AWS - GuardDuty

category: IT Services
provider: Amazon
commonfields:
  id: AWS - GuardDuty
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: AWS Default Region
  name: defaultRegion
  required: true
  type: 0
  section: Connect
- display: Role Arn
  name: roleArn
  type: 0
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Role Session Name
  name: roleSessionName
  type: 0
  section: Connect
  required: false
- display: Role Session Duration
  name: sessionDuration
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  required: false
  section: Connect
- display: Access Key
  name: access_key
  type: 0
  section: Connect
  hidden: true
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Timeout
  name: timeout
  defaultvalue: 60,10
  additionalinfo: "The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used."
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Retries
  name: retries
  type: 0
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  section: Connect
  advanced: true
  required: false
- display: PrivateLink service URL.
  name: endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: STS PrivateLink URL.
  name: sts_endpoint_url
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: How many incidents to fetch each time
  name: fetch_limit
  type: 0
  defaultvalue: '10'
  required: false
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch_time
  type: 0
  defaultvalue: "3 days"
  required: false
  section: Collect
- display: Guard Duty Severity level
  name: gs_severity
  type: 16
  additionalinfo: 'You can set the severity level of the findings to be fetched: "Low", "Medium", "High". For example, if you set the severity level to "Medium", the integration will only fetch findings with severity level of Medium and higher.'
  section: Collect
  advanced: true
  options:
  - Low
  - Medium
  - High
  required: false
- display: Archive findings After Fetch
  name: is_archive
  type: 8
  defaultvalue: "false"
  additionalinfo: You can set whether findings that are fetched will be moved to the GuardDuty archive.
  required: false
  section: Collect
  advanced: true
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  defaultvalue: '1'
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Amazon Web Services Guard Duty Service (gd).
display: AWS - GuardDuty
name: AWS - GuardDuty
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'True'
      description: A boolean value that specifies whether the detector is to be enabled.
      name: enabled
      predefined:
      - 'True'
      - 'False'
      required: true
    - description: The status of S3 data event logs as a data source.
      name: enableS3Logs
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: The status of Kubernetes audit logs as a data source.
      name: enableKubernetesLogs
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: Describes the configuration for scanning EBS volumes as a data source.
      name: ebsVolumesMalwareProtection
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: Specifies how frequently updated findings are exported.
      name: findingFrequency
      auto: PREDEFINED
      predefined:
      - 'Fifteen Minutes'
      - 'One Hour'
      - 'Six Hours'
    - description: The AWS Region. If not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Create an AWS Guard Duty Detector on the integration instance specified aws account.
    name: aws-gd-create-detector
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.DetectorId
      description: The unique ID of the created detector.
      type: string
  - arguments:
    - description: The unique ID that specifies the detector that you want to delete.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes a Amazon GuardDuty detector specified by the detector ID.
    name: aws-gd-delete-detector
  - arguments:
    - description: The unique ID of the detector that you want to retrieve.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves an Amazon GuardDuty detector specified by the detectorId.
    name: aws-gd-get-detector
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.DetectorId
      description: The unique ID of the created detector.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.CreatedAt
      description: The first time a resource was created.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.ServiceRole
      description: Customer serviceRole name or ARN for accessing customer resources.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.Status
      description: The status of detector.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.UpdatedAt
      description: The time a resource was last updated.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.CloudTrailStatus
      description: Describes whether CloudTrail is enabled as a data source for the detector.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.DNSLogsStatus
      description: Denotes whether DNS logs are enabled as a data source.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.FlowLogsStatus
      description: Denotes whether VPC flow logs are enabled as a data source.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.S3LogsStatus
      description: Describes whether S3 data event logs are automatically enabled for new members of the organization.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.KubernetesAuditLogsStatus
      description: Describes whether Kubernetes audit logs are enabled as a data source.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.MalwareProtectionStatus
      description: Describes whether scanning EBS volumes is enabled as a data source.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.MalwareProtectionReason
      description: The reason why scanning EBS volumes (Malware Protection) was not enabled as a data source.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.Tags
      description: The tags of the detector resource.
      type: string
  - arguments:
    - description: The unique ID of the detector that you want to update.
      name: detectorId
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: Updated boolean value for the detector that specifies whether the detector is enabled.
