
        • Domain
      • NetworkConnectionAction
        • Blocked
        • ConnectionDirection
        • LocalIpDetails
          • IpAddressV4
        • LocalPortDetails
          • Port
          • PortName
        • Protocol
        • RemoteIpDetails
          • City
          • Country
          • GeoLocation
          • IpAddressV4
          • Organization
        • RemotePortDetails
          • Port
          • PortName
      • PortProbeAction
        • Blocked
        • PortProbeDetails
          • items PortProbeDetail
    • Archived
    • Count
    • DetectorId
    • EventFirstSeen
    • EventLastSeen
    • Evidence
      • ThreatIntelligenceDetails
        • items ThreatIntelligenceDetail
    • ResourceRole
    • ServiceName
    • UserFeedback
  • Severity required
  • Title
  • Type required
  • UpdatedAt required

FindingCriteria

• FindingCriteria object: Contains information about the criteria used for querying findings.
  • Criterion

FindingId

• FindingId string

FindingIds

• FindingIds array
  • items FindingId

FindingPublishingFrequency

• FindingPublishingFrequency string (values: FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS)

FindingStatisticType

• FindingStatisticType string (values: COUNT_BY_SEVERITY)

FindingStatisticTypes

• FindingStatisticTypes array
  • items FindingStatisticType

FindingStatistics

• FindingStatistics object: Contains information about finding statistics.
  • CountBySeverity

FindingType

• FindingType string

FindingTypes

• FindingTypes array
  • items FindingType

Findings

• Findings array
  • items Finding

FlowLogsConfigurationResult

• FlowLogsConfigurationResult object: Contains information on the status of VPC flow logs as a data source.
  • Status required

GeoLocation

• GeoLocation object: Contains information about the location of the remote IP address.
  • Lat
  • Lon

GetDetectorRequest

• GetDetectorRequest object

GetDetectorResponse

• GetDetectorResponse object
  • CreatedAt
  • DataSources
    • CloudTrail required
      • Status required
    • DNSLogs required
      • Status required
    • FlowLogs required
      • Status required
    • S3Logs required
      • Status required
  • FindingPublishingFrequency
  • ServiceRole required
  • Status required
  • Tags
  • UpdatedAt

GetFilterRequest

• GetFilterRequest object

GetFilterResponse

• GetFilterResponse object
  • Action required
  • Description
  • FindingCriteria required
    • Criterion
  • Name required
  • Rank
  • Tags

GetFindingsRequest

• GetFindingsRequest object
  • FindingIds required
    • items FindingId
  • SortCriteria
    • AttributeName
    • OrderBy

GetFindingsResponse

• GetFindingsResponse object
  • Findings required
    • items Finding

GetFindingsStatisticsRequest

• GetFindingsStatisticsRequest object
  • FindingCriteria
    • Criterion
  • FindingStatisticTypes required
    • items FindingStatisticType

GetFindingsStatisticsResponse

• GetFindingsStatisticsResponse object
  • FindingStatistics required
    • CountBySeverity

GetIPSetRequest

• GetIPSetRequest object

GetIPSetResponse

• GetIPSetResponse object
  • Format required
  • Location required
  • Name required
  • Status required
  • Tags

GetInvitationsCountRequest

• GetInvitationsCountRequest object

GetInvitationsCountResponse

• GetInvitationsCountResponse object
  • InvitationsCount

GetMasterAccountRequest

• GetMasterAccountRequest object

GetMasterAccountResponse

• GetMasterAccountResponse object
  • Master required
    • AccountId
    • InvitationId
    • InvitedAt
    • RelationshipStatus

GetMemberDetectorsRequest

• GetMemberDetectorsRequest object
  • AccountIds required
    • items AccountId

GetMemberDetectorsResponse

• GetMemberDetectorsResponse object
  • MemberDataSourceConfigurations required
    • items MemberDataSourceConfiguration
  • UnprocessedAccounts required
    • items UnprocessedAccount

