Amazon AWS GuardDuty

The Amazon AWS GuardDuty connector allows users to manage and automate responses to the threat detection findings directly within the Swimlane Turbine platform.

Amazon AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. With the Swimlane Turbine AWS GuardDuty connector, users can automate the management of GuardDuty detectors, IP sets, and threat intel sets. This integration empowers security teams to streamline threat detection, enhance visibility, and respond efficiently to potential security threats. By automating actions such as archiving findings, creating detectors, and updating threat intelligence, Swimlane Turbine users can maintain a robust security posture with minimal manual intervention.

Prerequisites

To utilize the Amazon AWS GuardDuty connector within Swimlane Turbine, ensure you have the following:

AWS credentials for authentication with the following parameters:

Access Key: Your AWS access key ID.

Secret Key: Your AWS secret access key.

Region Name: The AWS region where your GuardDuty instance is deployed.

Asset Setup

This integration authenticates with AWS GuardDuty Connector using the following input values:

AWS Access Key ID: A long-term AWS access key ID with access to Security Hub.

AWS Secret Key ID: A long-term secret access key associated with the above AccessKey ID.

Region Name: The AWS region.

Role ARN: An ARN of an AWS IAM Role to assume.

Capabilities

This connector provides the following capabilities:

Archieve Findings

Create Detector

Create IP Set

Create Threat Intel Set

Delete Detector

Delete IP Set

Delete Threat Intel Set

Get all Findings

Get Detector

Get Findings

Get IP Set

Get Threat Intel Set

List Detectors

List Findings

List IP Sets ... and so on

Obtaining AWS Credentials

To use this integration, you will need to have an AWS account and obtain the necessary AWS credentials. You can obtain these credentials by following the steps below:

In the left navigation pane, click on the Users tab and select the user for which you want to create credentials.

Attach policy AmazonGuardDutyFullAccess to the user.

Click on the Security credentials tab, and then click on the Create access key.

Make sure to save the access key ID and secret access key in a secure location, as you will not be able to see the secret access key again after this step.

Notes

AWS Account and Access Keys

Boto3 AWS GuardDuty Documentation

For more information about AWS GuardDuty, Click here!

Configurations

AWS GuardDuty Authentication

Authenticates using AWS credentials

Configuration Parameters

Parameter	Description	Type	Required
access_key	AWS Access Key.	string	Required
secret_key	AWS Secret Key.	string	Required
region_name	The AWS Region where you want to create new connections.	string	Required
role_arn	Optional Role ARN to assume. Leave blank unless tasks need to assume a different role.	string	Optional
external_id	External ID to assume IAM Role. Optional value used for assuming roles. Can be added, or removed in Trusted Relationships of target role.	string	Optional
session_token	Use if a session token is provided when switching roles	string	Optional
role_session_name	Defaults to SessionFromSwimlane_<HASH> when no value is provide	string	Optional

Actions

Archive Findings

Archives specified Amazon AWS GuardDuty findings using a DetectorId and list of FindingIds. Available to administrator accounts.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The ID of the detector that specifies the GuardDuty service whose findings you want to archieve.
FindingIds	array	Required	The IDs of the findings that you want to archieve.

Input Example

{"DetectorId":"string","FindingIds":["string"]}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Create Detector

Creates a new Amazon AWS GuardDuty detector to initiate the service with an 'Enable' parameter.

