Class: Aws::GuardDuty::Client

Inherits:
Seahorse::Client::Base show all
Includes:
ClientStubs
Defined in:
gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb

Overview

An API client for GuardDuty. To construct a client, you need to configure a :region and :credentials.

client = Aws::GuardDuty::Client.new(
  region: region_name,
  credentials: credentials,
  # ...
)

For details on configuring region and credentials see the developer guide.

See #initialize for a full list of supported configuration options.

Instance Attribute Summary

Attributes inherited from Seahorse::Client::Base

#config, #handlers

API Operations collapse

Instance Method Summary collapse

Methods included from ClientStubs

#api_requests, #stub_data, #stub_responses

Methods inherited from Seahorse::Client::Base

add_plugin, api, clear_plugins, define, new, #operation_names, plugins, remove_plugin, set_api, set_plugins

Methods included from Seahorse::Client::HandlerBuilder

#handle, #handle_request, #handle_response

Constructor Details

#initialize(options) ⇒ Client

Returns a new instance of Client.

Parameters:

  • options (Hash)

Options Hash (options):

  • :credentials (required, Aws::CredentialProvider)

    Your AWS credentials. This can be an instance of any one of the following classes:

    • Aws::Credentials - Used for configuring static, non-refreshing credentials.

    • Aws::SharedCredentials - Used for loading static credentials from a shared file, such as ~/.aws/config.

    • Aws::AssumeRoleCredentials - Used when you need to assume a role.

    • Aws::AssumeRoleWebIdentityCredentials - Used when you need to assume a role after providing credentials via the web.

    • Aws::SSOCredentials - Used for loading credentials from AWS SSO using an access token generated from aws login.

    • Aws::ProcessCredentials - Used for loading credentials from a process that outputs to stdout.

    • Aws::InstanceProfileCredentials - Used for loading credentials from an EC2 IMDS on an EC2 instance.

    • Aws::ECSCredentials - Used for loading credentials from instances running in ECS.

    • Aws::CognitoIdentityCredentials - Used for loading credentials from the Cognito Identity service.

    When :credentials are not configured directly, the following locations will be searched for credentials:

    • Aws.config[:credentials]
    • The :access_key_id, :secret_access_key, and :session_token options.
    • ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY']
    • ~/.aws/credentials
    • ~/.aws/config
    • EC2/ECS IMDS instance profile - When used by default, the timeouts are very aggressive. Construct and pass an instance of Aws::InstanceProfileCredentails or Aws::ECSCredentials to enable retries and extended timeouts. Instance profile credential fetching can be disabled by setting ENV['AWS_EC2_METADATA_DISABLED'] to true.
  • :region (required, String)

    The AWS region to connect to. The configured :region is used to determine the service :endpoint. When not passed, a default :region is searched for in the following locations:

    • Aws.config[:region]
    • ENV['AWS_REGION']
    • ENV['AMAZON_REGION']
    • ENV['AWS_DEFAULT_REGION']
    • ~/.aws/credentials
    • ~/.aws/config
  • :access_key_id (String)
  • :active_endpoint_cache (Boolean) — default: false

    When set to true, a thread polling for endpoints will be running in the background every 60 secs (default). Defaults to false.

  • :adaptive_retry_wait_to_fill (Boolean) — default: true

    Used only in adaptive retry mode. When true, the request will sleep until there is sufficent client side capacity to retry the request. When false, the request will raise a RetryCapacityNotAvailableError and will not retry instead of sleeping.

  • :client_side_monitoring (Boolean) — default: false

    When true, client-side metrics will be collected for all API requests from this client.

  • :client_side_monitoring_client_id (String) — default: ""

    Allows you to provide an identifier for this client which will be attached to all generated client side metrics. Defaults to an empty string.

  • :client_side_monitoring_host (String) — default: "127.0.0.1"

    Allows you to specify the DNS hostname or IPv4 or IPv6 address that the client side monitoring agent is running on, where client metrics will be published via UDP.

  • :client_side_monitoring_port (Integer) — default: 31000

    Required for publishing client metrics. The port that the client side monitoring agent is running on, where client metrics will be published via UDP.

  • :client_side_monitoring_publisher (Aws::ClientSideMonitoring::Publisher) — default: Aws::ClientSideMonitoring::Publisher

    Allows you to provide a custom client-side monitoring publisher class. By default, will use the Client Side Monitoring Agent Publisher.

  • :convert_params (Boolean) — default: true

    When true, an attempt is made to coerce request parameters into the required types.

  • :correct_clock_skew (Boolean) — default: true

    Used only in standard and adaptive retry modes. Specifies whether to apply a clock skew correction and retry requests with skewed client clocks.

  • :defaults_mode (String) — default: "legacy"

    See DefaultsModeConfiguration for a list of the accepted modes and the configuration defaults that are included.

  • :disable_host_prefix_injection (Boolean) — default: false

    Set to true to disable SDK automatically adding host prefix to default service endpoint when available.

  • :disable_request_compression (Boolean) — default: false

    When set to 'true' the request body will not be compressed for supported operations.

  • :endpoint (String)

    The client endpoint is normally constructed from the :region option. You should only configure an :endpoint when connecting to test or custom endpoints. This should be a valid HTTP(S) URI.

  • :endpoint_cache_max_entries (Integer) — default: 1000

    Used for the maximum size limit of the LRU cache storing endpoints data for endpoint discovery enabled operations. Defaults to 1000.

  • :endpoint_cache_max_threads (Integer) — default: 10

    Used for the maximum threads in use for polling endpoints to be cached, defaults to 10.

  • :endpoint_cache_poll_interval (Integer) — default: 60

    When :endpoint_discovery and :active_endpoint_cache is enabled, Use this option to config the time interval in seconds for making requests fetching endpoints information. Defaults to 60 sec.

  • :endpoint_discovery (Boolean) — default: false

    When set to true, endpoint discovery will be enabled for operations when available.

  • :ignore_configured_endpoint_urls (Boolean)

    Setting to true disables use of endpoint URLs provided via environment variables and the shared configuration file.

  • :log_formatter (Aws::Log::Formatter) — default: Aws::Log::Formatter.default

    The log formatter.

  • :log_level (Symbol) — default: :info

    The log level to send messages to the :logger at.

  • :logger (Logger)

    The Logger instance to send log messages to. If this option is not set, logging will be disabled.

  • :max_attempts (Integer) — default: 3

    An integer representing the maximum number attempts that will be made for a single request, including the initial attempt. For example, setting this value to 5 will result in a request being retried up to 4 times. Used in standard and adaptive retry modes.

  • :profile (String) — default: "default"

    Used when loading credentials from the shared credentials file at HOME/.aws/credentials. When not specified, 'default' is used.

  • :request_min_compression_size_bytes (Integer) — default: 10240

    The minimum size in bytes that triggers compression for request bodies. The value must be non-negative integer value between 0 and 10485780 bytes inclusive.

  • :retry_backoff (Proc)

    A proc or lambda used for backoff. Defaults to 2**retries * retry_base_delay. This option is only used in the legacy retry mode.

  • :retry_base_delay (Float) — default: 0.3

    The base delay in seconds used by the default backoff function. This option is only used in the legacy retry mode.

  • :retry_jitter (Symbol) — default: :none

    A delay randomiser function used by the default backoff function. Some predefined functions can be referenced by name - :none, :equal, :full, otherwise a Proc that takes and returns a number. This option is only used in the legacy retry mode.

    @see https://www.awsarchitectureblog.com/2015/03/backoff.html

  • :retry_limit (Integer) — default: 3

    The maximum number of times to retry failed requests. Only ~ 500 level server errors and certain ~ 400 level client errors are retried. Generally, these are throttling errors, data checksum errors, networking errors, timeout errors, auth errors, endpoint discovery, and errors from expired credentials. This option is only used in the legacy retry mode.

  • :retry_max_delay (Integer) — default: 0

    The maximum number of seconds to delay between retries (0 for no limit) used by the default backoff function. This option is only used in the legacy retry mode.

  • :retry_mode (String) — default: "legacy"

    Specifies which retry algorithm to use. Values are:

    • legacy - The pre-existing retry behavior. This is default value if no retry mode is provided.

    • standard - A standardized set of retry rules across the AWS SDKs. This includes support for retry quotas, which limit the number of unsuccessful retries a client can make.

    • adaptive - An experimental retry mode that includes all the functionality of standard mode along with automatic client side throttling. This is a provisional mode that may change behavior in the future.

  • :sdk_ua_app_id (String)

    A unique and opaque application ID that is appended to the User-Agent header as app/. It should have a maximum length of 50.

  • :secret_access_key (String)
  • :session_token (String)
  • :stub_responses (Boolean) — default: false

    Causes the client to return stubbed responses. By default fake responses are generated and returned. You can specify the response data to return or errors to raise by calling ClientStubs#stub_responses. See ClientStubs for more information.

    Please note When response stubbing is enabled, no HTTP requests are made, and retries are disabled.

  • :token_provider (Aws::TokenProvider)

    A Bearer Token Provider. This can be an instance of any one of the following classes:

    • Aws::StaticTokenProvider - Used for configuring static, non-refreshing tokens.

    • Aws::SSOTokenProvider - Used for loading tokens from AWS SSO using an access token generated from aws login.

    When :token_provider is not configured directly, the Aws::TokenProviderChain will be used to search for tokens configured for your profile in shared configuration files.

  • :use_dualstack_endpoint (Boolean)

    When set to true, dualstack enabled endpoints (with .aws TLD) will be used if available.

  • :use_fips_endpoint (Boolean)

    When set to true, fips compatible endpoints will be used if available. When a fips region is used, the region is normalized and this config is set to true.

  • :validate_params (Boolean) — default: true

    When true, request parameters are validated before sending the request.

  • :endpoint_provider (Aws::GuardDuty::EndpointProvider)

    The endpoint provider used to resolve endpoints. Any object that responds to #resolve_endpoint(parameters) where parameters is a Struct similar to Aws::GuardDuty::EndpointParameters

  • :http_proxy (URI::HTTP, String)

    A proxy to send requests through. Formatted like 'http://proxy.com:123'.

  • :http_open_timeout (Float) — default: 15

    The number of seconds to wait when opening a HTTP session before raising a Timeout::Error.

  • :http_read_timeout (Float) — default: 60

    The default number of seconds to wait for response data. This value can safely be set per-request on the session.

  • :http_idle_timeout (Float) — default: 5

    The number of seconds a connection is allowed to sit idle before it is considered stale. Stale connections are closed and removed from the pool before making a request.

  • :http_continue_timeout (Float) — default: 1

    The number of seconds to wait for a 100-continue response before sending the request body. This option has no effect unless the request has "Expect" header set to "100-continue". Defaults to nil which disables this behaviour. This value can safely be set per request on the session.

  • :ssl_timeout (Float) — default: nil

    Sets the SSL timeout in seconds.

  • :http_wire_trace (Boolean) — default: false

    When true, HTTP debug output will be sent to the :logger.

  • :ssl_verify_peer (Boolean) — default: true

    When true, SSL peer certificates are verified when establishing a connection.

  • :ssl_ca_bundle (String)

    Full path to the SSL certificate authority bundle file that should be used when verifying peer certificates. If you do not pass :ssl_ca_bundle or :ssl_ca_directory the the system default will be used if available.

  • :ssl_ca_directory (String)

    Full path of the directory that contains the unbundled SSL certificate authority files for verifying peer certificates. If you do not pass :ssl_ca_bundle or :ssl_ca_directory the the system default will be used if available.



385
386
387
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 385

def initialize(*args)
  super
end

Instance Method Details

#accept_administrator_invitation(params = {}) ⇒ Struct

Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.

Examples:

Request syntax with placeholder values


resp = client.accept_administrator_invitation({
  detector_id: "DetectorId", # required
  administrator_id: "String", # required
  invitation_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

  • :administrator_id (required, String)

    The account ID of the GuardDuty administrator account whose invitation you're accepting.

  • :invitation_id (required, String)

    The value that is used to validate the administrator account to the member account.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



419
420
421
422
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 419

def accept_administrator_invitation(params = {}, options = {})
  req = build_request(:accept_administrator_invitation, params)
  req.send_request(options)
end

#accept_invitation(params = {}) ⇒ Struct

Accepts the invitation to be monitored by a GuardDuty administrator account.

Examples:

Request syntax with placeholder values


resp = client.accept_invitation({
  detector_id: "DetectorId", # required
  master_id: "String", # required
  invitation_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

  • :master_id (required, String)

    The account ID of the GuardDuty administrator account whose invitation you're accepting.

  • :invitation_id (required, String)

    The value that is used to validate the administrator account to the member account.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



452
453
454
455
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 452

def accept_invitation(params = {}, options = {})
  req = build_request(:accept_invitation, params)
  req.send_request(options)
end

#archive_findings(params = {}) ⇒ Struct

Archives GuardDuty findings that are specified by the list of finding IDs.

Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.

Examples:

Request syntax with placeholder values


resp = client.archive_findings({
  detector_id: "DetectorId", # required
  finding_ids: ["FindingId"], # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that specifies the GuardDuty service whose findings you want to archive.

  • :finding_ids (required, Array<String>)

    The IDs of the findings that you want to archive.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



485
486
487
488
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 485

def archive_findings(params = {}, options = {})
  req = build_request(:archive_findings, params)
  req.send_request(options)
end

#create_detector(params = {}) ⇒ Types::CreateDetectorResponse

Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default.

  • When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default.