      name: enable
      predefined:
      - 'True'
      - 'False'
      required: true
    - description: The status of S3 data event logs as a data source.
      name: enableS3Logs
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: The status of Kubernetes audit logs as a data source.
      name: enableKubernetesLogs
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: Describes the configuration for scanning EBS volumes as a data source.
      name: ebsVolumesMalwareProtection
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    - description: Specifies how frequently updated findings are exported.
      name: findingFrequency
      auto: PREDEFINED
      predefined:
      - 'Fifteen Minutes'
      - 'One Hour'
      - 'Six Hours'
    - description: The AWS Region. If not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates an Amazon GuardDuty detector specified by the detectorId.
    name: aws-gd-update-detector
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'True'
      description: A boolean value that indicates whether GuardDuty is to start using the uploaded IPSet.
      name: activate
      predefined:
      - 'True'
      - 'False'
    - description: The unique ID of the detector that you want to update.
      name: detectorId
      required: true
    - auto: PREDEFINED
      description: The format of the file that contains the IPSet.
      name: format
      predefined:
      - TXT
      - STIX
      - OTX_CSV
      - ALIEN_VAULT
      - PROOF_POINT
      - FIRE_EYE
      required: true
    - description: The URI of the file that contains the IPSet. For example (https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key).
      name: location
    - description: The user friendly name to identify the IPSet. This name is displayed in all findings that are triggered by activity that involves IP addresses included in this IPSet.
      name: name
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: A list of trusted IP addresses on allow list for secure communication with AWS infrastructure and applications.
    name: aws-gd-create-ip-set
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.IPSet.IpSetId
      description: The unique identifier for an IP Set.
      type: Unknown
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose IPSet you want to delete.
      name: detectorId
      required: true
    - description: The unique ID that specifies the IPSet that you want to delete.
      name: ipSetId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the IPSet specified by the IPSet ID.
    name: aws-gd-delete-ip-set
  - arguments:
    - description: Number of total results to query.
      name: limit
      defaultValue: '50'
    - description: Specific page to query.
      name: page
    - description: Number of total results in each page.
      name: page_size
      defaultValue: '50'
    - description: The AWS Region. If not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists detectorIds of all the existing Amazon GuardDuty detector resources.
    name: aws-gd-list-detectors
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.DetectorId
      description: The unique identifier for a detector.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The updated boolean value that specifies whether the IPSet is active or not.
      name: activate
      predefined:
      - 'True'
      - 'False'
    - description: The detectorID that specifies the GuardDuty service whose IPSet you want to update.
      name: detectorId
      required: true
    - description: The unique ID that specifies the IPSet that you want to update.
      name: ipSetId
      required: true
    - description: The updated URI of the file that contains the IPSet. For example (https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key).
      name: location
    - description: The user friendly name to identify the IPSet.
      name: name
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates the IPSet specified by the IPSet ID.
    name: aws-gd-update-ip-set
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose IPSet you want to retrieve.
      name: detectorId
      required: true
    - description: The unique ID that specifies the IPSet that you want to describe.
      name: ipSetId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves the IPSet specified by the IPSet ID.
    name: aws-gd-get-ip-set
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.IPSet.IpSetId
      description: The unique ID for the IPSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.IPSet.Format
      description: The format of the file that contains the IPSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.IPSet.Location
      description: The URI of the file that contains the IPSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.IPSet.Name
      description: he user friendly name to identify the IPSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.IPSet.Status
      description: The status of ipSet file uploaded.
      type: string
  - arguments:
    - description: The unique ID of the detector that you want to retrieve.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - defaultValue: '50'
      description: Number of total results to query.
      name: limit
    - description: Specific page to query.
      name: page
    - defaultValue: '50'
      description: Number of total results in each page.
      name: page_size
    description: Lists the IPSets of the GuardDuty service specified by the detector ID.
    name: aws-gd-list-ip-sets
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.IPSet.IpSetId
      description: The unique identifier for an IP Set.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'True'
      description: A boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
      name: activate
      predefined:
      - 'True'
      - 'False'
      required: true
    - description: The unique ID of the detector that you want to update.
      name: detectorId
      required: true
    - auto: PREDEFINED
      description: The format of the file that contains the ThreatIntelSet.