GetMembersRequest

• GetMembersRequest object
  • AccountIds required
    • items AccountId

GetMembersResponse

• GetMembersResponse object
  • Members required
    • items Member
  • UnprocessedAccounts required
    • items UnprocessedAccount

GetThreatIntelSetRequest

• GetThreatIntelSetRequest object

GetThreatIntelSetResponse

• GetThreatIntelSetResponse object
  • Format required
  • Location required
  • Name required
  • Status required
  • Tags

GetUsageStatisticsRequest

• GetUsageStatisticsRequest object
  • MaxResults
  • NextToken
  • Unit
  • UsageCriteria required
    • AccountIds
      • items AccountId
    • DataSources required
      • items DataSource
    • Resources
      • items String
  • UsageStatisticType required

GetUsageStatisticsResponse

• GetUsageStatisticsResponse object
  • NextToken
  • UsageStatistics
    • SumByAccount
      • items UsageAccountResult
    • SumByDataSource
      • items UsageDataSourceResult
    • SumByResource
      • items UsageResourceResult
    • TopResources
      • items UsageResourceResult

GuardDutyArn

• GuardDutyArn string

IamInstanceProfile

• IamInstanceProfile object: Contains information about the EC2 instance profile.
  • Arn
  • Id

InstanceDetails

• InstanceDetails object: Contains information about the details of an instance.
  • AvailabilityZone
  • IamInstanceProfile
    • Arn
    • Id
  • ImageDescription
  • ImageId
  • InstanceId
  • InstanceState
  • InstanceType
  • LaunchTime
  • NetworkInterfaces
    • items NetworkInterface
  • OutpostArn
  • Platform
  • ProductCodes
    • items ProductCode
  • Tags
    • items Tag

Integer

• Integer integer

InternalServerErrorException

Invitation

• Invitation object: Contains information about the invitation to become a member account.
  • AccountId
  • InvitationId
  • InvitedAt
  • RelationshipStatus

Invitations

• Invitations array
  • items Invitation

InviteMembersRequest

• InviteMembersRequest object
  • AccountIds required
    • items AccountId
  • DisableEmailNotification
  • Message

InviteMembersResponse

• InviteMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

IpSetFormat

• IpSetFormat string (values: TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)

IpSetIds

• IpSetIds array
  • items String

IpSetStatus

• IpSetStatus string (values: INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)

Ipv6Addresses

• Ipv6Addresses array
  • items String

ListDetectorsRequest

• ListDetectorsRequest object

ListDetectorsResponse

• ListDetectorsResponse object
  • DetectorIds required
    • items DetectorId
  • NextToken

ListFiltersRequest

• ListFiltersRequest object

ListFiltersResponse

• ListFiltersResponse object
  • FilterNames required
    • items FilterName
  • NextToken

ListFindingsRequest

• ListFindingsRequest object
  • FindingCriteria
    • Criterion
  • MaxResults
  • NextToken
  • SortCriteria
    • AttributeName
    • OrderBy

ListFindingsResponse

• ListFindingsResponse object
  • FindingIds required
    • items FindingId
  • NextToken

ListIPSetsRequest

• ListIPSetsRequest object

ListIPSetsResponse

• ListIPSetsResponse object
  • IpSetIds required
    • items String
  • NextToken

ListInvitationsRequest

• ListInvitationsRequest object

ListInvitationsResponse

• ListInvitationsResponse object
  • Invitations
    • items Invitation
  • NextToken

ListMembersRequest

• ListMembersRequest object

ListMembersResponse

• ListMembersResponse object
  • Members
    • items Member
  • NextToken

ListOrganizationAdminAccountsRequest

• ListOrganizationAdminAccountsRequest object

ListOrganizationAdminAccountsResponse

• ListOrganizationAdminAccountsResponse object
  • AdminAccounts
    • items AdminAccount
  • NextToken

ListPublishingDestinationsRequest

• ListPublishingDestinationsRequest object

ListPublishingDestinationsResponse

• ListPublishingDestinationsResponse object
  • Destinations required
    • items Destination
  • NextToken