  • When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.create_detector({
  enable: false, # required
  client_token: "ClientToken",
  finding_publishing_frequency: "FIFTEEN_MINUTES", # accepts FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS
  data_sources: {
    s3_logs: {
      enable: false, # required
    },
    kubernetes: {
      audit_logs: { # required
        enable: false, # required
      },
    },
    malware_protection: {
      scan_ec2_instance_with_findings: {
        ebs_volumes: false,
      },
    },
  },
  tags: {
    "TagKey" => "TagValue",
  },
  features: [
    {
      name: "S3_DATA_EVENTS", # accepts S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING
      status: "ENABLED", # accepts ENABLED, DISABLED
      additional_configuration: [
        {
          name: "EKS_ADDON_MANAGEMENT", # accepts EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT
          status: "ENABLED", # accepts ENABLED, DISABLED
        },
      ],
    },
  ],
})

Response structure


resp.detector_id #=> String
resp.unprocessed_data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
resp.unprocessed_data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
resp.unprocessed_data_sources.malware_protection.service_role #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :enable (required, Boolean)

    A Boolean value that specifies whether the detector is to be enabled.

  • :client_token (String)

    The idempotency token for the create request.

    A suitable default value is auto-generated. You should normally not need to pass this option.**

  • :finding_publishing_frequency (String)

    A value that specifies how frequently updated findings are exported.

  • :data_sources (Types::DataSourceConfigurations)

    Describes which data sources will be enabled for the detector.

    There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

  • :tags (Hash<String,String>)

    The tags to be added to a new detector resource.

  • :features (Array<Types::DetectorFeatureConfiguration>)

    A list of features that will be configured for the detector.

Returns:

See Also:



604
605
606
607
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 604

def create_detector(params = {}, options = {})
  req = build_request(:create_detector, params)
  req.send_request(options)
end

#create_filter(params = {}) ⇒ Types::CreateFilterResponse

Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.

Examples:

Request syntax with placeholder values


resp = client.create_filter({
  detector_id: "DetectorId", # required
  name: "FilterName", # required
  description: "FilterDescription",
  action: "NOOP", # accepts NOOP, ARCHIVE
  rank: 1,
  finding_criteria: { # required
    criterion: {
      "String" => {
        eq: ["String"],
        neq: ["String"],
        gt: 1,
        gte: 1,
        lt: 1,
        lte: 1,
        equals: ["String"],
        not_equals: ["String"],
        greater_than: 1,
        greater_than_or_equal: 1,
        less_than: 1,
        less_than_or_equal: 1,
      },
    },
  },
  client_token: "ClientToken",
  tags: {
    "TagKey" => "TagValue",
  },
})

Response structure


resp.name #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector belonging to the GuardDuty account that you want to create a filter for.

  • :name (required, String)

    The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.

  • :description (String)

    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses (\{ \}, [ ], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.

  • :action (String)

    Specifies the action that is to be applied to the findings that match the filter.

  • :rank (Integer)

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.

  • :finding_criteria (required, Types::FindingCriteria)

    Represents the criteria to be used in the filter for querying findings.

    You can only use the following attributes to query findings:

    • accountId

    • id

    • region

    • severity

      To filter on the basis of severity, the API and CLI use the following input list for the FindingCriteria condition:

      • Low: ["1", "2", "3"]

      • Medium: ["4", "5", "6"]

      • High: ["7", "8", "9"]

      For more information, see Severity levels for GuardDuty findings.

    • type

    • updatedAt

      Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds.

    • resource.accessKeyDetails.accessKeyId

    • resource.accessKeyDetails.principalId

    • resource.accessKeyDetails.userName

    • resource.accessKeyDetails.userType

    • resource.instanceDetails.iamInstanceProfile.id

    • resource.instanceDetails.imageId

    • resource.instanceDetails.instanceId

    • resource.instanceDetails.tags.key

    • resource.instanceDetails.tags.value

    • resource.instanceDetails.networkInterfaces.ipv6Addresses

    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress

    • resource.instanceDetails.networkInterfaces.publicDnsName

    • resource.instanceDetails.networkInterfaces.publicIp

    • resource.instanceDetails.networkInterfaces.securityGroups.groupId

    • resource.instanceDetails.networkInterfaces.securityGroups.groupName

    • resource.instanceDetails.networkInterfaces.subnetId

    • resource.instanceDetails.networkInterfaces.vpcId

    • resource.instanceDetails.outpostArn

    • resource.resourceType

    • resource.s3BucketDetails.publicAccess.effectivePermissions

    • resource.s3BucketDetails.name

    • resource.s3BucketDetails.tags.key

    • resource.s3BucketDetails.tags.value

    • resource.s3BucketDetails.type

    • service.action.actionType

    • service.action.awsApiCallAction.api

    • service.action.awsApiCallAction.callerType

    • service.action.awsApiCallAction.errorCode

    • service.action.awsApiCallAction.remoteIpDetails.city.cityName

    • service.action.awsApiCallAction.remoteIpDetails.country.countryName

    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4

    • service.action.awsApiCallAction.remoteIpDetails.organization.asn

    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg

    • service.action.awsApiCallAction.serviceName

    • service.action.dnsRequestAction.domain

    • service.action.dnsRequestAction.domainWithSuffix

    • service.action.networkConnectionAction.blocked

    • service.action.networkConnectionAction.connectionDirection

    • service.action.networkConnectionAction.localPortDetails.port

    • service.action.networkConnectionAction.protocol

    • service.action.networkConnectionAction.remoteIpDetails.city.cityName

    • service.action.networkConnectionAction.remoteIpDetails.country.countryName

    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4

    • service.action.networkConnectionAction.remoteIpDetails.organization.asn

    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg

    • service.action.networkConnectionAction.remotePortDetails.port

    • service.action.awsApiCallAction.remoteAccountDetails.affiliated

    • service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4

    • service.action.kubernetesApiCallAction.namespace

    • service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn

    • service.action.kubernetesApiCallAction.requestUri

    • service.action.kubernetesApiCallAction.statusCode

    • service.action.networkConnectionAction.localIpDetails.ipAddressV4

    • service.action.networkConnectionAction.protocol

    • service.action.awsApiCallAction.serviceName

    • service.action.awsApiCallAction.remoteAccountDetails.accountId

    • service.additionalInfo.threatListName

    • service.resourceRole

    • resource.eksClusterDetails.name

    • resource.kubernetesDetails.kubernetesWorkloadDetails.name

    • resource.kubernetesDetails.kubernetesWorkloadDetails.namespace

    • resource.kubernetesDetails.kubernetesUserDetails.username

    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image

    • resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix

    • service.ebsVolumeScanDetails.scanId

    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name

    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity

    • service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash

    • resource.ecsClusterDetails.name

    • resource.ecsClusterDetails.taskDetails.containers.image

    • resource.ecsClusterDetails.taskDetails.definitionArn

    • resource.containerDetails.image

    • resource.rdsDbInstanceDetails.dbInstanceIdentifier

    • resource.rdsDbInstanceDetails.dbClusterIdentifier

    • resource.rdsDbInstanceDetails.engine

    • resource.rdsDbUserDetails.user

    • resource.rdsDbInstanceDetails.tags.key

    • resource.rdsDbInstanceDetails.tags.value

    • service.runtimeDetails.process.executableSha256

    • service.runtimeDetails.process.name

    • service.runtimeDetails.process.name

    • resource.lambdaDetails.functionName

    • resource.lambdaDetails.functionArn

    • resource.lambdaDetails.tags.key

    • resource.lambdaDetails.tags.value

  • :client_token (String)

    The idempotency token for the create request.

    A suitable default value is auto-generated. You should normally not need to pass this option.**

  • :tags (Hash<String,String>)

    The tags to be added to a new filter resource.

Returns:

See Also:



904
905
906
907
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 904

def create_filter(params = {}, options = {})
  req = build_request(:create_filter, params)
  req.send_request(options)
end

#create_ip_set(params = {}) ⇒ Types::CreateIPSetResponse

Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.

Examples:

Request syntax with placeholder values


resp = client.create_ip_set({
  detector_id: "DetectorId", # required
  name: "Name", # required
  format: "TXT", # required, accepts TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE
  location: "Location", # required
  activate: false, # required
  client_token: "ClientToken",
  tags: {
    "TagKey" => "TagValue",
  },
})

Response structure


resp.ip_set_id #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account that you want to create an IPSet for.

  • :name (required, String)

    The user-friendly name to identify the IPSet.

    Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_).

  • :format (required, String)

    The format of the file that contains the IPSet.

  • :location (required, String)

    The URI of the file that contains the IPSet.

  • :activate (required, Boolean)

    A Boolean value that indicates whether GuardDuty is to start using the uploaded IPSet.

  • :client_token (String)

    The idempotency token for the create request.

    A suitable default value is auto-generated. You should normally not need to pass this option.**

  • :tags (Hash<String,String>)

    The tags to be added to a new IP set resource.

Returns:

See Also:



971
972
973
974
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 971

def create_ip_set(params = {}, options = {})
  req = build_request(:create_ip_set, params)
  req.send_request(options)
end

#create_members(params = {}) ⇒ Types::CreateMembersResponse

Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization.

As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member.

When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration.

If you are adding accounts by invitation, before using InviteMembers, use CreateMembers after GuardDuty has been enabled in potential member accounts.

If you disassociate a member from a GuardDuty delegated administrator, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

Examples:

Request syntax with placeholder values


resp = client.create_members({
  detector_id: "DetectorId", # required
  account_details: [ # required
    {
      account_id: "AccountId", # required
      email: "Email", # required
    },
  ],
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account that you want to associate member accounts with.

  • :account_details (required, Array<Types::AccountDetail>)

    A list of account ID and email address pairs of the accounts that you want to associate with the GuardDuty administrator account.

Returns:

See Also:



1045
1046
1047
1048
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1045

def create_members(params = {}, options = {})
  req = build_request(:create_members, params)
  req.send_request(options)
end

#create_publishing_destination(params = {}) ⇒ Types::CreatePublishingDestinationResponse

Creates a publishing destination to export findings to. The resource to export findings to must exist before you use this operation.

Examples:

Request syntax with placeholder values


resp = client.create_publishing_destination({
  detector_id: "DetectorId", # required
  destination_type: "S3", # required, accepts S3
  destination_properties: { # required
    destination_arn: "String",
    kms_key_arn: "String",
  },
  client_token: "ClientToken",
})

Response structure


resp.destination_id #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the GuardDuty detector associated with the publishing destination.

  • :destination_type (required, String)

    The type of resource for the publishing destination. Currently only Amazon S3 buckets are supported.

  • :destination_properties (required, Types::DestinationProperties)

    The properties of the publishing destination, including the ARNs for the destination and the KMS key used for encryption.

  • :client_token (String)

    The idempotency token for the request.

    A suitable default value is auto-generated. You should normally not need to pass this option.**

Returns:

See Also:



1095
1096
1097
1098
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1095

def create_publishing_destination(params = {}, options = {})
  req = build_request(:create_publishing_destination, params)
  req.send_request(options)
end

#create_sample_findings(params = {}) ⇒ Struct

Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.

Examples:

Request syntax with placeholder values


resp = client.create_sample_findings({
  detector_id: "DetectorId", # required
  finding_types: ["FindingType"],
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector to create sample findings for.

  • :finding_types (Array<String>)

    The types of sample findings to generate.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1123
1124
1125
1126
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1123

def create_sample_findings(params = {}, options = {})
  req = build_request(:create_sample_findings, params)
  req.send_request(options)
end

#create_threat_intel_set(params = {}) ⇒ Types::CreateThreatIntelSetResponse

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Examples:

Request syntax with placeholder values


resp = client.create_threat_intel_set({
  detector_id: "DetectorId", # required
  name: "Name", # required
  format: "TXT", # required, accepts TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE
  location: "Location", # required
  activate: false, # required
  client_token: "ClientToken",
  tags: {
    "TagKey" => "TagValue",
  },
})

Response structure


resp.threat_intel_set_id #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.

  • :name (required, String)

    A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

  • :format (required, String)

    The format of the file that contains the ThreatIntelSet.

  • :location (required, String)

    The URI of the file that contains the ThreatIntelSet.

  • :activate (required, Boolean)

    A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

  • :client_token (String)

    The idempotency token for the create request.

    A suitable default value is auto-generated. You should normally not need to pass this option.**

  • :tags (Hash<String,String>)

    The tags to be added to a new threat list resource.

Returns:

See Also:



1187
1188
1189
1190
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1187

def create_threat_intel_set(params = {}, options = {})
  req = build_request(:create_threat_intel_set, params)
  req.send_request(options)
end

#decline_invitations(params = {}) ⇒ Types::DeclineInvitationsResponse

Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Examples:

Request syntax with placeholder values


resp = client.decline_invitations({
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :account_ids (required, Array<String>)

    A list of account IDs of the Amazon Web Services accounts that sent invitations to the current member account that you want to decline invitations from.

Returns:

See Also:



1220
1221
1222
1223
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1220

def decline_invitations(params = {}, options = {})
  req = build_request(:decline_invitations, params)
  req.send_request(options)
end

#delete_detector(params = {}) ⇒ Struct

Deletes an Amazon GuardDuty detector that is specified by the detector ID.

Examples:

Request syntax with placeholder values


resp = client.delete_detector({
  detector_id: "DetectorId", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that you want to delete.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1243
1244
1245
1246
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1243

def delete_detector(params = {}, options = {})
  req = build_request(:delete_detector, params)
  req.send_request(options)
end

#delete_filter(params = {}) ⇒ Struct

Deletes the filter specified by the filter name.

Examples:

Request syntax with placeholder values


resp = client.delete_filter({
  detector_id: "DetectorId", # required
  filter_name: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the filter is associated with.

  • :filter_name (required, String)

    The name of the filter that you want to delete.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1269
1270
1271
1272
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1269

def delete_filter(params = {}, options = {})
  req = build_request(:delete_filter, params)
  req.send_request(options)
end

#delete_invitations(params = {}) ⇒ Types::DeleteInvitationsResponse

Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Examples:

Request syntax with placeholder values


resp = client.delete_invitations({
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :account_ids (required, Array<String>)

    A list of account IDs of the Amazon Web Services accounts that sent invitations to the current member account that you want to delete invitations from.

