Request Syntax URI Request Parameters Request Body Response Syntax Response Elements Errors See Also

CreateThreatIntelSet

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Request Syntax


POST /detector/detectorId/threatintelset HTTP/1.1
Content-type: application/json

{
   "activate": boolean,
   "clientToken": "string",
   "expectedBucketOwner": "string",
   "format": "string",
   "location": "string",
   "name": "string",
   "tags": { 
      "string" : "string" 
   }
}

URI Request Parameters

The request uses the following URI parameters.

detectorId

The unique ID of the detector of the GuardDuty account for which you want to create a threatIntelSet.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes

Request Body

The request accepts the following data in JSON format.

activate

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

Type: Boolean

Required: Yes

clientToken

The idempotency token for the create request.

Type: String

Length Constraints: Minimum length of 0. Maximum length of 64.

Required: No

expectedBucketOwner

The Amazon account ID that owns the Amazon S3 bucket specified in the location parameter.

Type: String

Length Constraints: Fixed length of 12.

Required: No

format

The format of the file that contains the ThreatIntelSet.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes

location

The URI of the file that contains the ThreatIntelSet.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes

name

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes

tags

The tags to be added to a new threat list resource.

Type: String to string map

Map Entries: Maximum number of 200 items.

Key Length Constraints: Minimum length of 1. Maximum length of 128.

Key Pattern: ^(?!aws:)[a-zA-Z+-=._:/]+$

Value Length Constraints: Maximum length of 256.

Required: No

Response Syntax


HTTP/1.1 200
Content-type: application/json

{
   "threatIntelSetId": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

threatIntelSetId

The ID of the ThreatIntelSet resource.

Type: String

Errors

For information about the errors that are common to all actions, see Common Errors.

AccessDeniedException

An access denied exception object.

Message: The error message.
Type: The error type.

HTTP Status Code: 403

BadRequestException

A bad request exception object.

Message: The error message.
Type: The error type.

HTTP Status Code: 400

InternalServerErrorException

An internal server error exception object.

Message: The error message.
Type: The error type.

HTTP Status Code: 500