AWS - GuardDuty v1.3.71
Amazon Web Services Guard Duty Service (gd)
- Author:
- Cortex XSOAR
- Support:
- xsoar
- Default data source:
- AWS - GuardDuty Event Collector
agentixxsiam
Cloud Service Provider
Classifiers (2)
Incident fields (18)
- AWS Arn
- AWS GuardDuty Access Key Details
- AWS GuardDuty Confidence Score
- AWS GuardDuty Container Details
- AWS GuardDuty Ebs Volume Details
- AWS GuardDuty Ecs Cluster Details
- AWS GuardDuty Eks Cluster Details
- AWS GuardDuty Iam Instance Profile
- AWS GuardDuty Instance Details
- AWS GuardDuty Kubernetes User Details
- AWS GuardDuty Kubernetes Workload Details
- AWS GuardDuty Network Interface
- AWS GuardDuty Partition
- AWS GuardDuty Resource Type
- AWS GuardDuty S3 Bucket Details
- AWS GuardDuty Schema Version
- AWS GuardDuty Service
- AWS GuardDuty Type
Incident types (5)
Integrations (2)
Layouts (5)
Modeling rules (2)
Parsing rules (1)
README
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3.
What does this pack do
This integration enables you to:
- Create an AWS GuardDuty detector on the integration instance specified AWS account.
- Retrieve, update, or delete Amazon GuardDuty detectors.
- Create, retrieve, update, or delete a list of IP addresses that are trusted for secure communication with AWS infrastructure and applications.
- Create, retrieve, or delete a set of known malicious IP addresses.
- Retrieve lists or descriptions of Amazon GuardDuty findings (a potential security issue detected within your network).
- Archive Amazon GuardDuty findings.
- Retrieve a description of the Amazon GuardDuty members.