Returns:

See Also:



1329
1330
1331
1332
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1329

def delete_invitations(params = {}, options = {})
  req = build_request(:delete_invitations, params)
  req.send_request(options)
end

#delete_ip_set(params = {}) ⇒ Struct

Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

Examples:

Request syntax with placeholder values


resp = client.delete_ip_set({
  detector_id: "DetectorId", # required
  ip_set_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector associated with the IPSet.

  • :ip_set_id (required, String)

    The unique ID of the IPSet to delete.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1296
1297
1298
1299
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1296

def delete_ip_set(params = {}, options = {})
  req = build_request(:delete_ip_set, params)
  req.send_request(options)
end

#delete_members(params = {}) ⇒ Types::DeleteMembersResponse

Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization.

Examples:

Request syntax with placeholder values


resp = client.delete_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account whose members you want to delete.

  • :account_ids (required, Array<String>)

    A list of account IDs of the GuardDuty member accounts that you want to delete.

Returns:

See Also:



1370
1371
1372
1373
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1370

def delete_members(params = {}, options = {})
  req = build_request(:delete_members, params)
  req.send_request(options)
end

#delete_publishing_destination(params = {}) ⇒ Struct

Deletes the publishing definition with the specified destinationId.

Examples:

Request syntax with placeholder values


resp = client.delete_publishing_destination({
  detector_id: "DetectorId", # required
  destination_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector associated with the publishing destination to delete.

  • :destination_id (required, String)

    The ID of the publishing destination to delete.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1397
1398
1399
1400
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1397

def delete_publishing_destination(params = {}, options = {})
  req = build_request(:delete_publishing_destination, params)
  req.send_request(options)
end

#delete_threat_intel_set(params = {}) ⇒ Struct

Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

Examples:

Request syntax with placeholder values


resp = client.delete_threat_intel_set({
  detector_id: "DetectorId", # required
  threat_intel_set_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the threatIntelSet is associated with.

  • :threat_intel_set_id (required, String)

    The unique ID of the threatIntelSet that you want to delete.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1424
1425
1426
1427
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1424

def delete_threat_intel_set(params = {}, options = {})
  req = build_request(:delete_threat_intel_set, params)
  req.send_request(options)
end

#describe_malware_scans(params = {}) ⇒ Types::DescribeMalwareScansResponse

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.describe_malware_scans({
  detector_id: "DetectorId", # required
  next_token: "String",
  max_results: 1,
  filter_criteria: {
    filter_criterion: [
      {
        criterion_key: "EC2_INSTANCE_ARN", # accepts EC2_INSTANCE_ARN, SCAN_ID, ACCOUNT_ID, GUARDDUTY_FINDING_ID, SCAN_START_TIME, SCAN_STATUS, SCAN_TYPE
        filter_condition: {
          equals_value: "NonEmptyString",
          greater_than: 1,
          less_than: 1,
        },
      },
    ],
  },
  sort_criteria: {
    attribute_name: "String",
    order_by: "ASC", # accepts ASC, DESC
  },
})

Response structure


resp.scans #=> Array
resp.scans[0].detector_id #=> String
resp.scans[0].admin_detector_id #=> String
resp.scans[0].scan_id #=> String
resp.scans[0].scan_status #=> String, one of "RUNNING", "COMPLETED", "FAILED", "SKIPPED"
resp.scans[0].failure_reason #=> String
resp.scans[0].scan_start_time #=> Time
resp.scans[0].scan_end_time #=> Time
resp.scans[0].trigger_details.guard_duty_finding_id #=> String
resp.scans[0].trigger_details.description #=> String
resp.scans[0].resource_details.instance_arn #=> String
resp.scans[0].scan_result_details.scan_result #=> String, one of "CLEAN", "INFECTED"
resp.scans[0]. #=> String
resp.scans[0].total_bytes #=> Integer
resp.scans[0].file_count #=> Integer
resp.scans[0].attached_volumes #=> Array
resp.scans[0].attached_volumes[0].volume_arn #=> String
resp.scans[0].attached_volumes[0].volume_type #=> String
resp.scans[0].attached_volumes[0].device_name #=> String
resp.scans[0].attached_volumes[0].volume_size_in_gb #=> Integer
resp.scans[0].attached_volumes[0].encryption_type #=> String
resp.scans[0].attached_volumes[0].snapshot_arn #=> String
resp.scans[0].attached_volumes[0].kms_key_arn #=> String
resp.scans[0].scan_type #=> String, one of "GUARDDUTY_INITIATED", "ON_DEMAND"
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the request is associated with.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

  • :filter_criteria (Types::FilterCriteria)

    Represents the criteria to be used in the filter for describing scan entries.

  • :sort_criteria (Types::SortCriteria)

    Represents the criteria used for sorting scan entries. The attributeName is required and it must be scanStartTime.

Returns:

See Also:



1532
1533
1534
1535
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1532

def describe_malware_scans(params = {}, options = {})
  req = build_request(:describe_malware_scans, params)
  req.send_request(options)
end

#describe_organization_configuration(params = {}) ⇒ Types::DescribeOrganizationConfigurationResponse

Returns information about the account selected as the delegated administrator for GuardDuty.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.describe_organization_configuration({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
})

Response structure


resp.auto_enable #=> Boolean
resp. #=> Boolean
resp.data_sources.s3_logs.auto_enable #=> Boolean
resp.data_sources.kubernetes.audit_logs.auto_enable #=> Boolean
resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.auto_enable #=> Boolean
resp.features #=> Array
resp.features[0].name #=> String, one of "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"
resp.features[0].auto_enable #=> String, one of "NEW", "NONE", "ALL"
resp.features[0].additional_configuration #=> Array
resp.features[0].additional_configuration[0].name #=> String, one of "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT"
resp.features[0].additional_configuration[0].auto_enable #=> String, one of "NEW", "NONE", "ALL"
resp.next_token #=> String
resp.auto_enable_organization_members #=> String, one of "NEW", "ALL", "NONE"

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector to retrieve information about the delegated administrator from.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



1603
1604
1605
1606
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1603

def describe_organization_configuration(params = {}, options = {})
  req = build_request(:describe_organization_configuration, params)
  req.send_request(options)
end

#describe_publishing_destination(params = {}) ⇒ Types::DescribePublishingDestinationResponse

Returns information about the publishing destination specified by the provided destinationId.

Examples:

Request syntax with placeholder values


resp = client.describe_publishing_destination({
  detector_id: "DetectorId", # required
  destination_id: "String", # required
})

Response structure


resp.destination_id #=> String
resp.destination_type #=> String, one of "S3"
resp.status #=> String, one of "PENDING_VERIFICATION", "PUBLISHING", "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY", "STOPPED"
resp.publishing_failure_start_timestamp #=> Integer
resp.destination_properties.destination_arn #=> String
resp.destination_properties.kms_key_arn #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector associated with the publishing destination to retrieve.

  • :destination_id (required, String)

    The ID of the publishing destination to retrieve.

Returns:

See Also:



1646
1647
1648
1649
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1646

def describe_publishing_destination(params = {}, options = {})
  req = build_request(:describe_publishing_destination, params)
  req.send_request(options)
end

#disable_organization_admin_account(params = {}) ⇒ Struct

Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation.

Examples:

Request syntax with placeholder values


resp = client.({
  admin_account_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :admin_account_id (required, String)

    The Amazon Web Services Account ID for the organizations account to be disabled as a GuardDuty delegated administrator.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1671
1672
1673
1674
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1671

def (params = {}, options = {})
  req = build_request(:disable_organization_admin_account, params)
  req.send_request(options)
end

#disassociate_from_administrator_account(params = {}) ⇒ Struct

Disassociates the current GuardDuty member account from its administrator account.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.

Examples:

Request syntax with placeholder values


resp = client.({
  detector_id: "DetectorId", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1713
1714
1715
1716
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1713

def (params = {}, options = {})
  req = build_request(:disassociate_from_administrator_account, params)
  req.send_request(options)
end

#disassociate_from_master_account(params = {}) ⇒ Struct

Disassociates the current GuardDuty member account from its administrator account.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

Examples:

Request syntax with placeholder values


resp = client.({
  detector_id: "DetectorId", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1751
1752
1753
1754
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1751

def (params = {}, options = {})
  req = build_request(:disassociate_from_master_account, params)
  req.send_request(options)
end

#disassociate_members(params = {}) ⇒ Types::DisassociateMembersResponse

Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization.

Examples:

Request syntax with placeholder values


resp = client.disassociate_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account whose members you want to disassociate from the administrator account.

  • :account_ids (required, Array<String>)

    A list of account IDs of the GuardDuty member accounts that you want to disassociate from the administrator account.

Returns:

See Also:



1808
1809
1810
1811
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1808

def disassociate_members(params = {}, options = {})
  req = build_request(:disassociate_members, params)
  req.send_request(options)
end

#enable_organization_admin_account(params = {}) ⇒ Struct

Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation.

Examples:

Request syntax with placeholder values


resp = client.({
  admin_account_id: "String", # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :admin_account_id (required, String)

    The Amazon Web Services account ID for the organization account to be enabled as a GuardDuty delegated administrator.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



1833
1834
1835
1836
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1833

def (params = {}, options = {})
  req = build_request(:enable_organization_admin_account, params)
  req.send_request(options)
end

#get_administrator_account(params = {}) ⇒ Types::GetAdministratorAccountResponse

Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account.

If the organization's management account or a delegated administrator runs this API, it will return success (HTTP 200) but no content.

Examples:

Request syntax with placeholder values


resp = client.({
  detector_id: "DetectorId", # required
})

Response structure


resp.administrator. #=> String
resp.administrator.invitation_id #=> String
resp.administrator.relationship_status #=> String
resp.administrator.invited_at #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

Returns:

See Also:



1870
1871
1872
1873
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1870

def (params = {}, options = {})
  req = build_request(:get_administrator_account, params)
  req.send_request(options)
end

#get_coverage_statistics(params = {}) ⇒ Types::GetCoverageStatisticsResponse

Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources.

Examples:

Request syntax with placeholder values


resp = client.get_coverage_statistics({
  detector_id: "DetectorId", # required
  filter_criteria: {
    filter_criterion: [
      {
        criterion_key: "ACCOUNT_ID", # accepts ACCOUNT_ID, CLUSTER_NAME, RESOURCE_TYPE, COVERAGE_STATUS, ADDON_VERSION, MANAGEMENT_TYPE, EKS_CLUSTER_NAME, ECS_CLUSTER_NAME, AGENT_VERSION, INSTANCE_ID, CLUSTER_ARN
        filter_condition: {
          equals: ["String"],
          not_equals: ["String"],
        },
      },
    ],
  },
  statistics_type: ["COUNT_BY_RESOURCE_TYPE"], # required, accepts COUNT_BY_RESOURCE_TYPE, COUNT_BY_COVERAGE_STATUS
})

Response structure


resp.coverage_statistics.count_by_resource_type #=> Hash
resp.coverage_statistics.count_by_resource_type["ResourceType"] #=> Integer
resp.coverage_statistics.count_by_coverage_status #=> Hash
resp.coverage_statistics.count_by_coverage_status["CoverageStatus"] #=> Integer

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the GuardDuty detector associated to the coverage statistics.

  • :filter_criteria (Types::CoverageFilterCriteria)

    Represents the criteria used to filter the coverage statistics

  • :statistics_type (required, Array<String>)

    Represents the statistics type used to aggregate the coverage details.

Returns:

See Also:



1924
1925
1926
1927
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1924

def get_coverage_statistics(params = {}, options = {})
  req = build_request(:get_coverage_statistics, params)
  req.send_request(options)
end

#get_detector(params = {}) ⇒ Types::GetDetectorResponse

Retrieves an Amazon GuardDuty detector specified by the detectorId.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.get_detector({
  detector_id: "DetectorId", # required
})

Response structure


resp.created_at #=> String
resp.finding_publishing_frequency #=> String, one of "FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS"
resp.service_role #=> String
resp.status #=> String, one of "ENABLED", "DISABLED"
resp.updated_at #=> String
resp.data_sources.cloud_trail.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.dns_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.flow_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.s3_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.kubernetes.audit_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
resp.data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
resp.data_sources.malware_protection.service_role #=> String
resp.tags #=> Hash
resp.tags["TagKey"] #=> String
resp.features #=> Array
resp.features[0].name #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"
resp.features[0].status #=> String, one of "ENABLED", "DISABLED"
resp.features[0].updated_at #=> Time
resp.features[0].additional_configuration #=> Array
resp.features[0].additional_configuration[0].name #=> String, one of "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT"
resp.features[0].additional_configuration[0].status #=> String, one of "ENABLED", "DISABLED"
resp.features[0].additional_configuration[0].updated_at #=> Time

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that you want to get.

Returns:

See Also:



1990
1991
1992
1993
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 1990

def get_detector(params = {}, options = {})
  req = build_request(:get_detector, params)
  req.send_request(options)
end

#get_filter(params = {}) ⇒ Types::GetFilterResponse

Returns the details of the filter specified by the filter name.

Examples:

Request syntax with placeholder values


resp = client.get_filter({
  detector_id: "DetectorId", # required
  filter_name: "String", # required
})

Response structure


resp.name #=> String
resp.description #=> String
resp.action #=> String, one of "NOOP", "ARCHIVE"
resp.rank #=> Integer
resp.finding_criteria.criterion #=> Hash
resp.finding_criteria.criterion["String"].eq #=> Array
resp.finding_criteria.criterion["String"].eq[0] #=> String
resp.finding_criteria.criterion["String"].neq #=> Array
resp.finding_criteria.criterion["String"].neq[0] #=> String
resp.finding_criteria.criterion["String"].gt #=> Integer
resp.finding_criteria.criterion["String"].gte #=> Integer
resp.finding_criteria.criterion["String"].lt #=> Integer
resp.finding_criteria.criterion["String"].lte #=> Integer
resp.finding_criteria.criterion["String"].equals #=> Array
resp.finding_criteria.criterion["String"].equals[0] #=> String
resp.finding_criteria.criterion["String"].not_equals #=> Array
resp.finding_criteria.criterion["String"].not_equals[0] #=> String
resp.finding_criteria.criterion["String"].greater_than #=> Integer
resp.finding_criteria.criterion["String"].greater_than_or_equal #=> Integer
resp.finding_criteria.criterion["String"].less_than #=> Integer
resp.finding_criteria.criterion["String"].less_than_or_equal #=> Integer
resp.tags #=> Hash
resp.tags["TagKey"] #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the filter is associated with.