      name: format
      predefined:
      - TXT
      - STIX
      - OTX_CSV
      - ALIEN_VAULT
      - PROOF_POINT
      - FIRE_EYE
      required: true
    - description: The URI of the file that contains the ThreatIntelSet. For example (https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key).
      name: location
      required: true
    - description: A user-friendly ThreatIntelSet name that is displayed in all finding generated by activity that involves IP addresses included in this ThreatIntelSet.
      name: name
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Create a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets.
    name: aws-gd-create-threatintel-set
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.ThreatIntelSetId
      description: The unique identifier for an threat intel set.
      type: string
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to delete.
      name: detectorId
      required: true
    - description: The unique ID that specifies the ThreatIntelSet that you want to delete.
      name: threatIntelSetId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes ThreatIntelSet specified by the ThreatIntelSet ID.
    name: aws-gd-delete-threatintel-set
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to describe.
      name: detectorId
      required: true
    - description: The unique ID that specifies the ThreatIntelSet that you want to describe.
      name: threatIntelSetId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.
    name: aws-gd-get-threatintel-set
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.ThreatIntelSetId
      description: The unique ID that specifies the ThreatIntelSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.Format
      description: The format of the threatIntelSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.Location
      description: The URI of the file that contains the ThreatIntelSet.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.Name
      description: A user-friendly ThreatIntelSet name.
      type: string
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.Status
      description: The status of threatIntelSet file uploaded.
      type: string
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose ThreatIntelSets you want to list.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - defaultValue: '50'
      description: Number of total results to query.
      name: limit
    - description: Specific page to query.
      name: page
    - defaultValue: '50'
      description: Number of total results in each page.
      name: page_size
    description: Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID.
    name: aws-gd-list-threatintel-sets
    outputs:
    - contextPath: AWS.GuardDuty.Detectors.ThreatIntelSet.ThreatIntelSetId
      description: The unique identifier for an threat intel set.
      type: string
  - arguments:
    - description: The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to update.
      name: detectorId
      required: true
    - description: The unique ID that specifies the ThreatIntelSet that you want to update.
      name: threatIntelSetId
    - auto: PREDEFINED
      description: The updated boolean value that specifies whether the ThreatIntelSet is active or not.
      name: activate
      predefined:
      - 'True'
      - 'False'
    - description: The updated URI of the file that contains the ThreatIntelSet. For example (https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key).
      name: location
    - description: The user-friendly ThreatIntelSet name.
      name: name
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates the ThreatIntelSet specified by ThreatIntelSet ID.
    name: aws-gd-update-threatintel-set
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose findings you want to list.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - defaultValue: '50'
      description: Number of total results to query.
      name: limit
    - description: Specific page to query.
      name: page
    - defaultValue: '50'
      description: Number of total results in each page.
      name: page_size
    description: Lists Amazon GuardDuty findings for the specified detector ID.
    name: aws-gd-list-findings
    outputs:
    - contextPath: AWS.GuardDuty.Findings.FindingId
      description: The unique identifier for the Finding.
      type: string
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
      name: detectorId
      required: true
    - description: IDs of the findings that you want to retrieve.
      name: findingIds
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - name: returnRawResponse
      description: Select 'true' to save all fields from the response to the context. Otherwise, complex fields will be stored in JSON format. Default value is False.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: false
    description: Describes Amazon GuardDuty findings specified by finding IDs.
    name: aws-gd-get-findings
    outputs:
    - contextPath: 'AWS.GuardDuty.Findings.AccountId'
      description: The ID of the account in which the finding was generated.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.CreatedAt'
      description: The time and date when the finding was created.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Description'
      description: The description of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Region'
      description: The region where the finding was generated.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Id'
      description: The ID of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Title'
      description: The title of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Severity'
      description: The severity of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Type'
      description: The type of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.UpdatedAt'
      description: The time and date when the finding was last updated.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Arn'
      description: The ARN of the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Confidence'
      description: The confidence score for the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Partition'
      description: The partition associated with the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.ResourceType'
      description: The type of Amazon Web Services resource.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.SchemaVersion'
      description: The version of the schema used for the finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.AccessKeyDetails'
      description: The IAM access key details (IAM user information) of a user that engaged in the activity that prompted GuardDuty to generate a finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.InstanceDetails'
      description: The information about the EC2 instance associated with the activity that prompted GuardDuty to generate a finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.EksClusterDetails'
      description: Details about the EKS cluster involved in a Kubernetes finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.KubernetesDetails'
      description: Details about the Kubernetes user and workload involved in a Kubernetes finding.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.EbsVolumeDetails'
      description: Contains a list of scanned and skipped EBS volumes with details.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.EcsClusterDetails'
      description: Contains information about the details of the ECS cluster.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.ContainerDetails'
      description: Details of a container.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Resource.S3BucketDetails'
      description: Contains information on the S3 bucket.
