AWS - GuardDuty (v1.4.2)
Amazon Web Services Guard Duty Service (gd)
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Default data source
- AWS - GuardDuty Event Collector
- Categories
- Cloud Service Provider
Incident fields (18)
- AWS Arn
- AWS GuardDuty Access Key Details
- AWS GuardDuty Confidence Score
- AWS GuardDuty Container Details
- AWS GuardDuty Ebs Volume Details
- AWS GuardDuty Ecs Cluster Details
- AWS GuardDuty Eks Cluster Details
- AWS GuardDuty Iam Instance Profile
- AWS GuardDuty Instance Details
- AWS GuardDuty Kubernetes User Details
- AWS GuardDuty Kubernetes Workload Details
- AWS GuardDuty Network Interface
- AWS GuardDuty Partition
- AWS GuardDuty Resource Type
- AWS GuardDuty S3 Bucket Details
- AWS GuardDuty Schema Version
- AWS GuardDuty Service
- AWS GuardDuty Type
Integrations (2)
- AWS - GuardDuty
- AWS - GuardDuty Event Collector
Layouts (5)
- AWS Guard Duty EC2 Finding
- AWS Guard Duty IAM Finding
- AWS Guard Duty Kubernetes Finding
- AWS Guard Duty Malware Protection Finding
- AWS Guard Duty S3 Finding
Modeling rules (1)
- AWSGuardDuty Modeling Rule
Parsing rules (1)
- AWSGuardDuty Parsing Rule
README
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3.
What does this pack do
This integration enables you to:
- Create an AWS GuardDuty detector on the integration instance specified AWS account.
- Retrieve, update, or delete Amazon GuardDuty detectors.
- Create, retrieve, update, or delete a list of IP addresses that are trusted for secure communication with AWS infrastructure and applications.
- Create, retrieve, or delete a set of known malicious IP addresses.
- Retrieve lists or descriptions of Amazon GuardDuty findings (a potential security issue detected within your network).
- Archive Amazon GuardDuty findings.
- Retrieve a description of the Amazon GuardDuty members.