  • :filter_name (required, String)

    The name of the filter you want to get.

Returns:

See Also:



2049
2050
2051
2052
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2049

def get_filter(params = {}, options = {})
  req = build_request(:get_filter, params)
  req.send_request(options)
end

#get_findings(params = {}) ⇒ Types::GetFindingsResponse

Describes Amazon GuardDuty findings specified by finding IDs.

Examples:

Request syntax with placeholder values


resp = client.get_findings({
  detector_id: "DetectorId", # required
  finding_ids: ["FindingId"], # required
  sort_criteria: {
    attribute_name: "String",
    order_by: "ASC", # accepts ASC, DESC
  },
})

Response structure


resp.findings #=> Array
resp.findings[0]. #=> String
resp.findings[0].arn #=> String
resp.findings[0].confidence #=> Float
resp.findings[0].created_at #=> String
resp.findings[0].description #=> String
resp.findings[0].id #=> String
resp.findings[0].partition #=> String
resp.findings[0].region #=> String
resp.findings[0].resource.access_key_details.access_key_id #=> String
resp.findings[0].resource.access_key_details.principal_id #=> String
resp.findings[0].resource.access_key_details.user_name #=> String
resp.findings[0].resource.access_key_details.user_type #=> String
resp.findings[0].resource.s3_bucket_details #=> Array
resp.findings[0].resource.s3_bucket_details[0].arn #=> String
resp.findings[0].resource.s3_bucket_details[0].name #=> String
resp.findings[0].resource.s3_bucket_details[0].type #=> String
resp.findings[0].resource.s3_bucket_details[0].created_at #=> Time
resp.findings[0].resource.s3_bucket_details[0].owner.id #=> String
resp.findings[0].resource.s3_bucket_details[0].tags #=> Array
resp.findings[0].resource.s3_bucket_details[0].tags[0].key #=> String
resp.findings[0].resource.s3_bucket_details[0].tags[0].value #=> String
resp.findings[0].resource.s3_bucket_details[0].default_server_side_encryption.encryption_type #=> String
resp.findings[0].resource.s3_bucket_details[0].default_server_side_encryption.kms_master_key_arn #=> String
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_read_access #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_write_access #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_read_access #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_write_access #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.block_public_access.ignore_public_acls #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.block_public_access.restrict_public_buckets #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_acls #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_policy #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration..block_public_access.ignore_public_acls #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration..block_public_access.restrict_public_buckets #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration..block_public_access.block_public_acls #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.permission_configuration..block_public_access.block_public_policy #=> Boolean
resp.findings[0].resource.s3_bucket_details[0].public_access.effective_permission #=> String
resp.findings[0].resource.instance_details.availability_zone #=> String
resp.findings[0].resource.instance_details.iam_instance_profile.arn #=> String
resp.findings[0].resource.instance_details.iam_instance_profile.id #=> String
resp.findings[0].resource.instance_details.image_description #=> String
resp.findings[0].resource.instance_details.image_id #=> String
resp.findings[0].resource.instance_details.instance_id #=> String
resp.findings[0].resource.instance_details.instance_state #=> String
resp.findings[0].resource.instance_details.instance_type #=> String
resp.findings[0].resource.instance_details.outpost_arn #=> String
resp.findings[0].resource.instance_details.launch_time #=> String
resp.findings[0].resource.instance_details.network_interfaces #=> Array
resp.findings[0].resource.instance_details.network_interfaces[0].ipv_6_addresses #=> Array
resp.findings[0].resource.instance_details.network_interfaces[0].ipv_6_addresses[0] #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].network_interface_id #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].private_dns_name #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].private_ip_address #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].private_ip_addresses #=> Array
resp.findings[0].resource.instance_details.network_interfaces[0].private_ip_addresses[0].private_dns_name #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].private_ip_addresses[0].private_ip_address #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].public_dns_name #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].public_ip #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].security_groups #=> Array
resp.findings[0].resource.instance_details.network_interfaces[0].security_groups[0].group_id #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].security_groups[0].group_name #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].subnet_id #=> String
resp.findings[0].resource.instance_details.network_interfaces[0].vpc_id #=> String
resp.findings[0].resource.instance_details.platform #=> String
resp.findings[0].resource.instance_details.product_codes #=> Array
resp.findings[0].resource.instance_details.product_codes[0].code #=> String
resp.findings[0].resource.instance_details.product_codes[0].product_type #=> String
resp.findings[0].resource.instance_details.tags #=> Array
resp.findings[0].resource.instance_details.tags[0].key #=> String
resp.findings[0].resource.instance_details.tags[0].value #=> String
resp.findings[0].resource.eks_cluster_details.name #=> String
resp.findings[0].resource.eks_cluster_details.arn #=> String
resp.findings[0].resource.eks_cluster_details.vpc_id #=> String
resp.findings[0].resource.eks_cluster_details.status #=> String
resp.findings[0].resource.eks_cluster_details.tags #=> Array
resp.findings[0].resource.eks_cluster_details.tags[0].key #=> String
resp.findings[0].resource.eks_cluster_details.tags[0].value #=> String
resp.findings[0].resource.eks_cluster_details.created_at #=> Time
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.username #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.uid #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.groups #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.groups[0] #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.session_name #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.session_name[0] #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.impersonated_user.username #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.impersonated_user.groups #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_user_details.impersonated_user.groups[0] #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.name #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.type #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.uid #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.namespace #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.host_network #=> Boolean
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].container_runtime #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].id #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].name #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].image #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].image_prefix #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].volume_mounts #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].volume_mounts[0].name #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].volume_mounts[0].mount_path #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].security_context.privileged #=> Boolean
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.containers[0].security_context.allow_privilege_escalation #=> Boolean
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.volumes #=> Array
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.volumes[0].name #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.volumes[0].host_path.path #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details. #=> String
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.host_ipc #=> Boolean
resp.findings[0].resource.kubernetes_details.kubernetes_workload_details.host_pid #=> Boolean
resp.findings[0].resource.resource_type #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details #=> Array
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_arn #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_type #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].device_name #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].volume_size_in_gb #=> Integer
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].encryption_type #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].snapshot_arn #=> String
resp.findings[0].resource.ebs_volume_details.scanned_volume_details[0].kms_key_arn #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details #=> Array
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_arn #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_type #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].device_name #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].volume_size_in_gb #=> Integer
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].encryption_type #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].snapshot_arn #=> String
resp.findings[0].resource.ebs_volume_details.skipped_volume_details[0].kms_key_arn #=> String
resp.findings[0].resource.ecs_cluster_details.name #=> String
resp.findings[0].resource.ecs_cluster_details.arn #=> String
resp.findings[0].resource.ecs_cluster_details.status #=> String
resp.findings[0].resource.ecs_cluster_details.active_services_count #=> Integer
resp.findings[0].resource.ecs_cluster_details.registered_container_instances_count #=> Integer
resp.findings[0].resource.ecs_cluster_details.running_tasks_count #=> Integer
resp.findings[0].resource.ecs_cluster_details.tags #=> Array
resp.findings[0].resource.ecs_cluster_details.tags[0].key #=> String
resp.findings[0].resource.ecs_cluster_details.tags[0].value #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.arn #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.definition_arn #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.version #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.task_created_at #=> Time
resp.findings[0].resource.ecs_cluster_details.task_details.started_at #=> Time
resp.findings[0].resource.ecs_cluster_details.task_details.started_by #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.tags #=> Array
resp.findings[0].resource.ecs_cluster_details.task_details.tags[0].key #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.tags[0].value #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.volumes #=> Array
resp.findings[0].resource.ecs_cluster_details.task_details.volumes[0].name #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.volumes[0].host_path.path #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers #=> Array
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].container_runtime #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].id #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].name #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].image #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].image_prefix #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts #=> Array
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts[0].name #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].volume_mounts[0].mount_path #=> String
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].security_context.privileged #=> Boolean
resp.findings[0].resource.ecs_cluster_details.task_details.containers[0].security_context.allow_privilege_escalation #=> Boolean
resp.findings[0].resource.ecs_cluster_details.task_details.group #=> String
resp.findings[0].resource.container_details.container_runtime #=> String
resp.findings[0].resource.container_details.id #=> String
resp.findings[0].resource.container_details.name #=> String
resp.findings[0].resource.container_details.image #=> String
resp.findings[0].resource.container_details.image_prefix #=> String
resp.findings[0].resource.container_details.volume_mounts #=> Array
resp.findings[0].resource.container_details.volume_mounts[0].name #=> String
resp.findings[0].resource.container_details.volume_mounts[0].mount_path #=> String
resp.findings[0].resource.container_details.security_context.privileged #=> Boolean
resp.findings[0].resource.container_details.security_context.allow_privilege_escalation #=> Boolean
resp.findings[0].resource.rds_db_instance_details.db_instance_identifier #=> String
resp.findings[0].resource.rds_db_instance_details.engine #=> String
resp.findings[0].resource.rds_db_instance_details.engine_version #=> String
resp.findings[0].resource.rds_db_instance_details.db_cluster_identifier #=> String
resp.findings[0].resource.rds_db_instance_details.db_instance_arn #=> String
resp.findings[0].resource.rds_db_instance_details.tags #=> Array
resp.findings[0].resource.rds_db_instance_details.tags[0].key #=> String
resp.findings[0].resource.rds_db_instance_details.tags[0].value #=> String
resp.findings[0].resource.rds_db_user_details.user #=> String
resp.findings[0].resource.rds_db_user_details.application #=> String
resp.findings[0].resource.rds_db_user_details.database #=> String
resp.findings[0].resource.rds_db_user_details.ssl #=> String
resp.findings[0].resource.rds_db_user_details.auth_method #=> String
resp.findings[0].resource.lambda_details.function_arn #=> String
resp.findings[0].resource.lambda_details.function_name #=> String
resp.findings[0].resource.lambda_details.description #=> String
resp.findings[0].resource.lambda_details.last_modified_at #=> Time
resp.findings[0].resource.lambda_details.revision_id #=> String
resp.findings[0].resource.lambda_details.function_version #=> String
resp.findings[0].resource.lambda_details.role #=> String
resp.findings[0].resource.lambda_details.vpc_config.subnet_ids #=> Array
resp.findings[0].resource.lambda_details.vpc_config.subnet_ids[0] #=> String
resp.findings[0].resource.lambda_details.vpc_config.vpc_id #=> String
resp.findings[0].resource.lambda_details.vpc_config.security_groups #=> Array
resp.findings[0].resource.lambda_details.vpc_config.security_groups[0].group_id #=> String
resp.findings[0].resource.lambda_details.vpc_config.security_groups[0].group_name #=> String
resp.findings[0].resource.lambda_details.tags #=> Array
resp.findings[0].resource.lambda_details.tags[0].key #=> String
resp.findings[0].resource.lambda_details.tags[0].value #=> String
resp.findings[0].schema_version #=> String
resp.findings[0].service.action.action_type #=> String
resp.findings[0].service.action.aws_api_call_action.api #=> String
resp.findings[0].service.action.aws_api_call_action.caller_type #=> String
resp.findings[0].service.action.aws_api_call_action.domain_details.domain #=> String
resp.findings[0].service.action.aws_api_call_action.error_code #=> String
resp.findings[0].service.action.aws_api_call_action.user_agent #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.city.city_name #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.country.country_code #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.country.country_name #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.geo_location.lat #=> Float
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.geo_location.lon #=> Float
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.organization.asn #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.organization.asn_org #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.organization.isp #=> String
resp.findings[0].service.action.aws_api_call_action.remote_ip_details.organization.org #=> String
resp.findings[0].service.action.aws_api_call_action.service_name #=> String
resp.findings[0].service.action.aws_api_call_action.. #=> String
resp.findings[0].service.action.aws_api_call_action..affiliated #=> Boolean
resp.findings[0].service.action.aws_api_call_action.affected_resources #=> Hash
resp.findings[0].service.action.aws_api_call_action.affected_resources["String"] #=> String
resp.findings[0].service.action.dns_request_action.domain #=> String
resp.findings[0].service.action.dns_request_action.protocol #=> String
resp.findings[0].service.action.dns_request_action.blocked #=> Boolean
resp.findings[0].service.action.dns_request_action.domain_with_suffix #=> String
resp.findings[0].service.action.network_connection_action.blocked #=> Boolean
resp.findings[0].service.action.network_connection_action.connection_direction #=> String
resp.findings[0].service.action.network_connection_action.local_port_details.port #=> Integer
resp.findings[0].service.action.network_connection_action.local_port_details.port_name #=> String
resp.findings[0].service.action.network_connection_action.protocol #=> String
resp.findings[0].service.action.network_connection_action.local_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.city.city_name #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.country.country_code #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.country.country_name #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.geo_location.lat #=> Float
resp.findings[0].service.action.network_connection_action.remote_ip_details.geo_location.lon #=> Float
resp.findings[0].service.action.network_connection_action.remote_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.organization.asn #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.organization.asn_org #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.organization.isp #=> String
resp.findings[0].service.action.network_connection_action.remote_ip_details.organization.org #=> String
resp.findings[0].service.action.network_connection_action.remote_port_details.port #=> Integer
resp.findings[0].service.action.network_connection_action.remote_port_details.port_name #=> String
resp.findings[0].service.action.port_probe_action.blocked #=> Boolean
resp.findings[0].service.action.port_probe_action.port_probe_details #=> Array
resp.findings[0].service.action.port_probe_action.port_probe_details[0].local_port_details.port #=> Integer
resp.findings[0].service.action.port_probe_action.port_probe_details[0].local_port_details.port_name #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].local_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.city.city_name #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.country.country_code #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.country.country_name #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.geo_location.lat #=> Float
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.geo_location.lon #=> Float
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.organization.asn #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.organization.asn_org #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.organization.isp #=> String
resp.findings[0].service.action.port_probe_action.port_probe_details[0].remote_ip_details.organization.org #=> String
resp.findings[0].service.action.kubernetes_api_call_action.request_uri #=> String
resp.findings[0].service.action.kubernetes_api_call_action.verb #=> String
resp.findings[0].service.action.kubernetes_api_call_action.source_ips #=> Array
resp.findings[0].service.action.kubernetes_api_call_action.source_ips[0] #=> String
resp.findings[0].service.action.kubernetes_api_call_action.user_agent #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.city.city_name #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.country.country_code #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.country.country_name #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.geo_location.lat #=> Float
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.geo_location.lon #=> Float
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.organization.asn #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.organization.asn_org #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.organization.isp #=> String
resp.findings[0].service.action.kubernetes_api_call_action.remote_ip_details.organization.org #=> String
resp.findings[0].service.action.kubernetes_api_call_action.status_code #=> Integer
resp.findings[0].service.action.kubernetes_api_call_action.parameters #=> String
resp.findings[0].service.action.kubernetes_api_call_action.resource #=> String
resp.findings[0].service.action.kubernetes_api_call_action.subresource #=> String
resp.findings[0].service.action.kubernetes_api_call_action.namespace #=> String
resp.findings[0].service.action.kubernetes_api_call_action.resource_name #=> String
resp.findings[0].service.action..remote_ip_details.city.city_name #=> String
resp.findings[0].service.action..remote_ip_details.country.country_code #=> String
resp.findings[0].service.action..remote_ip_details.country.country_name #=> String
resp.findings[0].service.action..remote_ip_details.geo_location.lat #=> Float
resp.findings[0].service.action..remote_ip_details.geo_location.lon #=> Float
resp.findings[0].service.action..remote_ip_details.ip_address_v4 #=> String
resp.findings[0].service.action..remote_ip_details.organization.asn #=> String
resp.findings[0].service.action..remote_ip_details.organization.asn_org #=> String
resp.findings[0].service.action..remote_ip_details.organization.isp #=> String
resp.findings[0].service.action..remote_ip_details.organization.org #=> String
resp.findings[0].service.action.. #=> Array
resp.findings[0].service.action..[0].user #=> String
resp.findings[0].service.action..[0].application #=> String
resp.findings[0].service.action..[0]. #=> Integer
resp.findings[0].service.action..[0]. #=> Integer
resp.findings[0].service.action.kubernetes_permission_checked_details.verb #=> String
resp.findings[0].service.action.kubernetes_permission_checked_details.resource #=> String
resp.findings[0].service.action.kubernetes_permission_checked_details.namespace #=> String
resp.findings[0].service.action.kubernetes_permission_checked_details.allowed #=> Boolean
resp.findings[0].service.action.kubernetes_role_binding_details.kind #=> String
resp.findings[0].service.action.kubernetes_role_binding_details.name #=> String
resp.findings[0].service.action.kubernetes_role_binding_details.uid #=> String
resp.findings[0].service.action.kubernetes_role_binding_details.role_ref_name #=> String
resp.findings[0].service.action.kubernetes_role_binding_details.role_ref_kind #=> String
resp.findings[0].service.action.kubernetes_role_details.kind #=> String
resp.findings[0].service.action.kubernetes_role_details.name #=> String
resp.findings[0].service.action.kubernetes_role_details.uid #=> String
resp.findings[0].service.evidence.threat_intelligence_details #=> Array
resp.findings[0].service.evidence.threat_intelligence_details[0].threat_list_name #=> String
resp.findings[0].service.evidence.threat_intelligence_details[0].threat_names #=> Array
resp.findings[0].service.evidence.threat_intelligence_details[0].threat_names[0] #=> String
resp.findings[0].service.archived #=> Boolean
resp.findings[0].service.count #=> Integer
resp.findings[0].service.detector_id #=> String
resp.findings[0].service.event_first_seen #=> String
resp.findings[0].service.event_last_seen #=> String
resp.findings[0].service.resource_role #=> String
resp.findings[0].service.service_name #=> String
resp.findings[0].service.user_feedback #=> String
resp.findings[0].service.additional_info.value #=> String
resp.findings[0].service.additional_info.type #=> String
resp.findings[0].service.feature_name #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_id #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_started_at #=> Time
resp.findings[0].service.ebs_volume_scan_details.scan_completed_at #=> Time
resp.findings[0].service.ebs_volume_scan_details.trigger_finding_id #=> String
resp.findings[0].service.ebs_volume_scan_details.sources #=> Array
resp.findings[0].service.ebs_volume_scan_details.sources[0] #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.total_gb #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.files #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.scanned_item_count.volumes #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threats_detected_item_count.files #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.severity #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.threat_name #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.highest_severity_threat_details.count #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.item_count #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.unique_threat_name_count #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.shortened #=> Boolean
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names #=> Array
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].name #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].severity #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].item_count #=> Integer
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths #=> Array
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].file_path #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].volume_arn #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].hash #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_detections.threat_detected_by_name.threat_names[0].file_paths[0].file_name #=> String
resp.findings[0].service.ebs_volume_scan_details.scan_type #=> String, one of "GUARDDUTY_INITIATED", "ON_DEMAND"
resp.findings[0].service.runtime_details.process.name #=> String
resp.findings[0].service.runtime_details.process.executable_path #=> String
resp.findings[0].service.runtime_details.process.executable_sha_256 #=> String
resp.findings[0].service.runtime_details.process.namespace_pid #=> Integer
resp.findings[0].service.runtime_details.process.pwd #=> String
resp.findings[0].service.runtime_details.process.pid #=> Integer
resp.findings[0].service.runtime_details.process.start_time #=> Time
resp.findings[0].service.runtime_details.process.uuid #=> String
resp.findings[0].service.runtime_details.process.parent_uuid #=> String
resp.findings[0].service.runtime_details.process.user #=> String
resp.findings[0].service.runtime_details.process.user_id #=> Integer
resp.findings[0].service.runtime_details.process.euid #=> Integer
resp.findings[0].service.runtime_details.process.lineage #=> Array
resp.findings[0].service.runtime_details.process.lineage[0].start_time #=> Time
resp.findings[0].service.runtime_details.process.lineage[0].namespace_pid #=> Integer
resp.findings[0].service.runtime_details.process.lineage[0].user_id #=> Integer
resp.findings[0].service.runtime_details.process.lineage[0].name #=> String
resp.findings[0].service.runtime_details.process.lineage[0].pid #=> Integer
resp.findings[0].service.runtime_details.process.lineage[0].uuid #=> String
resp.findings[0].service.runtime_details.process.lineage[0].executable_path #=> String
resp.findings[0].service.runtime_details.process.lineage[0].euid #=> Integer
resp.findings[0].service.runtime_details.process.lineage[0].parent_uuid #=> String
resp.findings[0].service.runtime_details.context.modifying_process.name #=> String
resp.findings[0].service.runtime_details.context.modifying_process.executable_path #=> String
resp.findings[0].service.runtime_details.context.modifying_process.executable_sha_256 #=> String
resp.findings[0].service.runtime_details.context.modifying_process.namespace_pid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.pwd #=> String
resp.findings[0].service.runtime_details.context.modifying_process.pid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.start_time #=> Time
resp.findings[0].service.runtime_details.context.modifying_process.uuid #=> String
resp.findings[0].service.runtime_details.context.modifying_process.parent_uuid #=> String
resp.findings[0].service.runtime_details.context.modifying_process.user #=> String
resp.findings[0].service.runtime_details.context.modifying_process.user_id #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.euid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.lineage #=> Array
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].start_time #=> Time
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].namespace_pid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].user_id #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].name #=> String
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].pid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].uuid #=> String
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].executable_path #=> String
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].euid #=> Integer
resp.findings[0].service.runtime_details.context.modifying_process.lineage[0].parent_uuid #=> String
resp.findings[0].service.runtime_details.context.modified_at #=> Time
resp.findings[0].service.runtime_details.context.script_path #=> String
resp.findings[0].service.runtime_details.context.library_path #=> String
resp.findings[0].service.runtime_details.context.ld_preload_value #=> String
resp.findings[0].service.runtime_details.context.socket_path #=> String
resp.findings[0].service.runtime_details.context.runc_binary_path #=> String
resp.findings[0].service.runtime_details.context.release_agent_path #=> String
resp.findings[0].service.runtime_details.context.mount_source #=> String
resp.findings[0].service.runtime_details.context.mount_target #=> String
resp.findings[0].service.runtime_details.context.file_system_type #=> String
resp.findings[0].service.runtime_details.context.flags #=> Array
resp.findings[0].service.runtime_details.context.flags[0] #=> String
resp.findings[0].service.runtime_details.context.module_name #=> String
resp.findings[0].service.runtime_details.context.module_file_path #=> String
resp.findings[0].service.runtime_details.context.module_sha_256 #=> String
resp.findings[0].service.runtime_details.context.shell_history_file_path #=> String
resp.findings[0].service.runtime_details.context.target_process.name #=> String
resp.findings[0].service.runtime_details.context.target_process.executable_path #=> String
resp.findings[0].service.runtime_details.context.target_process.executable_sha_256 #=> String
resp.findings[0].service.runtime_details.context.target_process.namespace_pid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.pwd #=> String
resp.findings[0].service.runtime_details.context.target_process.pid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.start_time #=> Time
resp.findings[0].service.runtime_details.context.target_process.uuid #=> String
resp.findings[0].service.runtime_details.context.target_process.parent_uuid #=> String
resp.findings[0].service.runtime_details.context.target_process.user #=> String
resp.findings[0].service.runtime_details.context.target_process.user_id #=> Integer
resp.findings[0].service.runtime_details.context.target_process.euid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.lineage #=> Array
resp.findings[0].service.runtime_details.context.target_process.lineage[0].start_time #=> Time
resp.findings[0].service.runtime_details.context.target_process.lineage[0].namespace_pid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.lineage[0].user_id #=> Integer
resp.findings[0].service.runtime_details.context.target_process.lineage[0].name #=> String
resp.findings[0].service.runtime_details.context.target_process.lineage[0].pid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.lineage[0].uuid #=> String
resp.findings[0].service.runtime_details.context.target_process.lineage[0].executable_path #=> String
resp.findings[0].service.runtime_details.context.target_process.lineage[0].euid #=> Integer
resp.findings[0].service.runtime_details.context.target_process.lineage[0].parent_uuid #=> String
resp.findings[0].service.runtime_details.context.address_family #=> String
resp.findings[0].service.runtime_details.context.iana_protocol_number #=> Integer
resp.findings[0].service.runtime_details.context.memory_regions #=> Array
resp.findings[0].service.runtime_details.context.memory_regions[0] #=> String
resp.findings[0].service.detection.anomaly.profiles #=> Hash
resp.findings[0].service.detection.anomaly.profiles["String"] #=> Hash
resp.findings[0].service.detection.anomaly.profiles["String"]["String"] #=> Array
resp.findings[0].service.detection.anomaly.profiles["String"]["String"][0].profile_type #=> String, one of "FREQUENCY"
resp.findings[0].service.detection.anomaly.profiles["String"]["String"][0].profile_subtype #=> String, one of "FREQUENT", "INFREQUENT", "UNSEEN", "RARE"
resp.findings[0].service.detection.anomaly.profiles["String"]["String"][0].observations.text #=> Array
resp.findings[0].service.detection.anomaly.profiles["String"]["String"][0].observations.text[0] #=> String
resp.findings[0].service.detection.anomaly.unusual.behavior #=> Hash
resp.findings[0].service.detection.anomaly.unusual.behavior["String"] #=> Hash
resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].profile_type #=> String, one of "FREQUENCY"
resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].profile_subtype #=> String, one of "FREQUENT", "INFREQUENT", "UNSEEN", "RARE"
resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].observations.text #=> Array
resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].observations.text[0] #=> String
resp.findings[0].severity #=> Float
resp.findings[0].title #=> String
resp.findings[0].type #=> String
resp.findings[0].updated_at #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.