ListTagsForResourceRequest

• ListTagsForResourceRequest object

ListTagsForResourceResponse

• ListTagsForResourceResponse object
  • Tags

ListThreatIntelSetsRequest

• ListThreatIntelSetsRequest object

ListThreatIntelSetsResponse

• ListThreatIntelSetsResponse object
  • NextToken
  • ThreatIntelSetIds required
    • items String

LocalIpDetails

• LocalIpDetails object: Contains information about the local IP address of the connection.
  • IpAddressV4

LocalPortDetails

• LocalPortDetails object: Contains information about the port for the local connection.
  • Port
  • PortName

Location

• Location string

Long

• Long integer

Master

• Master object: Contains information about the administrator account and invitation.
  • AccountId
  • InvitationId
  • InvitedAt
  • RelationshipStatus

MaxResults

• MaxResults integer

Member

• Member object: Contains information about the member account.
  • AccountId required
  • DetectorId
  • Email required
  • InvitedAt
  • MasterId required
  • RelationshipStatus required
  • UpdatedAt required

MemberDataSourceConfiguration

• MemberDataSourceConfiguration object: Contains information on which data sources are enabled for a member account.
  • AccountId required
  • DataSources required
    • CloudTrail required
      • Status required
    • DNSLogs required
      • Status required
    • FlowLogs required
      • Status required
    • S3Logs required
      • Status required

MemberDataSourceConfigurations

• MemberDataSourceConfigurations array
  • items MemberDataSourceConfiguration

Members

• Members array
  • items Member

Name

• Name string

Neq

• Neq array
  • items String

NetworkConnectionAction

• NetworkConnectionAction object: Contains information about the NETWORK_CONNECTION action described in the finding.
  • Blocked
  • ConnectionDirection
  • LocalIpDetails
    • IpAddressV4
  • LocalPortDetails
    • Port
    • PortName
  • Protocol
  • RemoteIpDetails
    • City
      • CityName
    • Country
      • CountryCode
      • CountryName
    • GeoLocation
      • Lat
      • Lon
    • IpAddressV4
    • Organization
      • Asn
      • AsnOrg
      • Isp
      • Org
  • RemotePortDetails
    • Port
    • PortName

NetworkInterface

• NetworkInterface object: Contains information about the elastic network interface of the EC2 instance.
  • Ipv6Addresses
    • items String
  • NetworkInterfaceId
  • PrivateDnsName
  • PrivateIpAddress
  • PrivateIpAddresses
    • items PrivateIpAddressDetails
  • PublicDnsName
  • PublicIp
  • SecurityGroups
    • items SecurityGroup
  • SubnetId
  • VpcId

NetworkInterfaces

• NetworkInterfaces array
  • items NetworkInterface

NotEquals

• NotEquals array
  • items String

OrderBy

• OrderBy string (values: ASC, DESC)

Organization

• Organization object: Contains information about the ISP organization of the remote IP address.
  • Asn
  • AsnOrg
  • Isp
  • Org

OrganizationDataSourceConfigurations

• OrganizationDataSourceConfigurations object: An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.
  • S3Logs
    • AutoEnable required

OrganizationDataSourceConfigurationsResult

• OrganizationDataSourceConfigurationsResult object: An object that contains information on which data sources are automatically enabled for new members within the organization.
  • S3Logs required
    • AutoEnable required

OrganizationS3LogsConfiguration

• OrganizationS3LogsConfiguration object: Describes whether S3 data event logs will be automatically enabled for new members of the organization.
  • AutoEnable required

OrganizationS3LogsConfigurationResult

• OrganizationS3LogsConfigurationResult object: The current configuration of S3 data event logs as a data source for the organization.
  • AutoEnable required

Owner

• Owner object: Contains information on the owner of the bucket.
  • Id

PermissionConfiguration

• PermissionConfiguration object: Contains information about how permissions are configured for the S3 bucket.
  • AccountLevelPermissions
    • BlockPublicAccess
      • BlockPublicAcls
      • BlockPublicPolicy
      • IgnorePublicAcls
      • RestrictPublicBuckets
  • BucketLevelPermissions
    • AccessControlList
      • AllowsPublicReadAccess
      • AllowsPublicWriteAccess
    • BlockPublicAccess
      • BlockPublicAcls
      • BlockPublicPolicy
      • IgnorePublicAcls
      • RestrictPublicBuckets
    • BucketPolicy
      • AllowsPublicReadAccess
      • AllowsPublicWriteAccess