Input

Argument Name	Type	Required	Description
Enable	boolean	Required	A Boolean value that specifies whether the detector is to be enabled.
ClientToken	string	Optional	The idempotency token for the create request. This field is autopopulated if not provided.
FindingPublishingFrequency	string	Optional	A value that specifies how frequently updated findings are exported.
DataSources	object	Optional	Describes which data sources will be enabled for the detector.
DataSources.S3Logs	object	Optional	Describes whether S3 data event logs are enabled as a data source.
DataSources.S3Logs.Enable	boolean	Required	The status of S3 data event logs as a data source.
DataSources.Kubernetes	object	Optional	Describes whether any Kubernetes logs are enabled as data sources.
DataSources.Kubernetes.AuditLogs	object	Required	The status of Kubernetes audit logs as a data source.
DataSources.Kubernetes.AuditLogs.Enable	boolean	Required	The status of Kubernetes audit logs as a data source.
DataSources.MalwareProtection	object	Optional	Describes whether Malware Protection is enabled as a data source.
DataSources.MalwareProtection.ScanEc2InstanceWithFindings	object	Optional	Describes the configuration of Malware Protection for EC2 instances with findings.
DataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes	boolean	Optional	Describes the configuration for scanning EBS volumes as data source.
Tags	object	Optional	The tags to be added to a new detector resource.
Tags.string	string	Optional	Parameter for Create Detector
Features	array	Optional	A list of features that will be configured for the detector.
Features.Name	string	Optional	The name of the feature.
Features.Status	string	Optional	The status of the feature.
Features.AdditionalConfiguration	array	Optional	Additional configuration for a resource.
Features.AdditionalConfiguration.Name	string	Optional	Name of the additional configuration.
Features.AdditionalConfiguration.Status	string	Optional	Status of the additional configuration.

Input Example

{"Enable":true,"FindingPublishingFrequency":"FIFTEEN_MINUTES","DataSources":{"S3Logs":{"Enable":true},"Kubernetes":{"AuditLogs":{"Enable":true}},"MalwareProtection":{"ScanEc2InstanceWithFindings":{"EbsVolumes":true}}},"Tags":{"string":"string"},"Features":[{"Name":"S3_DATA_EVENTS","Status":"ENABLED","AdditionalConfiguration":[{"Name":"EKS_ADDON_MANAGEMENT","Status":"ENABLED"}]}]}

Output

Parameter	Type	Description
DetectorId	string	Unique identifier
UnprocessedDataSources	object	Response data
UnprocessedDataSources.MalwareProtection	object	Response data
UnprocessedDataSources.MalwareProtection.ScanEc2InstanceWithFindings	object	Response data
UnprocessedDataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes	object	Response data
UnprocessedDataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes.Status	string	Response data
UnprocessedDataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes.Reason	string	Response data
UnprocessedDataSources.MalwareProtection.ServiceRole	string	Response data

Output Example

{"DetectorId":"string","UnprocessedDataSources":{"MalwareProtection":{"ScanEc2InstanceWithFindings":{},"ServiceRole":"string"}}}

Create IP Set

Creates a new IP set in Amazon AWS GuardDuty to whitelist trusted IPs, requiring DetectorId, Name, Format, Location, and Activate status.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector of the GuardDuty account that you want to create an IP Set for.
Name	string	Required	The user-friendly name to identify the IP Set. Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_).
Format	string	Required	The format of the file that contains the IP Set.
Location	string	Required	The URI of the file that contains the IP Set.
Activate	boolean	Required	A Boolean value that indicates whether GuardDuty is to start using the uploaded IP Set.
ClientToken	string	Optional	The idempotency token for the create request. This field is autopopulated if not provided.
Tags	object	Optional	The tags to be added to a new IP set resource.
Tags.string	string	Optional	Parameter for Create IP Set

Input Example

{"Format":"TXT","Activate":true,"Tags":{"string":"string"}}

Output

Parameter	Type	Description
IpSetId	string	Unique identifier

Output Example

{"IpSetId":"string"}

Create Threat Intel Set

Creates a new Threat Intel Set in Amazon AWS GuardDuty using provided DetectorId, Name, Format, Location, and activation status.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.
Name	string	Required	A user-friendly Threat Intel Set name displayed in all findings that are generated by activity that involves IP addresses included in this Threat Intel Set.
Format	string	Required	The format of the file that contains the Threat Intel Set.
Location	string	Required	The URI of the file that contains the Threat Intel Set.
Activate	boolean	Required	A Boolean value that indicates whether GuardDuty is to start using the uploaded Threat Intel Set.
ClientToken	string	Optional	The idempotency token for the create request. This field is autopopulated if not provided.
Tags	object	Optional	The tags to be added to a new threat list resource.
Tags.string	string	Optional	Parameter for Create Threat Intel Set

Input Example

{"Format":"TXT","Activate":true,"Tags":{"string":"string"}}

Output

Parameter	Type	Description
ThreatIntelSetId	string	Unique identifier

Output Example

{"ThreatIntelSetId":"string"}

Delete Detector

Removes a specified Amazon AWS GuardDuty detector using the provided DetectorId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that you want to delete.