  • :finding_ids (required, Array<String>)

    The IDs of the findings that you want to retrieve.

  • :sort_criteria (Types::SortCriteria)

    Represents the criteria used for sorting findings.

Returns:

See Also:



2537
2538
2539
2540
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2537

def get_findings(params = {}, options = {})
  req = build_request(:get_findings, params)
  req.send_request(options)
end

#get_findings_statistics(params = {}) ⇒ Types::GetFindingsStatisticsResponse

Lists Amazon GuardDuty findings statistics for the specified detector ID.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.get_findings_statistics({
  detector_id: "DetectorId", # required
  finding_statistic_types: ["COUNT_BY_SEVERITY"], # required, accepts COUNT_BY_SEVERITY
  finding_criteria: {
    criterion: {
      "String" => {
        eq: ["String"],
        neq: ["String"],
        gt: 1,
        gte: 1,
        lt: 1,
        lte: 1,
        equals: ["String"],
        not_equals: ["String"],
        greater_than: 1,
        greater_than_or_equal: 1,
        less_than: 1,
        less_than_or_equal: 1,
      },
    },
  },
})

Response structure


resp.finding_statistics.count_by_severity #=> Hash
resp.finding_statistics.count_by_severity["String"] #=> Integer

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that specifies the GuardDuty service whose findings' statistics you want to retrieve.

  • :finding_statistic_types (required, Array<String>)

    The types of finding statistics to retrieve.

  • :finding_criteria (Types::FindingCriteria)

    Represents the criteria that is used for querying findings.