PortProbeAction

• PortProbeAction object: Contains information about the PORT_PROBE action described in the finding.
  • Blocked
  • PortProbeDetails
    • items PortProbeDetail

PortProbeDetail

• PortProbeDetail object: Contains information about the port probe details.
  • LocalIpDetails
    • IpAddressV4
  • LocalPortDetails
    • Port
    • PortName
  • RemoteIpDetails
    • City
      • CityName
    • Country
      • CountryCode
      • CountryName
    • GeoLocation
      • Lat
      • Lon
    • IpAddressV4
    • Organization
      • Asn
      • AsnOrg
      • Isp
      • Org

PortProbeDetails

• PortProbeDetails array
  • items PortProbeDetail

PrivateIpAddressDetails

• PrivateIpAddressDetails object: Contains other private IP address information of the EC2 instance.
  • PrivateDnsName
  • PrivateIpAddress

PrivateIpAddresses

• PrivateIpAddresses array
  • items PrivateIpAddressDetails

ProductCode

• ProductCode object: Contains information about the product code for the EC2 instance.
  • Code
  • ProductType

ProductCodes

• ProductCodes array
  • items ProductCode

PublicAccess

• PublicAccess object: Describes the public access policies that apply to the S3 bucket.
  • EffectivePermission
  • PermissionConfiguration
    • AccountLevelPermissions
      • BlockPublicAccess
        • BlockPublicAcls
        • BlockPublicPolicy
        • IgnorePublicAcls
        • RestrictPublicBuckets
    • BucketLevelPermissions
      • AccessControlList
        • AllowsPublicReadAccess
        • AllowsPublicWriteAccess
      • BlockPublicAccess
        • BlockPublicAcls
        • BlockPublicPolicy
        • IgnorePublicAcls
        • RestrictPublicBuckets
      • BucketPolicy
        • AllowsPublicReadAccess
        • AllowsPublicWriteAccess

PublishingStatus

• PublishingStatus string (values: PENDING_VERIFICATION, PUBLISHING, UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY, STOPPED)

RemoteIpDetails

• RemoteIpDetails object: Contains information about the remote IP address of the connection.
  • City
    • CityName
  • Country
    • CountryCode
    • CountryName
  • GeoLocation
    • Lat
    • Lon
  • IpAddressV4
  • Organization
    • Asn
    • AsnOrg
    • Isp
    • Org

RemotePortDetails

• RemotePortDetails object: Contains information about the remote port.
  • Port
  • PortName

Resource

• Resource object: Contains information about the AWS resource associated with the activity that prompted GuardDuty to generate a finding.
  • AccessKeyDetails
    • AccessKeyId
    • PrincipalId
    • UserName
    • UserType
  • InstanceDetails
    • AvailabilityZone
    • IamInstanceProfile
      • Arn
      • Id
    • ImageDescription
    • ImageId
    • InstanceId
    • InstanceState
    • InstanceType
    • LaunchTime
    • NetworkInterfaces
      • items NetworkInterface
    • OutpostArn
    • Platform
    • ProductCodes
      • items ProductCode
    • Tags
      • items Tag
  • ResourceType
  • S3BucketDetails
    • items S3BucketDetail

ResourceList

• ResourceList array
  • items String

S3BucketDetail

• S3BucketDetail object: Contains information on the S3 bucket.
  • Arn
  • CreatedAt
  • DefaultServerSideEncryption
    • EncryptionType
    • KmsMasterKeyArn
  • Name
  • Owner
    • Id
  • PublicAccess
    • EffectivePermission
    • PermissionConfiguration
      • AccountLevelPermissions
        • BlockPublicAccess
          • BlockPublicAcls
          • BlockPublicPolicy
          • IgnorePublicAcls
          • RestrictPublicBuckets
      • BucketLevelPermissions
        • AccessControlList
          • AllowsPublicReadAccess
          • AllowsPublicWriteAccess
        • BlockPublicAccess
          • BlockPublicAcls
          • BlockPublicPolicy
          • IgnorePublicAcls
          • RestrictPublicBuckets
        • BucketPolicy
          • AllowsPublicReadAccess
          • AllowsPublicWriteAccess
  • Tags
    • items Tag
  • Type