      type: string
    - contextPath: 'AWS.GuardDuty.Findings.Service'
      description: Contains additional information about the generated finding.
      type: string
  - arguments:
    - description: The ID of the detector to create sample findings for.
      name: detectorId
      required: true
    - description: Types of sample findings that you want to generate. Separated by comma.
      name: findingTypes
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Generates example findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates example findings of all supported finding types.
    name: aws-gd-create-sample-findings
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose findings you want to archive.
      name: detectorId
      required: true
    - description: IDs of the findings that you want to archive. Separated by comma.
      name: findingIds
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Archives Amazon GuardDuty findings specified by the list of finding IDs.
    name: aws-gd-archive-findings
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose findings you want to unarchive.
      name: detectorId
      required: true
    - description: IDs of the findings that you want to unarchive.
      name: findingIds
    description: Unarchives Amazon GuardDuty findings specified by the list of finding IDs.
    name: aws-gd-unarchive-findings
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose findings you want to mark as useful or not useful.
      name: detectorId
      required: true
    - description: IDs of the findings that you want to mark as useful or not useful.
      name: findingIds
    - description: Additional feedback about the GuardDuty findings.
      name: comments
    - auto: PREDEFINED
      description: Specify whether the finding was useful or not.
      name: feedback
      predefined:
      - USEFUL
      - NOT_USEFUL
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Marks specified Amazon GuardDuty findings as useful or not useful.
    name: aws-gd-update-findings-feedback
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose members you want to retrieve.
      name: detectorId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - defaultValue: '50'
      description: Number of total results to query.
      name: limit
    - description: Specific page to query.
      name: page
    - defaultValue: '50'
      description: Number of total results in each page.
      name: page_size
    description: Describes Amazon GuardDuty members for the specified detector ID.
    name: aws-gd-list-members
    outputs:
    - contextPath: AWS.GuardDuty.Members.AccountId
      description: The unique account ID of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.DetectorId
      description: The unique detector ID of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.MasterId
      description: The unique detector ID of the master.
      type: string
    - contextPath: AWS.GuardDuty.Members.Email
      description: The email of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.RelationshipStatus
      description: The relationship  status of member.
      type: string
    - contextPath: AWS.GuardDuty.Members.InvitedAt
      description: The first time a member was invited.
      type: string
    - contextPath: AWS.GuardDuty.Members.UpdatedAt
      description: The time a member was last updated.
      type: string
  - arguments:
    - description: The ID of the detector that specifies the GuardDuty service whose members you want to retrieve.
      name: detectorId
      required: true
    - description: The ID of the account that specifies the GuardDuty service whose details you want to retrieve.
      name: accountIds
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Describes Amazon GuardDuty members for the specified detector ID & account ID.
    name: aws-gd-get-members
    outputs:
    - contextPath: AWS.GuardDuty.Members.AccountId
      description: The unique account ID of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.DetectorId
      description: The unique detector ID of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.MasterId
      description: The unique detector ID of the master.
      type: string
    - contextPath: AWS.GuardDuty.Members.Email
      description: The email of the member.
      type: string
    - contextPath: AWS.GuardDuty.Members.RelationshipStatus
      description: The relationship  status of member.
      type: string
    - contextPath: AWS.GuardDuty.Members.InvitedAt
      description: The first time a member was invited.
      type: string
    - contextPath: AWS.GuardDuty.Members.UpdatedAt
      description: The time a member was last updated.
      type: string
  dockerimage: demisto/boto3py3:1.0.0.10221838
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0
defaultmapperin: AWSGuardDuty - Incoming Mapper
defaultclassifier: AWSGuardDuty - Classifier