Returns:

See Also:



2601
2602
2603
2604
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2601

def get_findings_statistics(params = {}, options = {})
  req = build_request(:get_findings_statistics, params)
  req.send_request(options)
end

#get_invitations_count(params = {}) ⇒ Types::GetInvitationsCountResponse

Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.

Examples:

Response structure


resp.invitations_count #=> Integer

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Returns:

See Also:



2663
2664
2665
2666
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2663

def get_invitations_count(params = {}, options = {})
  req = build_request(:get_invitations_count, params)
  req.send_request(options)
end

#get_ip_set(params = {}) ⇒ Types::GetIPSetResponse

Retrieves the IPSet specified by the ipSetId.

Examples:

Request syntax with placeholder values


resp = client.get_ip_set({
  detector_id: "DetectorId", # required
  ip_set_id: "String", # required
})

Response structure


resp.name #=> String
resp.format #=> String, one of "TXT", "STIX", "OTX_CSV", "ALIEN_VAULT", "PROOF_POINT", "FIRE_EYE"
resp.location #=> String
resp.status #=> String, one of "INACTIVE", "ACTIVATING", "ACTIVE", "DEACTIVATING", "ERROR", "DELETE_PENDING", "DELETED"
resp.tags #=> Hash
resp.tags["TagKey"] #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the IPSet is associated with.

  • :ip_set_id (required, String)

    The unique ID of the IPSet to retrieve.

Returns:

See Also:



2642
2643
2644
2645
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2642

def get_ip_set(params = {}, options = {})
  req = build_request(:get_ip_set, params)
  req.send_request(options)
end

#get_malware_scan_settings(params = {}) ⇒ Types::GetMalwareScanSettingsResponse

Returns the details of the malware scan settings.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.get_malware_scan_settings({
  detector_id: "DetectorId", # required
})

Response structure


resp.scan_resource_criteria.include #=> Hash
resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals #=> Array
resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals[0].key #=> String
resp.scan_resource_criteria.include["ScanCriterionKey"].map_equals[0].value #=> String
resp.scan_resource_criteria.exclude #=> Hash
resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals #=> Array
resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals[0].key #=> String
resp.scan_resource_criteria.exclude["ScanCriterionKey"].map_equals[0].value #=> String
resp.ebs_snapshot_preservation #=> String, one of "NO_RETENTION", "RETENTION_WITH_FINDING"

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the scan setting is associated with.

Returns:

See Also:



2710
2711
2712
2713
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2710

def get_malware_scan_settings(params = {}, options = {})
  req = build_request(:get_malware_scan_settings, params)
  req.send_request(options)
end

#get_master_account(params = {}) ⇒ Types::GetMasterAccountResponse

Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.

Examples:

Request syntax with placeholder values


resp = client.({
  detector_id: "DetectorId", # required
})

Response structure


resp.master. #=> String
resp.master.invitation_id #=> String
resp.master.relationship_status #=> String
resp.master.invited_at #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

Returns:

See Also:



2742
2743
2744
2745
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2742

def (params = {}, options = {})
  req = build_request(:get_master_account, params)
  req.send_request(options)
end

#get_member_detectors(params = {}) ⇒ Types::GetMemberDetectorsResponse

Describes which data sources are enabled for the member account's detector.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.get_member_detectors({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.member_data_source_configurations #=> Array
resp.member_data_source_configurations[0]. #=> String
resp.member_data_source_configurations[0].data_sources.cloud_trail.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.dns_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.flow_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.s3_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.kubernetes.audit_logs.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.reason #=> String
resp.member_data_source_configurations[0].data_sources.malware_protection.service_role #=> String
resp.member_data_source_configurations[0].features #=> Array
resp.member_data_source_configurations[0].features[0].name #=> String, one of "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"
resp.member_data_source_configurations[0].features[0].status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].features[0].updated_at #=> Time
resp.member_data_source_configurations[0].features[0].additional_configuration #=> Array
resp.member_data_source_configurations[0].features[0].additional_configuration[0].name #=> String, one of "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT"
resp.member_data_source_configurations[0].features[0].additional_configuration[0].status #=> String, one of "ENABLED", "DISABLED"
resp.member_data_source_configurations[0].features[0].additional_configuration[0].updated_at #=> Time
resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The detector ID for the administrator account.

  • :account_ids (required, Array<String>)

    The account ID of the member account.

Returns:

See Also:



2805
2806
2807
2808
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2805

def get_member_detectors(params = {}, options = {})
  req = build_request(:get_member_detectors, params)
  req.send_request(options)
end

#get_members(params = {}) ⇒ Types::GetMembersResponse

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Examples:

Request syntax with placeholder values


resp = client.get_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.members #=> Array
resp.members[0]. #=> String
resp.members[0].detector_id #=> String
resp.members[0].master_id #=> String
resp.members[0].email #=> String
resp.members[0].relationship_status #=> String
resp.members[0].invited_at #=> String
resp.members[0].updated_at #=> String
resp.members[0].administrator_id #=> String
resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account whose members you want to retrieve.

  • :account_ids (required, Array<String>)

    A list of account IDs of the GuardDuty member accounts that you want to describe.

Returns:

See Also:



2852
2853
2854
2855
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2852

def get_members(params = {}, options = {})
  req = build_request(:get_members, params)
  req.send_request(options)
end

#get_organization_statistics(params = {}) ⇒ Types::GetOrganizationStatisticsResponse

Retrieves how many active member accounts have each feature enabled within GuardDuty. Only a delegated GuardDuty administrator of an organization can run this API.

When you create a new organization, it might take up to 24 hours to generate the statistics for the entire organization.

Examples:

Response structure


resp.organization_details.updated_at #=> Time
resp.organization_details.organization_statistics.total_accounts_count #=> Integer
resp.organization_details.organization_statistics.member_accounts_count #=> Integer
resp.organization_details.organization_statistics.active_accounts_count #=> Integer
resp.organization_details.organization_statistics.enabled_accounts_count #=> Integer
resp.organization_details.organization_statistics.count_by_feature #=> Array
resp.organization_details.organization_statistics.count_by_feature[0].name #=> String, one of "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING"
resp.organization_details.organization_statistics.count_by_feature[0].enabled_accounts_count #=> Integer
resp.organization_details.organization_statistics.count_by_feature[0].additional_configuration #=> Array
resp.organization_details.organization_statistics.count_by_feature[0].additional_configuration[0].name #=> String, one of "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT"
resp.organization_details.organization_statistics.count_by_feature[0].additional_configuration[0].enabled_accounts_count #=> Integer

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Returns:

See Also:



2886
2887
2888
2889
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2886

def get_organization_statistics(params = {}, options = {})
  req = build_request(:get_organization_statistics, params)
  req.send_request(options)
end

#get_remaining_free_trial_days(params = {}) ⇒ Types::GetRemainingFreeTrialDaysResponse

Provides the number of days left for each data source used in the free trial period.

Examples:

Request syntax with placeholder values


resp = client.get_remaining_free_trial_days({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"],
})

Response structure


resp.accounts #=> Array
resp.accounts[0]. #=> String
resp.accounts[0].data_sources.cloud_trail.free_trial_days_remaining #=> Integer
resp.accounts[0].data_sources.dns_logs.free_trial_days_remaining #=> Integer
resp.accounts[0].data_sources.flow_logs.free_trial_days_remaining #=> Integer
resp.accounts[0].data_sources.s3_logs.free_trial_days_remaining #=> Integer
resp.accounts[0].data_sources.kubernetes.audit_logs.free_trial_days_remaining #=> Integer
resp.accounts[0].data_sources.malware_protection.scan_ec2_instance_with_findings.free_trial_days_remaining #=> Integer
resp.accounts[0].features #=> Array
resp.accounts[0].features[0].name #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "FARGATE_RUNTIME_MONITORING", "EC2_RUNTIME_MONITORING"
resp.accounts[0].features[0].free_trial_days_remaining #=> Integer
resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty member account.

  • :account_ids (Array<String>)

    A list of account identifiers of the GuardDuty member account.

Returns:

See Also:



2933
2934
2935
2936
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2933

def get_remaining_free_trial_days(params = {}, options = {})
  req = build_request(:get_remaining_free_trial_days, params)
  req.send_request(options)
end

#get_threat_intel_set(params = {}) ⇒ Types::GetThreatIntelSetResponse

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Examples:

Request syntax with placeholder values


resp = client.get_threat_intel_set({
  detector_id: "DetectorId", # required
  threat_intel_set_id: "String", # required
})

Response structure


resp.name #=> String
resp.format #=> String, one of "TXT", "STIX", "OTX_CSV", "ALIEN_VAULT", "PROOF_POINT", "FIRE_EYE"
resp.location #=> String
resp.status #=> String, one of "INACTIVE", "ACTIVATING", "ACTIVE", "DEACTIVATING", "ERROR", "DELETE_PENDING", "DELETED"
resp.tags #=> Hash
resp.tags["TagKey"] #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the threatIntelSet is associated with.

  • :threat_intel_set_id (required, String)

    The unique ID of the threatIntelSet that you want to get.

Returns:

See Also:



2976
2977
2978
2979
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 2976

def get_threat_intel_set(params = {}, options = {})
  req = build_request(:get_threat_intel_set, params)
  req.send_request(options)
end

#get_usage_statistics(params = {}) ⇒ Types::GetUsageStatisticsResponse

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.get_usage_statistics({
  detector_id: "DetectorId", # required
  usage_statistic_type: "SUM_BY_ACCOUNT", # required, accepts SUM_BY_ACCOUNT, SUM_BY_DATA_SOURCE, SUM_BY_RESOURCE, TOP_RESOURCES, SUM_BY_FEATURES, TOP_ACCOUNTS_BY_FEATURE
  usage_criteria: { # required
    account_ids: ["AccountId"],
    data_sources: ["FLOW_LOGS"], # accepts FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_LOGS, KUBERNETES_AUDIT_LOGS, EC2_MALWARE_SCAN
    resources: ["String"],
    features: ["FLOW_LOGS"], # accepts FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, LAMBDA_NETWORK_LOGS, EKS_RUNTIME_MONITORING, FARGATE_RUNTIME_MONITORING, EC2_RUNTIME_MONITORING, RDS_DBI_PROTECTION_PROVISIONED, RDS_DBI_PROTECTION_SERVERLESS
  },
  unit: "String",
  max_results: 1,
  next_token: "String",
})

Response structure


resp.usage_statistics. #=> Array
resp.usage_statistics.[0]. #=> String
resp.usage_statistics.[0].total.amount #=> String
resp.usage_statistics.[0].total.unit #=> String
resp.usage_statistics.top_accounts_by_feature #=> Array
resp.usage_statistics.top_accounts_by_feature[0].feature #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "LAMBDA_NETWORK_LOGS", "EKS_RUNTIME_MONITORING", "FARGATE_RUNTIME_MONITORING", "EC2_RUNTIME_MONITORING", "RDS_DBI_PROTECTION_PROVISIONED", "RDS_DBI_PROTECTION_SERVERLESS"
resp.usage_statistics.top_accounts_by_feature[0].accounts #=> Array
resp.usage_statistics.top_accounts_by_feature[0].accounts[0]. #=> String
resp.usage_statistics.top_accounts_by_feature[0].accounts[0].total.amount #=> String
resp.usage_statistics.top_accounts_by_feature[0].accounts[0].total.unit #=> String
resp.usage_statistics.sum_by_data_source #=> Array
resp.usage_statistics.sum_by_data_source[0].data_source #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_LOGS", "KUBERNETES_AUDIT_LOGS", "EC2_MALWARE_SCAN"
resp.usage_statistics.sum_by_data_source[0].total.amount #=> String
resp.usage_statistics.sum_by_data_source[0].total.unit #=> String
resp.usage_statistics.sum_by_resource #=> Array
resp.usage_statistics.sum_by_resource[0].resource #=> String
resp.usage_statistics.sum_by_resource[0].total.amount #=> String
resp.usage_statistics.sum_by_resource[0].total.unit #=> String
resp.usage_statistics.top_resources #=> Array
resp.usage_statistics.top_resources[0].resource #=> String
resp.usage_statistics.top_resources[0].total.amount #=> String
resp.usage_statistics.top_resources[0].total.unit #=> String
resp.usage_statistics.sum_by_feature #=> Array
resp.usage_statistics.sum_by_feature[0].feature #=> String, one of "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "LAMBDA_NETWORK_LOGS", "EKS_RUNTIME_MONITORING", "FARGATE_RUNTIME_MONITORING", "EC2_RUNTIME_MONITORING", "RDS_DBI_PROTECTION_PROVISIONED", "RDS_DBI_PROTECTION_SERVERLESS"
resp.usage_statistics.sum_by_feature[0].total.amount #=> String
resp.usage_statistics.sum_by_feature[0].total.unit #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that specifies the GuardDuty service whose usage statistics you want to retrieve.

  • :usage_statistic_type (required, String)

    The type of usage statistics to retrieve.

  • :usage_criteria (required, Types::UsageCriteria)

    Represents the criteria used for querying usage.

  • :unit (String)

    The currency unit you would like to view your usage statistics in. Current valid values are USD.

  • :max_results (Integer)

    The maximum number of results to return in the response.

  • :next_token (String)

    A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

Returns:

See Also:



3073
3074
3075
3076
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3073

def get_usage_statistics(params = {}, options = {})
  req = build_request(:get_usage_statistics, params)
  req.send_request(options)
end

#invite_members(params = {}) ⇒ Types::InviteMembersResponse

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations.

To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation.

After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers.

Examples:

Request syntax with placeholder values


resp = client.invite_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
  disable_email_notification: false,
  message: "String",
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty account that you want to invite members with.

  • :account_ids (required, Array<String>)

    A list of account IDs of the accounts that you want to invite to GuardDuty as members.

  • :disable_email_notification (Boolean)

    A Boolean value that specifies whether you want to disable email notification to the accounts that you are inviting to GuardDuty as members.

  • :message (String)

    The invitation message that you want to send to the accounts that you're inviting to GuardDuty as members.