S3BucketDetails

• S3BucketDetails array
  • items S3BucketDetail

S3LogsConfiguration

• S3LogsConfiguration object: Describes whether S3 data event logs will be enabled as a data source.
  • Enable required

S3LogsConfigurationResult

• S3LogsConfigurationResult object: Describes whether S3 data event logs will be enabled as a data source.
  • Status required

SecurityGroup

• SecurityGroup object: Contains information about the security groups associated with the EC2 instance.
  • GroupId
  • GroupName

SecurityGroups

• SecurityGroups array
  • items SecurityGroup

Service

• Service object: Contains additional information about the generated finding.
  • Action
    • ActionType
    • AwsApiCallAction
      • Api
      • CallerType
      • DomainDetails
        • Domain
      • ErrorCode
      • RemoteIpDetails
        • City
          • CityName
        • Country
          • CountryCode
          • CountryName
        • GeoLocation
          • Lat
          • Lon
        • IpAddressV4
        • Organization
          • Asn
          • AsnOrg
          • Isp
          • Org
      • ServiceName
    • DnsRequestAction
      • Domain
    • NetworkConnectionAction
      • Blocked
      • ConnectionDirection
      • LocalIpDetails
        • IpAddressV4
      • LocalPortDetails
        • Port
        • PortName
      • Protocol
      • RemoteIpDetails
        • City
          • CityName
        • Country
          • CountryCode
          • CountryName
        • GeoLocation
          • Lat
          • Lon
        • IpAddressV4
        • Organization
          • Asn
          • AsnOrg
          • Isp
          • Org
      • RemotePortDetails
        • Port
        • PortName
    • PortProbeAction
      • Blocked
      • PortProbeDetails
        • items PortProbeDetail
  • Archived
  • Count
  • DetectorId
  • EventFirstSeen
  • EventLastSeen
  • Evidence
    • ThreatIntelligenceDetails
      • items ThreatIntelligenceDetail
  • ResourceRole
  • ServiceName
  • UserFeedback

SortCriteria

• SortCriteria object: Contains information about the criteria used for sorting findings.
  • AttributeName
  • OrderBy

StartMonitoringMembersRequest

• StartMonitoringMembersRequest object
  • AccountIds required
    • items AccountId

StartMonitoringMembersResponse

• StartMonitoringMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

StopMonitoringMembersRequest

• StopMonitoringMembersRequest object
  • AccountIds required
    • items AccountId

StopMonitoringMembersResponse

• StopMonitoringMembersResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

String

• String string

Tag

• Tag object: Contains information about a tag associated with the EC2 instance.
  • Key
  • Value

TagKey

• TagKey string

TagKeyList

• TagKeyList array
  • items TagKey

TagMap

• TagMap object

TagResourceRequest

• TagResourceRequest object
  • Tags required

TagResourceResponse

• TagResourceResponse object

TagValue

• TagValue string

Tags

• Tags array
  • items Tag

ThreatIntelSetFormat

• ThreatIntelSetFormat string (values: TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)

ThreatIntelSetIds

• ThreatIntelSetIds array
  • items String

ThreatIntelSetStatus

• ThreatIntelSetStatus string (values: INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)

ThreatIntelligenceDetail

• ThreatIntelligenceDetail object: An instance of a threat intelligence detail that constitutes evidence for the finding.
  • ThreatListName
  • ThreatNames
    • items String

ThreatIntelligenceDetails

• ThreatIntelligenceDetails array
  • items ThreatIntelligenceDetail

ThreatNames

• ThreatNames array
  • items String

Timestamp

• Timestamp string

Total

• Total object: Contains the total usage with the corresponding currency unit for that value.
  • Amount
  • Unit