Input Example

{"DetectorId":"string"}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Delete IP Set

Removes a specified IP set from Amazon AWS GuardDuty using the provided DetectorId and IpSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector associated with the IP Set.
IpSetId	string	Required	The unique ID of the IP Set to delete.

Input Example

{"DetectorId":"string","IpSetId":"string"}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Delete Threat Intel Set

Removes a specified Threat Intel Set from Amazon AWS GuardDuty using the DetectorId and ThreatIntelSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that the Threat Intel Set is associated with.
ThreatIntelSetId	string	Required	The unique ID of the Threat Intel Set that you want to delete.

Input Example

{"DetectorId":"string","ThreatIntelSetId":"string"}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Get All Findings

Retrieve all detected security threats from Amazon AWS GuardDuty for a comprehensive overview.

Input

Argument Name	Type	Required	Description
FindingCriteria	object	Optional	Represents the criteria used for querying findings.
FindingCriteria.Criterion	object	Optional	Represents a map of finding properties that match specified conditions and values when querying findings.
FindingCriteria.Criterion.string	object	Optional	Parameter for Get All Findings
FindingCriteria.Criterion.string.Eq	array	Optional	Represents the equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Neq	array	Optional	Represents the not equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Gt	number	Optional	Represents a greater than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Gte	number	Optional	Represents a greater than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Lt	number	Optional	Represents a less than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Lte	number	Optional	Represents a less than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Equals	array	Optional	Represents an equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.NotEquals	array	Optional	Represents a not equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.GreaterThan	number	Optional	Represents a greater than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.GreaterThanOrEqual	number	Optional	Represents a greater than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.LessThan	number	Optional	Represents a less than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.LessThanOrEqual	number	Optional	Represents a less than or equal condition to be applied to a single field when querying for findings.
SortCriteria	object	Optional	Represents the criteria used for sorting findings.
SortCriteria.AttributeName	string	Optional	Represents the finding attribute, such as accountId, that sorts the findings.
SortCriteria.OrderBy	string	Optional	The order by which the sorted findings are to be displayed.
PaginationConfig	object	Optional	A dictionary that provides parameters to control pagination.
PaginationConfig.MaxItems	number	Optional	The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
PaginationConfig.PageSize	number	Optional	The size of each page.
PaginationConfig.StartingToken	string	Optional	A token to specify where to start paginating. This is the NextToken from a previous response.

Input Example

{"FindingCriteria":{"Criterion":{"string":{"Eq":["string"],"Neq":["string"],"Gt":123,"Gte":123,"Lt":123,"Lte":123,"Equals":["string"],"NotEquals":["string"],"GreaterThan":123,"GreaterThanOrEqual":123,"LessThan":123,"LessThanOrEqual":123}}},"SortCriteria":{"AttributeName":"string","OrderBy":"ASC"},"PaginationConfig":{"MaxItems":123,"PageSize":123,"StartingToken":"string"}}

Output

Parameter	Type	Description
findings	object	Output field: findings

Output Example

{"findings":{}}

Get Detector

Retrieves details of a specified Amazon AWS GuardDuty detector using the provided DetectorId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that you want to get.

Input Example

{"DetectorId":"string"}

Output

Parameter	Type	Description
CreatedAt	string	Output field: CreatedAt
FindingPublishingFrequency	string	Output field: FindingPublishingFrequency
ServiceRole	string	Output field: ServiceRole
Status	string	Status value
UpdatedAt	string	Output field: UpdatedAt
DataSources	object	Response data
DataSources.CloudTrail	object	Response data
DataSources.CloudTrail.Status	string	Response data
DataSources.DNSLogs	object	Response data
DataSources.DNSLogs.Status	string	Response data
DataSources.FlowLogs	object	Response data
DataSources.FlowLogs.Status	string	Response data
DataSources.S3Logs	object	Response data
DataSources.S3Logs.Status	string	Response data
DataSources.Kubernetes	object	Response data
DataSources.Kubernetes.AuditLogs	object	Response data
DataSources.Kubernetes.AuditLogs.Status	string	Response data
DataSources.MalwareProtection	object	Response data
DataSources.MalwareProtection.ScanEc2InstanceWithFindings	object	Response data
DataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes	object	Response data
DataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes.Status	string	Response data
DataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes.Reason	string	Response data
DataSources.MalwareProtection.ServiceRole	string	Response data
Tags	object	Output field: Tags
Tags.string	string	Output field: Tags.string

