AWS::GuardDuty::ThreatIntelSet - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

AWS::GuardDuty::ThreatIntelSet

The AWS::GuardDuty::ThreatIntelSet resource specifies a new ThreatIntelSet. A ThreatIntelSet consists of known malicious IP addresses. GuardDuty generates findings based on the ThreatIntelSet when it is activated.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::GuardDuty::ThreatIntelSet", "Properties" : { "Activate" : Boolean, "DetectorId" : String, "Format" : String, "Location" : String, "Name" : String, "Tags" : [ Tag, ... ] } }

YAML

Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: Boolean DetectorId: String Format: String Location: String Name: String Tags: - Tag

Properties

Activate

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

Required: Yes

Type: Boolean

Update requires: No interruption

DetectorId

The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.

Required: Yes

Type: String

Minimum: 1

Maximum: 300

Update requires: Replacement

Format

The format of the file that contains the ThreatIntelSet.

Required: Yes

Type: String

Allowed values: ALIEN_VAULT | FIRE_EYE | OTX_CSV | PROOF_POINT | STIX | TXT

Update requires: Replacement

Location

The URI of the file that contains the ThreatIntelSet.

Required: Yes

Type: String

Minimum: 1

Maximum: 300

Update requires: No interruption

Name

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

Required: No

Type: String

Minimum: 1

Maximum: 300

Update requires: No interruption

Tags

Not currently supported by Amazon CloudFormation.

Required: No

Type: List of Tag

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the unique ID of the ThreatIntelSet.

For more information about using the Ref function, see Ref.

Examples

Declare a ThreatIntelSet Resource

The following example shows how to declare a GuardDuty ThreatIntelSet resource:

JSON

"mythreatintelset": { "Type": "AWS::GuardDuty::ThreatIntelSet", "Properties": { "Activate": true, "DetectorId": "12abc34d567e8f4912ab3d45e67891f2", "Format": "TXT", "Location": "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt", "Name": "MyThreatIntelSet" } }

YAML

mythreatintelset: Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: true DetectorId: "12abc34d567e8f4912ab3d45e67891f2" Format: "TXT" Location: "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt" Name: "MyThreatIntelSet"