UnarchiveFindingsRequest

• UnarchiveFindingsRequest object
  • FindingIds required
    • items FindingId

UnarchiveFindingsResponse

• UnarchiveFindingsResponse object

UnprocessedAccount

• UnprocessedAccount object: Contains information about the accounts that weren't processed.
  • AccountId required
  • Result required

UnprocessedAccounts

• UnprocessedAccounts array
  • items UnprocessedAccount

UntagResourceRequest

• UntagResourceRequest object

UntagResourceResponse

• UntagResourceResponse object

UpdateDetectorRequest

• UpdateDetectorRequest object
  • DataSources
    • S3Logs
      • Enable required
  • Enable
  • FindingPublishingFrequency

UpdateDetectorResponse

• UpdateDetectorResponse object

UpdateFilterRequest

• UpdateFilterRequest object
  • Action
  • Description
  • FindingCriteria
    • Criterion
  • Rank

UpdateFilterResponse

• UpdateFilterResponse object
  • Name required

UpdateFindingsFeedbackRequest

• UpdateFindingsFeedbackRequest object
  • Comments
  • Feedback required
  • FindingIds required
    • items FindingId

UpdateFindingsFeedbackResponse

• UpdateFindingsFeedbackResponse object

UpdateIPSetRequest

• UpdateIPSetRequest object
  • Activate
  • Location
  • Name

UpdateIPSetResponse

• UpdateIPSetResponse object

UpdateMemberDetectorsRequest

• UpdateMemberDetectorsRequest object
  • AccountIds required
    • items AccountId
  • DataSources
    • S3Logs
      • Enable required

UpdateMemberDetectorsResponse

• UpdateMemberDetectorsResponse object
  • UnprocessedAccounts required
    • items UnprocessedAccount

UpdateOrganizationConfigurationRequest

• UpdateOrganizationConfigurationRequest object
  • AutoEnable required
  • DataSources
    • S3Logs
      • AutoEnable required

UpdateOrganizationConfigurationResponse

• UpdateOrganizationConfigurationResponse object

UpdatePublishingDestinationRequest

• UpdatePublishingDestinationRequest object
  • DestinationProperties
    • DestinationArn
    • KmsKeyArn

UpdatePublishingDestinationResponse

• UpdatePublishingDestinationResponse object

UpdateThreatIntelSetRequest

• UpdateThreatIntelSetRequest object
  • Activate
  • Location
  • Name

UpdateThreatIntelSetResponse

• UpdateThreatIntelSetResponse object

UsageAccountResult

• UsageAccountResult object: Contains information on the total of usage based on account IDs.
  • AccountId
  • Total
    • Amount
    • Unit

UsageAccountResultList

• UsageAccountResultList array
  • items UsageAccountResult

UsageCriteria

• UsageCriteria object: Contains information about the criteria used to query usage statistics.
  • AccountIds
    • items AccountId
  • DataSources required
    • items DataSource
  • Resources
    • items String

UsageDataSourceResult

• UsageDataSourceResult object: Contains information on the result of usage based on data source type.
  • DataSource
  • Total
    • Amount
    • Unit

UsageDataSourceResultList

• UsageDataSourceResultList array
  • items UsageDataSourceResult

UsageResourceResult

• UsageResourceResult object: Contains information on the sum of usage based on an AWS resource.
  • Resource
  • Total
    • Amount
    • Unit

UsageResourceResultList

• UsageResourceResultList array
  • items UsageResourceResult

UsageStatisticType

• UsageStatisticType string (values: SUM_BY_ACCOUNT, SUM_BY_DATA_SOURCE, SUM_BY_RESOURCE, TOP_RESOURCES)

UsageStatistics

• UsageStatistics object: Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.
  • SumByAccount
    • items UsageAccountResult
  • SumByDataSource
    • items UsageDataSourceResult
  • SumByResource
    • items UsageResourceResult
  • TopResources
    • items UsageResourceResult