Output Example

{"CreatedAt":"string","FindingPublishingFrequency":"FIFTEEN_MINUTES","ServiceRole":"string","Status":"ENABLED","UpdatedAt":"string","DataSources":{"CloudTrail":{"Status":"ENABLED"},"DNSLogs":{"Status":"ENABLED"},"FlowLogs":{"Status":"ENABLED"},"S3Logs":{"Status":"ENABLED"},"Kubernetes":{"AuditLogs":{}},"MalwareProtection":{"ScanEc2InstanceWithFindings":{},"ServiceRole":"string"}},"Tags":{"string":"string"},"Features":[{"Name":"FLOW_LOGS","Status":"ENABLED","UpdatedAt":"datetime(2015, 1, 1)","Add...

Get Findings

Retrieves detailed information for specified findings in Amazon AWS GuardDuty using DetectorId and FindingIds.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
FindingIds	array	Required	The IDs of the findings that you want to retrieve.
SortCriteria	object	Optional	Represents the criteria used for sorting findings.
SortCriteria.AttributeName	string	Optional	Represents the finding attribute, such as accountID, that sorts the findings.
SortCriteria.OrderBy	string	Optional	The order by which the sorted findings are to be displayed.

Input Example

{"SortCriteria":{"AttributeName":"string","OrderBy":"ASC"}}

Output

Parameter	Type	Description
Findings	array	Output field: Findings
Findings.AccountId	string	Unique identifier
Findings.Arn	string	Output field: Findings.Arn
Findings.Confidence	number	Unique identifier
Findings.CreatedAt	string	Output field: Findings.CreatedAt
Findings.Description	string	Output field: Findings.Description
Findings.Id	string	Unique identifier
Findings.Partition	string	Output field: Findings.Partition
Findings.Region	string	Output field: Findings.Region
Findings.Resource	object	Output field: Findings.Resource
Findings.Resource.AccessKeyDetails	object	Output field: Findings.Resource.AccessKeyDetails
Findings.Resource.AccessKeyDetails.AccessKeyId	string	Unique identifier
Findings.Resource.AccessKeyDetails.PrincipalId	string	Unique identifier
Findings.Resource.AccessKeyDetails.UserName	string	Name of the resource
Findings.Resource.AccessKeyDetails.UserType	string	Type of the resource
Findings.Resource.S3BucketDetails	array	Output field: Findings.Resource.S3BucketDetails
Findings.Resource.S3BucketDetails.Arn	string	Output field: Findings.Resource.S3BucketDetails.Arn
Findings.Resource.S3BucketDetails.Name	string	Name of the resource
Findings.Resource.S3BucketDetails.Type	string	Type of the resource
Findings.Resource.S3BucketDetails.CreatedAt	string	Output field: Findings.Resource.S3BucketDetails.CreatedAt
Findings.Resource.S3BucketDetails.Owner	object	Output field: Findings.Resource.S3BucketDetails.Owner
Findings.Resource.S3BucketDetails.Owner.Id	string	Unique identifier
Findings.Resource.S3BucketDetails.Tags	array	Output field: Findings.Resource.S3BucketDetails.Tags
Findings.Resource.S3BucketDetails.Tags.Key	string	Output field: Findings.Resource.S3BucketDetails.Tags.Key
Findings.Resource.S3BucketDetails.Tags.Value	string	Value for the parameter

Output Example

{"Findings":[]}

Get IP Set

Retrieves a specified IP set in Amazon AWS GuardDuty using the provided DetectorId and IpSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that the IP Set is associated with.
IpSetId	string	Required	The unique ID of the IP Set to retrieve.