Returns:

See Also:



3150
3151
3152
3153
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3150

def invite_members(params = {}, options = {})
  req = build_request(:invite_members, params)
  req.send_request(options)
end

#list_coverage(params = {}) ⇒ Types::ListCoverageResponse

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization.

Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_coverage({
  detector_id: "DetectorId", # required
  next_token: "String",
  max_results: 1,
  filter_criteria: {
    filter_criterion: [
      {
        criterion_key: "ACCOUNT_ID", # accepts ACCOUNT_ID, CLUSTER_NAME, RESOURCE_TYPE, COVERAGE_STATUS, ADDON_VERSION, MANAGEMENT_TYPE, EKS_CLUSTER_NAME, ECS_CLUSTER_NAME, AGENT_VERSION, INSTANCE_ID, CLUSTER_ARN
        filter_condition: {
          equals: ["String"],
          not_equals: ["String"],
        },
      },
    ],
  },
  sort_criteria: {
    attribute_name: "ACCOUNT_ID", # accepts ACCOUNT_ID, CLUSTER_NAME, COVERAGE_STATUS, ISSUE, ADDON_VERSION, UPDATED_AT, EKS_CLUSTER_NAME, ECS_CLUSTER_NAME, INSTANCE_ID
    order_by: "ASC", # accepts ASC, DESC
  },
})

Response structure


resp.resources #=> Array
resp.resources[0].resource_id #=> String
resp.resources[0].detector_id #=> String
resp.resources[0]. #=> String
resp.resources[0].resource_details.eks_cluster_details.cluster_name #=> String
resp.resources[0].resource_details.eks_cluster_details.covered_nodes #=> Integer
resp.resources[0].resource_details.eks_cluster_details.compatible_nodes #=> Integer
resp.resources[0].resource_details.eks_cluster_details.addon_details.addon_version #=> String
resp.resources[0].resource_details.eks_cluster_details.addon_details.addon_status #=> String
resp.resources[0].resource_details.eks_cluster_details.management_type #=> String, one of "AUTO_MANAGED", "MANUAL", "DISABLED"
resp.resources[0].resource_details.resource_type #=> String, one of "EKS", "ECS", "EC2"
resp.resources[0].resource_details.ecs_cluster_details.cluster_name #=> String
resp.resources[0].resource_details.ecs_cluster_details.fargate_details.issues #=> Array
resp.resources[0].resource_details.ecs_cluster_details.fargate_details.issues[0] #=> String
resp.resources[0].resource_details.ecs_cluster_details.fargate_details.management_type #=> String, one of "AUTO_MANAGED", "MANUAL", "DISABLED"
resp.resources[0].resource_details.ecs_cluster_details.container_instance_details.covered_container_instances #=> Integer
resp.resources[0].resource_details.ecs_cluster_details.container_instance_details.compatible_container_instances #=> Integer
resp.resources[0].resource_details.ec2_instance_details.instance_id #=> String
resp.resources[0].resource_details.ec2_instance_details.instance_type #=> String
resp.resources[0].resource_details.ec2_instance_details.cluster_arn #=> String
resp.resources[0].resource_details.ec2_instance_details.agent_details.version #=> String
resp.resources[0].resource_details.ec2_instance_details.management_type #=> String, one of "AUTO_MANAGED", "MANUAL", "DISABLED"
resp.resources[0].coverage_status #=> String, one of "HEALTHY", "UNHEALTHY"
resp.resources[0].issue #=> String
resp.resources[0].updated_at #=> Time
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector whose coverage details you want to retrieve.

  • :next_token (String)

    A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

  • :max_results (Integer)

    The maximum number of results to return in the response.

  • :filter_criteria (Types::CoverageFilterCriteria)

    Represents the criteria used to filter the coverage details.

  • :sort_criteria (Types::CoverageSortCriteria)

    Represents the criteria used to sort the coverage details.

Returns:

See Also:



3245
3246
3247
3248
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3245

def list_coverage(params = {}, options = {})
  req = build_request(:list_coverage, params)
  req.send_request(options)
end

#list_detectors(params = {}) ⇒ Types::ListDetectorsResponse

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_detectors({
  max_results: 1,
  next_token: "String",
})

Response structure


resp.detector_ids #=> Array
resp.detector_ids[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3289
3290
3291
3292
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3289

def list_detectors(params = {}, options = {})
  req = build_request(:list_detectors, params)
  req.send_request(options)
end

#list_filters(params = {}) ⇒ Types::ListFiltersResponse

Returns a paginated list of the current filters.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_filters({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
})

Response structure


resp.filter_names #=> Array
resp.filter_names[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the filter is associated with.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3336
3337
3338
3339
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3336

def list_filters(params = {}, options = {})
  req = build_request(:list_filters, params)
  req.send_request(options)
end

#list_findings(params = {}) ⇒ Types::ListFindingsResponse

Lists GuardDuty findings for the specified detector ID.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_findings({
  detector_id: "DetectorId", # required
  finding_criteria: {
    criterion: {
      "String" => {
        eq: ["String"],
        neq: ["String"],
        gt: 1,
        gte: 1,
        lt: 1,
        lte: 1,
        equals: ["String"],
        not_equals: ["String"],
        greater_than: 1,
        greater_than_or_equal: 1,
        less_than: 1,
        less_than_or_equal: 1,
      },
    },
  },
  sort_criteria: {
    attribute_name: "String",
    order_by: "ASC", # accepts ASC, DESC
  },
  max_results: 1,
  next_token: "String",
})

Response structure


resp.finding_ids #=> Array
resp.finding_ids[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that specifies the GuardDuty service whose findings you want to list.

  • :finding_criteria (Types::FindingCriteria)

    Represents the criteria used for querying findings. Valid values include:

    • JSON field name

    • accountId

    • region

    • confidence

    • id

    • resource.accessKeyDetails.accessKeyId

    • resource.accessKeyDetails.principalId

    • resource.accessKeyDetails.userName

    • resource.accessKeyDetails.userType

    • resource.instanceDetails.iamInstanceProfile.id

    • resource.instanceDetails.imageId

    • resource.instanceDetails.instanceId

    • resource.instanceDetails.networkInterfaces.ipv6Addresses

    • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress

    • resource.instanceDetails.networkInterfaces.publicDnsName

    • resource.instanceDetails.networkInterfaces.publicIp

    • resource.instanceDetails.networkInterfaces.securityGroups.groupId

    • resource.instanceDetails.networkInterfaces.securityGroups.groupName

    • resource.instanceDetails.networkInterfaces.subnetId

    • resource.instanceDetails.networkInterfaces.vpcId

    • resource.instanceDetails.tags.key

    • resource.instanceDetails.tags.value

    • resource.resourceType

    • service.action.actionType

    • service.action.awsApiCallAction.api

    • service.action.awsApiCallAction.callerType

    • service.action.awsApiCallAction.remoteIpDetails.city.cityName

    • service.action.awsApiCallAction.remoteIpDetails.country.countryName

    • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4

    • service.action.awsApiCallAction.remoteIpDetails.organization.asn

    • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg

    • service.action.awsApiCallAction.serviceName

    • service.action.dnsRequestAction.domain

    • service.action.dnsRequestAction.domainWithSuffix

    • service.action.networkConnectionAction.blocked

    • service.action.networkConnectionAction.connectionDirection

    • service.action.networkConnectionAction.localPortDetails.port

    • service.action.networkConnectionAction.protocol

    • service.action.networkConnectionAction.remoteIpDetails.country.countryName

    • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4

    • service.action.networkConnectionAction.remoteIpDetails.organization.asn

    • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg

    • service.action.networkConnectionAction.remotePortDetails.port

    • service.additionalInfo.threatListName

    • service.archived

      When this attribute is set to 'true', only archived findings are listed. When it's set to 'false', only unarchived findings are listed. When this attribute is not set, all existing findings are listed.

    • service.resourceRole

    • severity

    • type

    • updatedAt

      Type: Timestamp in Unix Epoch millisecond format: 1486685375000

  • :sort_criteria (Types::SortCriteria)

    Represents the criteria used for sorting findings.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3526
3527
3528
3529
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3526

def list_findings(params = {}, options = {})
  req = build_request(:list_findings, params)
  req.send_request(options)
end

#list_invitations(params = {}) ⇒ Types::ListInvitationsResponse

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_invitations({
  max_results: 1,
  next_token: "String",
})

Response structure


resp.invitations #=> Array
resp.invitations[0]. #=> String
resp.invitations[0].invitation_id #=> String
resp.invitations[0].relationship_status #=> String
resp.invitations[0].invited_at #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3622
3623
3624
3625
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3622

def list_invitations(params = {}, options = {})
  req = build_request(:list_invitations, params)
  req.send_request(options)
end

#list_ip_sets(params = {}) ⇒ Types::ListIPSetsResponse

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_ip_sets({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
})

Response structure


resp.ip_set_ids #=> Array
resp.ip_set_ids[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the IPSet is associated with.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3575
3576
3577
3578
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3575

def list_ip_sets(params = {}, options = {})
  req = build_request(:list_ip_sets, params)
  req.send_request(options)
end

#list_members(params = {}) ⇒ Types::ListMembersResponse

Lists details about all member accounts for the current GuardDuty administrator account.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_members({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
  only_associated: "String",
})

Response structure


resp.members #=> Array
resp.members[0]. #=> String
resp.members[0].detector_id #=> String
resp.members[0].master_id #=> String
resp.members[0].email #=> String
resp.members[0].relationship_status #=> String
resp.members[0].invited_at #=> String
resp.members[0].updated_at #=> String
resp.members[0].administrator_id #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector the member is associated with.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

  • :only_associated (String)

    Specifies whether to only return associated members or to return all members (including members who haven't been invited yet or have been disassociated). Member accounts must have been previously associated with the GuardDuty administrator account using Create Members .

Returns:

See Also:



3689
3690
3691
3692
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3689

def list_members(params = {}, options = {})
  req = build_request(:list_members, params)
  req.send_request(options)
end

#list_organization_admin_accounts(params = {}) ⇒ Types::ListOrganizationAdminAccountsResponse

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_organization_admin_accounts({
  max_results: 1,
  next_token: "String",
})

Response structure


resp.admin_accounts #=> Array
resp.admin_accounts[0]. #=> String
resp.admin_accounts[0].admin_status #=> String, one of "ENABLED", "DISABLE_IN_PROGRESS"
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :max_results (Integer)

    The maximum number of results to return in the response.

  • :next_token (String)

    A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

Returns:

See Also:



3733
3734
3735
3736
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3733

def list_organization_admin_accounts(params = {}, options = {})
  req = build_request(:list_organization_admin_accounts, params)
  req.send_request(options)
end

#list_publishing_destinations(params = {}) ⇒ Types::ListPublishingDestinationsResponse

Returns a list of publishing destinations associated with the specified detectorId.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_publishing_destinations({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
})

Response structure


resp.destinations #=> Array
resp.destinations[0].destination_id #=> String
resp.destinations[0].destination_type #=> String, one of "S3"
resp.destinations[0].status #=> String, one of "PENDING_VERIFICATION", "PUBLISHING", "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY", "STOPPED"
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector to retrieve publishing destinations for.

  • :max_results (Integer)

    The maximum number of results to return in the response.

  • :next_token (String)

    A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

Returns:

See Also:



3781
3782
3783
3784
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3781

def list_publishing_destinations(params = {}, options = {})
  req = build_request(:list_publishing_destinations, params)
  req.send_request(options)
end

#list_tags_for_resource(params = {}) ⇒ Types::ListTagsForResourceResponse

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Examples:

Request syntax with placeholder values


resp = client.list_tags_for_resource({
  resource_arn: "GuardDutyArn", # required
})

Response structure


resp.tags #=> Hash
resp.tags["TagKey"] #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :resource_arn (required, String)

    The Amazon Resource Name (ARN) for the given GuardDuty resource.

Returns:

See Also:



3813
3814
3815
3816
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3813

def list_tags_for_resource(params = {}, options = {})
  req = build_request(:list_tags_for_resource, params)
  req.send_request(options)
end

#list_threat_intel_sets(params = {}) ⇒ Types::ListThreatIntelSetsResponse

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

The returned response is a pageable response and is Enumerable. For details on usage see PageableResponse.

Examples:

Request syntax with placeholder values


resp = client.list_threat_intel_sets({
  detector_id: "DetectorId", # required
  max_results: 1,
  next_token: "String",
})

Response structure


resp.threat_intel_set_ids #=> Array
resp.threat_intel_set_ids[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that the threatIntelSet is associated with.

  • :max_results (Integer)

    You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

  • :next_token (String)

    You can use this parameter to paginate results in the response. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Returns:

See Also:



3864
3865
3866
3867
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3864

def list_threat_intel_sets(params = {}, options = {})
  req = build_request(:list_threat_intel_sets, params)
  req.send_request(options)
end

#start_malware_scan(params = {}) ⇒ Types::StartMalwareScanResponse

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account.

When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see DescribeMalwareScans.

Examples:

Request syntax with placeholder values


resp = client.start_malware_scan({
  resource_arn: "ResourceArn", # required
})

Response structure


resp.scan_id #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :resource_arn (required, String)

    Amazon Resource Name (ARN) of the resource for which you invoked the API.

Returns:

See Also:



3903
3904
3905
3906
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3903

def start_malware_scan(params = {}, options = {})
  req = build_request(:start_malware_scan, params)
  req.send_request(options)
end

#start_monitoring_members(params = {}) ⇒ Types::StartMonitoringMembersResponse

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Examples:

Request syntax with placeholder values


resp = client.start_monitoring_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector of the GuardDuty administrator account associated with the member accounts to monitor.

  • :account_ids (required, Array<String>)

    A list of account IDs of the GuardDuty member accounts to start monitoring.

