AWS - GuardDuty

Amazon Web Services Guard Duty Service (gd).

Category

IT Services

Pack

AWS-GuardDuty

Configuration parameters

• defaultRegion — AWS Default Region (required)
• roleArn — Role Arn
• isFetch — Fetch incidents
• incidentType — Incident type
• roleSessionName — Role Session Name
• sessionDuration — Role Session Duration
• credentials — Access Key
• access_key — Access Key
• secret_key — Secret Key
• timeout — Timeout
• retries — Retries
• endpoint_url — PrivateLink service URL.
• sts_endpoint_url — STS PrivateLink URL.
• sts_regional_endpoint — AWS STS Regional Endpoints
• fetch_limit — How many incidents to fetch each time
• first_fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• gs_severity — Guard Duty Severity level
• is_archive — Archive findings After Fetch
• incidentFetchInterval — Incidents Fetch Interval
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (23)

• aws-gd-archive-findings — Archives Amazon GuardDuty findings specified by the list of finding IDs.
• aws-gd-create-detector — Create an AWS Guard Duty Detector on the integration instance specified aws account.
• aws-gd-create-ip-set — A list of trusted IP addresses on allow list for secure communication with AWS infrastructure and applications.
• aws-gd-create-sample-findings — Generates example findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates example findings of all supported finding types.
• aws-gd-create-threatintel-set — Create a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets.
• aws-gd-delete-detector — Deletes a Amazon GuardDuty detector specified by the detector ID.
• aws-gd-delete-ip-set — Deletes the IPSet specified by the IPSet ID.
• aws-gd-delete-threatintel-set — Deletes ThreatIntelSet specified by the ThreatIntelSet ID.
• aws-gd-get-detector — Retrieves an Amazon GuardDuty detector specified by the detectorId.
• aws-gd-get-findings — Describes Amazon GuardDuty findings specified by finding IDs.
• aws-gd-get-ip-set — Retrieves the IPSet specified by the IPSet ID.
• aws-gd-get-members — Describes Amazon GuardDuty members for the specified detector ID & account ID.
• aws-gd-get-threatintel-set — Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.
• aws-gd-list-detectors — Lists detectorIds of all the existing Amazon GuardDuty detector resources.
• aws-gd-list-findings — Lists Amazon GuardDuty findings for the specified detector ID.
• aws-gd-list-ip-sets — Lists the IPSets of the GuardDuty service specified by the detector ID.
• aws-gd-list-members — Describes Amazon GuardDuty members for the specified detector ID.
• aws-gd-list-threatintel-sets — Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID.
• aws-gd-unarchive-findings — Unarchives Amazon GuardDuty findings specified by the list of finding IDs.
• aws-gd-update-detector — Updates an Amazon GuardDuty detector specified by the detectorId.
• aws-gd-update-findings-feedback — Marks specified Amazon GuardDuty findings as useful or not useful.
• aws-gd-update-ip-set — Updates the IPSet specified by the IPSet ID.
• aws-gd-update-threatintel-set — Updates the ThreatIntelSet specified by ThreatIntelSet ID.