Input Example

{"DetectorId":"string","IpSetId":"string"}

Output

Parameter	Type	Description
Name	string	Name of the resource
Format	string	Output field: Format
Location	string	Output field: Location
Status	string	Status value
Tags	object	Output field: Tags
Tags.string	string	Output field: Tags.string

Output Example

{"Name":"string","Format":"TXT","Location":"string","Status":"INACTIVE","Tags":{"string":"string"}}

Get Threat Intel Set

Retrieves a specified Threat Intel Set from Amazon AWS GuardDuty using DetectorId and ThreatIntelSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that the Threat Intel Set is associated with.
ThreatIntelSetId	string	Required	The unique ID of the Threat Intel Set that you want to get.

Input Example

{"DetectorId":"string","ThreatIntelSetId":"string"}

Output

Parameter	Type	Description
Name	string	Name of the resource
Format	string	Output field: Format
Location	string	Output field: Location
Status	string	Status value
Tags	object	Output field: Tags
Tags.string	string	Output field: Tags.string

Output Example

{"Name":"string","Format":"TXT","Location":"string","Status":"INACTIVE","Tags":{"string":"string"}}

List Detectors

Retrieve a list of detector IDs from Amazon AWS GuardDuty, enabling identification and management of existing resources.

Input

Argument Name	Type	Required	Description
PaginationConfig	object	Optional	A dictionary that provides parameters to control pagination.
PaginationConfig.MaxItems	number	Optional	The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
PaginationConfig.PageSize	number	Optional	The size of each page.
PaginationConfig.StartingToken	string	Optional	A token to specify where to start paginating. This is the NextToken from a previous response.

Input Example

{"PaginationConfig":{"MaxItems":123,"PageSize":123,"StartingToken":"string"}}

Output

Parameter	Type	Description
response	array	Output field: response
response.ResponseMetadata	object	Response data
response.ResponseMetadata.RequestId	string	Response data
response.ResponseMetadata.HTTPStatusCode	number	Response data
response.ResponseMetadata.HTTPHeaders	object	Response data
response.ResponseMetadata.HTTPHeaders.date	string	Response data
response.ResponseMetadata.HTTPHeaders.content-type	string	Response data
response.ResponseMetadata.HTTPHeaders.content-length	string	Response data
response.ResponseMetadata.HTTPHeaders.connection	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-requestid	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-origin	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amz-apigw-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-expose-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-trace-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-max-age	string	Response data
response.ResponseMetadata.RetryAttempts	number	Response data
response.DetectorIds	array	Unique identifier

Output Example

{"response":[{"ResponseMetadata":{},"DetectorIds":[]}]}

List Findings

Retrieve a summary of potential security threats by listing Amazon AWS GuardDuty findings for a specified DetectorId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The ID of the detector that specifies the GuardDuty service whose findings you want to list.
FindingCriteria	object	Optional	Represents the criteria used for querying findings.
FindingCriteria.Criterion	object	Optional	Represents a map of finding properties that match specified conditions and values when querying findings.
FindingCriteria.Criterion.string	object	Optional	Parameter for List Findings
FindingCriteria.Criterion.string.Eq	array	Optional	Represents the equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Neq	array	Optional	Represents the not equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Gt	number	Optional	Represents a greater than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Gte	number	Optional	Represents a greater than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Lt	number	Optional	Represents a less than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Lte	number	Optional	Represents a less than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.Equals	array	Optional	Represents an equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.NotEquals	array	Optional	Represents a not equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.GreaterThan	number	Optional	Represents a greater than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.GreaterThanOrEqual	number	Optional	Represents a greater than or equal condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.LessThan	number	Optional	Represents a less than condition to be applied to a single field when querying for findings.
FindingCriteria.Criterion.string.LessThanOrEqual	number	Optional	Represents a less than or equal condition to be applied to a single field when querying for findings.
SortCriteria	object	Optional	Represents the criteria used for sorting findings.
SortCriteria.AttributeName	string	Optional	Represents the finding attribute, such as account ID, that sorts the findings.
SortCriteria.OrderBy	string	Optional	The order by which the sorted findings are to be displayed.
PaginationConfig	object	Optional	A dictionary that provides parameters to control pagination.
PaginationConfig.MaxItems	number	Optional	The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
PaginationConfig.PageSize	number	Optional	The size of each page.
PaginationConfig.StartingToken	string	Optional	A token to specify where to start paginating. This is the NextToken from a previous response.

