AWS - GuardDuty

Amazon Web Services Guard Duty Service (gd).

IT Services · AWS - GuardDuty

Configuration parameters

  • defaultRegion — AWS Default Region (required)
  • roleArn — Role Arn
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • roleSessionName — Role Session Name
  • sessionDuration — Role Session Duration
  • credentials — Access Key
  • access_key — Access Key
  • secret_key — Secret Key
  • timeout — Timeout
  • retries — Retries
  • endpoint_url — PrivateLink service URL.
  • sts_endpoint_url — STS PrivateLink URL.
  • sts_regional_endpoint — AWS STS Regional Endpoints
  • fetch_limit — How many incidents to fetch each time
  • first_fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • gs_severity — Guard Duty Severity level
  • is_archive — Archive findings After Fetch
  • incidentFetchInterval — Incidents Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (23)

  • aws-gd-archive-findings

    Archives Amazon GuardDuty findings specified by the list of finding IDs.

  • aws-gd-create-detector

    Create an AWS Guard Duty Detector on the integration instance specified aws account.

  • aws-gd-create-ip-set

    A list of trusted IP addresses on allow list for secure communication with AWS infrastructure and applications.

  • aws-gd-create-sample-findings

    Generates example findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates example findings of all supported finding types.

  • aws-gd-create-threatintel-set

    Create a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets.

  • aws-gd-delete-detector

    Deletes a Amazon GuardDuty detector specified by the detector ID.

  • aws-gd-delete-ip-set

    Deletes the IPSet specified by the IPSet ID.

  • aws-gd-delete-threatintel-set

    Deletes ThreatIntelSet specified by the ThreatIntelSet ID.

  • aws-gd-get-detector

    Retrieves an Amazon GuardDuty detector specified by the detectorId.

  • aws-gd-get-findings

    Describes Amazon GuardDuty findings specified by finding IDs.

  • aws-gd-get-ip-set

    Retrieves the IPSet specified by the IPSet ID.

  • aws-gd-get-members

    Describes Amazon GuardDuty members for the specified detector ID & account ID.

  • aws-gd-get-threatintel-set

    Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

  • aws-gd-list-detectors

    Lists detectorIds of all the existing Amazon GuardDuty detector resources.

  • aws-gd-list-findings

    Lists Amazon GuardDuty findings for the specified detector ID.

  • aws-gd-list-ip-sets

    Lists the IPSets of the GuardDuty service specified by the detector ID.

  • aws-gd-list-members

    Describes Amazon GuardDuty members for the specified detector ID.

  • aws-gd-list-threatintel-sets

    Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID.

  • aws-gd-unarchive-findings

    Unarchives Amazon GuardDuty findings specified by the list of finding IDs.

  • aws-gd-update-detector

    Updates an Amazon GuardDuty detector specified by the detectorId.

  • aws-gd-update-findings-feedback

    Marks specified Amazon GuardDuty findings as useful or not useful.

  • aws-gd-update-ip-set

    Updates the IPSet specified by the IPSet ID.

  • aws-gd-update-threatintel-set

    Updates the ThreatIntelSet specified by ThreatIntelSet ID.