Returns:

See Also:



3945
3946
3947
3948
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3945

def start_monitoring_members(params = {}, options = {})
  req = build_request(:start_monitoring_members, params)
  req.send_request(options)
end

#stop_monitoring_members(params = {}) ⇒ Types::StopMonitoringMembersResponse

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Examples:

Request syntax with placeholder values


resp = client.stop_monitoring_members({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector associated with the GuardDuty administrator account that is monitoring member accounts.

  • :account_ids (required, Array<String>)

    A list of account IDs for the member accounts to stop monitoring.

Returns:

See Also:



3986
3987
3988
3989
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 3986

def stop_monitoring_members(params = {}, options = {})
  req = build_request(:stop_monitoring_members, params)
  req.send_request(options)
end

#tag_resource(params = {}) ⇒ Struct

Adds tags to a resource.

Examples:

Request syntax with placeholder values


resp = client.tag_resource({
  resource_arn: "GuardDutyArn", # required
  tags: { # required
    "TagKey" => "TagValue",
  },
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :resource_arn (required, String)

    The Amazon Resource Name (ARN) for the GuardDuty resource to apply a tag to.

  • :tags (required, Hash<String,String>)

    The tags to be added to a resource.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4015
4016
4017
4018
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4015

def tag_resource(params = {}, options = {})
  req = build_request(:tag_resource, params)
  req.send_request(options)
end

#unarchive_findings(params = {}) ⇒ Struct

Unarchives GuardDuty findings specified by the findingIds.

Examples:

Request syntax with placeholder values


resp = client.unarchive_findings({
  detector_id: "DetectorId", # required
  finding_ids: ["FindingId"], # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector associated with the findings to unarchive.

  • :finding_ids (required, Array<String>)

    The IDs of the findings to unarchive.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4041
4042
4043
4044
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4041

def unarchive_findings(params = {}, options = {})
  req = build_request(:unarchive_findings, params)
  req.send_request(options)
end

#untag_resource(params = {}) ⇒ Struct

Removes tags from a resource.

Examples:

Request syntax with placeholder values


resp = client.untag_resource({
  resource_arn: "GuardDutyArn", # required
  tag_keys: ["TagKey"], # required
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :resource_arn (required, String)

    The Amazon Resource Name (ARN) for the resource to remove tags from.

  • :tag_keys (required, Array<String>)

    The tag keys to remove from the resource.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4067
4068
4069
4070
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4067

def untag_resource(params = {}, options = {})
  req = build_request(:untag_resource, params)
  req.send_request(options)
end

#update_detector(params = {}) ⇒ Struct

Updates the GuardDuty detector specified by the detector ID.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.update_detector({
  detector_id: "DetectorId", # required
  enable: false,
  finding_publishing_frequency: "FIFTEEN_MINUTES", # accepts FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS
  data_sources: {
    s3_logs: {
      enable: false, # required
    },
    kubernetes: {
      audit_logs: { # required
        enable: false, # required
      },
    },
    malware_protection: {
      scan_ec2_instance_with_findings: {
        ebs_volumes: false,
      },
    },
  },
  features: [
    {
      name: "S3_DATA_EVENTS", # accepts S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING
      status: "ENABLED", # accepts ENABLED, DISABLED
      additional_configuration: [
        {
          name: "EKS_ADDON_MANAGEMENT", # accepts EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT
          status: "ENABLED", # accepts ENABLED, DISABLED
        },
      ],
    },
  ],
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector to update.

  • :enable (Boolean)

    Specifies whether the detector is enabled or not enabled.

  • :finding_publishing_frequency (String)

    An enum value that specifies how frequently findings are exported, such as to CloudWatch Events.

  • :data_sources (Types::DataSourceConfigurations)

    Describes which data sources will be updated.

    There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

  • :features (Array<Types::DetectorFeatureConfiguration>)

    Provides the features that will be updated for the detector.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4156
4157
4158
4159
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4156

def update_detector(params = {}, options = {})
  req = build_request(:update_detector, params)
  req.send_request(options)
end

#update_filter(params = {}) ⇒ Types::UpdateFilterResponse

Updates the filter specified by the filter name.

Examples:

Request syntax with placeholder values


resp = client.update_filter({
  detector_id: "DetectorId", # required
  filter_name: "String", # required
  description: "FilterDescription",
  action: "NOOP", # accepts NOOP, ARCHIVE
  rank: 1,
  finding_criteria: {
    criterion: {
      "String" => {
        eq: ["String"],
        neq: ["String"],
        gt: 1,
        gte: 1,
        lt: 1,
        lte: 1,
        equals: ["String"],
        not_equals: ["String"],
        greater_than: 1,
        greater_than_or_equal: 1,
        less_than: 1,
        less_than_or_equal: 1,
      },
    },
  },
})

Response structure


resp.name #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that specifies the GuardDuty service where you want to update a filter.

  • :filter_name (required, String)

    The name of the filter.

  • :description (String)

    The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses (\{ \}, [ ], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.

  • :action (String)

    Specifies the action that is to be applied to the findings that match the filter.

  • :rank (Integer)

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.

  • :finding_criteria (Types::FindingCriteria)

    Represents the criteria to be used in the filter for querying findings.

Returns:

See Also:



4230
4231
4232
4233
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4230

def update_filter(params = {}, options = {})
  req = build_request(:update_filter, params)
  req.send_request(options)
end

#update_findings_feedback(params = {}) ⇒ Struct

Marks the specified GuardDuty findings as useful or not useful.

Examples:

Request syntax with placeholder values


resp = client.update_findings_feedback({
  detector_id: "DetectorId", # required
  finding_ids: ["FindingId"], # required
  feedback: "USEFUL", # required, accepts USEFUL, NOT_USEFUL
  comments: "String",
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector associated with the findings to update feedback for.

  • :finding_ids (required, Array<String>)

    The IDs of the findings that you want to mark as useful or not useful.

  • :feedback (required, String)

    The feedback for the finding.

  • :comments (String)

    Additional feedback about the GuardDuty findings.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4265
4266
4267
4268
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4265

def update_findings_feedback(params = {}, options = {})
  req = build_request(:update_findings_feedback, params)
  req.send_request(options)
end

#update_ip_set(params = {}) ⇒ Struct

Updates the IPSet specified by the IPSet ID.

Examples:

Request syntax with placeholder values


resp = client.update_ip_set({
  detector_id: "DetectorId", # required
  ip_set_id: "String", # required
  name: "Name",
  location: "Location",
  activate: false,
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The detectorID that specifies the GuardDuty service whose IPSet you want to update.

  • :ip_set_id (required, String)

    The unique ID that specifies the IPSet that you want to update.

  • :name (String)

    The unique ID that specifies the IPSet that you want to update.

  • :location (String)

    The updated URI of the file that contains the IPSet.

  • :activate (Boolean)

    The updated Boolean value that specifies whether the IPSet is active or not.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4305
4306
4307
4308
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4305

def update_ip_set(params = {}, options = {})
  req = build_request(:update_ip_set, params)
  req.send_request(options)
end

#update_malware_scan_settings(params = {}) ⇒ Struct

Updates the malware scan settings.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.update_malware_scan_settings({
  detector_id: "DetectorId", # required
  scan_resource_criteria: {
    include: {
      "EC2_INSTANCE_TAG" => {
        map_equals: [ # required
          {
            key: "TagKey", # required
            value: "TagValue",
          },
        ],
      },
    },
    exclude: {
      "EC2_INSTANCE_TAG" => {
        map_equals: [ # required
          {
            key: "TagKey", # required
            value: "TagValue",
          },
        ],
      },
    },
  },
  ebs_snapshot_preservation: "NO_RETENTION", # accepts NO_RETENTION, RETENTION_WITH_FINDING
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The unique ID of the detector that specifies the GuardDuty service where you want to update scan settings.

  • :scan_resource_criteria (Types::ScanResourceCriteria)

    Represents the criteria to be used in the filter for selecting resources to scan.

  • :ebs_snapshot_preservation (String)

    An enum value representing possible snapshot preservation settings.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4367
4368
4369
4370
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4367

def update_malware_scan_settings(params = {}, options = {})
  req = build_request(:update_malware_scan_settings, params)
  req.send_request(options)
end

#update_member_detectors(params = {}) ⇒ Types::UpdateMemberDetectorsResponse

Contains information on member accounts to be updated.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.update_member_detectors({
  detector_id: "DetectorId", # required
  account_ids: ["AccountId"], # required
  data_sources: {
    s3_logs: {
      enable: false, # required
    },
    kubernetes: {
      audit_logs: { # required
        enable: false, # required
      },
    },
    malware_protection: {
      scan_ec2_instance_with_findings: {
        ebs_volumes: false,
      },
    },
  },
  features: [
    {
      name: "S3_DATA_EVENTS", # accepts S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING
      status: "ENABLED", # accepts ENABLED, DISABLED
      additional_configuration: [
        {
          name: "EKS_ADDON_MANAGEMENT", # accepts EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT
          status: "ENABLED", # accepts ENABLED, DISABLED
        },
      ],
    },
  ],
})

Response structure


resp.unprocessed_accounts #=> Array
resp.unprocessed_accounts[0]. #=> String
resp.unprocessed_accounts[0].result #=> String

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The detector ID of the administrator account.

  • :account_ids (required, Array<String>)

    A list of member account IDs to be updated.

  • :data_sources (Types::DataSourceConfigurations)

    Describes which data sources will be updated.

  • :features (Array<Types::MemberFeaturesConfiguration>)

    A list of features that will be updated for the specified member accounts.

Returns:

See Also:



4451
4452
4453
4454
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4451

def update_member_detectors(params = {}, options = {})
  req = build_request(:update_member_detectors, params)
  req.send_request(options)
end

#update_organization_configuration(params = {}) ⇒ Struct

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Examples:

Request syntax with placeholder values


resp = client.update_organization_configuration({
  detector_id: "DetectorId", # required
  auto_enable: false,
  data_sources: {
    s3_logs: {
      auto_enable: false, # required
    },
    kubernetes: {
      audit_logs: { # required
        auto_enable: false, # required
      },
    },
    malware_protection: {
      scan_ec2_instance_with_findings: {
        ebs_volumes: {
          auto_enable: false,
        },
      },
    },
  },
  features: [
    {
      name: "S3_DATA_EVENTS", # accepts S3_DATA_EVENTS, EKS_AUDIT_LOGS, EBS_MALWARE_PROTECTION, RDS_LOGIN_EVENTS, EKS_RUNTIME_MONITORING, LAMBDA_NETWORK_LOGS, RUNTIME_MONITORING
      auto_enable: "NEW", # accepts NEW, NONE, ALL
      additional_configuration: [
        {
          name: "EKS_ADDON_MANAGEMENT", # accepts EKS_ADDON_MANAGEMENT, ECS_FARGATE_AGENT_MANAGEMENT
          auto_enable: "NEW", # accepts NEW, NONE, ALL
        },
      ],
    },
  ],
  auto_enable_organization_members: "NEW", # accepts NEW, ALL, NONE
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector that configures the delegated administrator.

  • :auto_enable (Boolean)

    Represents whether or not to automatically enable member accounts in the organization.

    Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results. You must provide a value for either autoEnableOrganizationMembers or autoEnable.

  • :data_sources (Types::OrganizationDataSourceConfigurations)

    Describes which data sources will be updated.

  • :features (Array<Types::OrganizationFeatureConfiguration>)

    A list of features that will be configured for the organization.

  • :auto_enable_organization_members (String)

    Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. You must provide a value for either autoEnableOrganizationMembers or autoEnable.

    Use one of the following configuration values for autoEnableOrganizationMembers:

    • NEW: Indicates that when a new account joins the organization, they will have GuardDuty enabled automatically.

    • ALL: Indicates that all accounts in the organization have GuardDuty enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty.

      It may take up to 24 hours to update the configuration for all the member accounts.

    • NONE: Indicates that GuardDuty will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually.

      When you update the auto-enable setting from ALL or NEW to NONE, this action doesn't disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4567
4568
4569
4570
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4567

def update_organization_configuration(params = {}, options = {})
  req = build_request(:update_organization_configuration, params)
  req.send_request(options)
end

#update_publishing_destination(params = {}) ⇒ Struct

Updates information about the publishing destination specified by the destinationId.

Examples:

Request syntax with placeholder values


resp = client.update_publishing_destination({
  detector_id: "DetectorId", # required
  destination_id: "String", # required
  destination_properties: {
    destination_arn: "String",
    kms_key_arn: "String",
  },
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The ID of the detector associated with the publishing destinations to update.

  • :destination_id (required, String)

    The ID of the publishing destination to update.

  • :destination_properties (Types::DestinationProperties)

    A DestinationProperties object that includes the DestinationArn and KmsKeyArn of the publishing destination.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4603
4604
4605
4606
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4603

def update_publishing_destination(params = {}, options = {})
  req = build_request(:update_publishing_destination, params)
  req.send_request(options)
end

#update_threat_intel_set(params = {}) ⇒ Struct

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Examples:

Request syntax with placeholder values


resp = client.update_threat_intel_set({
  detector_id: "DetectorId", # required
  threat_intel_set_id: "String", # required
  name: "Name",
  location: "Location",
  activate: false,
})

Parameters:

  • params (Hash) (defaults to: {})

    ({})

Options Hash (params):

  • :detector_id (required, String)

    The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to update.

  • :threat_intel_set_id (required, String)

    The unique ID that specifies the ThreatIntelSet that you want to update.

  • :name (String)

    The unique ID that specifies the ThreatIntelSet that you want to update.

  • :location (String)

    The updated URI of the file that contains the ThreateIntelSet.

  • :activate (Boolean)

    The updated Boolean value that specifies whether the ThreateIntelSet is active or not.

Returns:

  • (Struct)

    Returns an empty response.

See Also:



4645
4646
4647
4648
# File 'gems/aws-sdk-guardduty/lib/aws-sdk-guardduty/client.rb', line 4645

def update_threat_intel_set(params = {}, options = {})
  req = build_request(:update_threat_intel_set, params)
  req.send_request(options)
end