Input Example

Output

Parameter	Type	Description
response	array	Output field: response
response.ResponseMetadata	object	Response data
response.ResponseMetadata.RequestId	string	Response data
response.ResponseMetadata.HTTPStatusCode	number	Response data
response.ResponseMetadata.HTTPHeaders	object	Response data
response.ResponseMetadata.HTTPHeaders.date	string	Response data
response.ResponseMetadata.HTTPHeaders.content-type	string	Response data
response.ResponseMetadata.HTTPHeaders.content-length	string	Response data
response.ResponseMetadata.HTTPHeaders.connection	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-requestid	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-origin	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amz-apigw-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-expose-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-trace-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-max-age	string	Response data
response.ResponseMetadata.RetryAttempts	number	Response data
response.FindingIds	array	Unique identifier
response.NextToken	string	Output field: response.NextToken

Output Example

{"response":[{"ResponseMetadata":{},"FindingIds":[],"NextToken":""}]}

List IP Sets

Retrieves a list of IP sets for a specified Amazon AWS GuardDuty detector ID, including sets from admin accounts if accessed by a member.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that the IP Set is associated with.
PaginationConfig	object	Optional	A dictionary that provides parameters to control pagination.
PaginationConfig.MaxItems	number	Optional	The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
PaginationConfig.PageSize	number	Optional	The size of each page.
PaginationConfig.StartingToken	string	Optional	A token to specify where to start paginating. This is the NextToken from a previous response.

Input Example

{"PaginationConfig":{"MaxItems":123,"PageSize":123,"StartingToken":"string"}}

Output

Parameter	Type	Description
response	array	Output field: response
response.ResponseMetadata	object	Response data
response.ResponseMetadata.RequestId	string	Response data
response.ResponseMetadata.HTTPStatusCode	number	Response data
response.ResponseMetadata.HTTPHeaders	object	Response data
response.ResponseMetadata.HTTPHeaders.date	string	Response data
response.ResponseMetadata.HTTPHeaders.content-type	string	Response data
response.ResponseMetadata.HTTPHeaders.content-length	string	Response data
response.ResponseMetadata.HTTPHeaders.connection	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-requestid	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-origin	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amz-apigw-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-expose-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-trace-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-max-age	string	Response data
response.ResponseMetadata.RetryAttempts	number	Response data
response.IpSetIds	array	Unique identifier

Output Example

{"response":[{"ResponseMetadata":{},"IpSetIds":[]}]}

List Threat Intel Sets

Lists all Threat Intel Sets associated with a given DetectorId in Amazon AWS GuardDuty, including admin account sets if accessed by a member.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector that the threat Intel Set is associated with.
PaginationConfig	object	Optional	A dictionary that provides parameters to control pagination.
PaginationConfig.MaxItems	number	Optional	The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
PaginationConfig.PageSize	number	Optional	The size of each page.
PaginationConfig.StartingToken	string	Optional	A token to specify where to start paginating. This is the NextToken from a previous response.

Input Example

{"PaginationConfig":{"MaxItems":123,"PageSize":123,"StartingToken":"string"}}

Output

Parameter	Type	Description
response	array	Output field: response
response.ResponseMetadata	object	Response data
response.ResponseMetadata.RequestId	string	Response data
response.ResponseMetadata.HTTPStatusCode	number	Response data
response.ResponseMetadata.HTTPHeaders	object	Response data
response.ResponseMetadata.HTTPHeaders.date	string	Response data
response.ResponseMetadata.HTTPHeaders.content-type	string	Response data
response.ResponseMetadata.HTTPHeaders.content-length	string	Response data
response.ResponseMetadata.HTTPHeaders.connection	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-requestid	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-origin	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-allow-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amz-apigw-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-expose-headers	string	Response data
response.ResponseMetadata.HTTPHeaders.x-amzn-trace-id	string	Response data
response.ResponseMetadata.HTTPHeaders.access-control-max-age	string	Response data
response.ResponseMetadata.RetryAttempts	number	Response data
response.ThreatIntelSetIds	array	Unique identifier

Output Example

{"response":[{"ResponseMetadata":{},"ThreatIntelSetIds":[]}]}

Update Detector

Updates the settings of a specified Amazon AWS GuardDuty detector using the provided DetectorId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The unique ID of the detector to update.
Enable	boolean	Optional	Specifies whether the detector is enabled or not enabled.
FindingPublishingFrequency	string	Optional	An enum value that specifies how frequently findings are exported, such as to CloudWatch Events.
DataSources	object	Optional	Describes which data sources will be updated.
DataSources.S3Logs	object	Optional	Describes whether S3 data event logs are enabled as a data source.
DataSources.S3Logs.Enable	boolean	Required	Describes whether any Kubernetes logs are enabled as data sources.
DataSources.Kubernetes	object	Optional	Describes whether any Kubernetes logs are enabled as data sources.
DataSources.Kubernetes.AuditLogs	object	Optional	The status of Kubernetes audit logs as a data source.
DataSources.Kubernetes.AuditLogs.Enable	boolean	Required	The status of Kubernetes audit logs as a data source.
DataSources.MalwareProtection	object	Optional	Describes whether Malware Protection is enabled as a data source.
DataSources.MalwareProtection.ScanEc2InstanceWithFindings	object	Optional	Describes the configuration of Malware Protection for EC2 instances with findings.
DataSources.MalwareProtection.ScanEc2InstanceWithFindings.EbsVolumes	boolean	Optional	Describes the configuration for scanning EBS volumes as data source.
Features	array	Optional	Provides the features that will be updated for the detector.
Features.Name	string	Optional	The name of the feature.
Features.Status	string	Optional	The status of the feature.
Features.AdditionalConfiguration	array	Optional	Additional configuration for a resource.
Features.AdditionalConfiguration.Name	string	Optional	Name of the additional configuration.
Features.AdditionalConfiguration.Status	string	Optional	Status of the additional configuration.

Input Example

{"Enable":true,"FindingPublishingFrequency":"FIFTEEN_MINUTES","DataSources":{"S3Logs":{"Enable":true},"Kubernetes":{"AuditLogs":{"Enable":true}},"MalwareProtection":{"ScanEc2InstanceWithFindings":{"EbsVolumes":true}}},"Features":[{"Name":"S3_DATA_EVENTS","Status":"ENABLED","AdditionalConfiguration":[{"Name":"EKS_ADDON_MANAGEMENT","Status":"ENABLED"}]}]}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Update IP Set

Updates an existing IP set in Amazon AWS GuardDuty using specified DetectorId and IpSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The detector ID that specifies the GuardDuty service whose IP Set you want to update.
IpSetId	string	Required	The unique ID that specifies the IP Set that you want to update.
Name	string	Optional	The unique ID that specifies the IP Set that you want to update.
Location	string	Optional	The updated URI of the file that contains the IP Set.
Activate	boolean	Optional	The updated Boolean value that specifies whether the IP Set is active or not.

Input Example

{"DetectorId":"string","IpSetId":"string","Name":"Example Name","Location":"string","Activate":true}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Update Threat Intel Set

Updates a specified Threat Intel Set in Amazon AWS GuardDuty using the provided DetectorId and ThreatIntelSetId.

Input

Argument Name	Type	Required	Description
DetectorId	string	Required	The detector ID that specifies the GuardDuty service whose Threat Intel Set you want to update.
ThreatIntelSetId	string	Required	The unique ID that specifies the ThreatIntelSet that you want to update.
Name	string	Optional	The unique ID that specifies the Threat Intel Set that you want to update.
Location	string	Optional	The updated URI of the file that contains the Threat Intel Set.
Activate	boolean	Optional	The updated Boolean value that specifies whether the Threat Intel Set is active or not.

Input Example

{"Activate":true}

Output

Parameter	Type	Description
success	boolean	Whether the operation was successful

Output Example

{"success":true}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT