Amazon GuardDuty

{'CreatedAt': 'timestamp', 'UpdatedAt': 'timestamp', 'Version': 'long'}

Returns the details of the filter specified by the filter name.

See also: AWS API Documentation

Request Syntax

client.get_filter(
    DetectorId='string',
    FilterName='string'
)

type DetectorId:

string

param DetectorId:

[REQUIRED]

The unique ID of the detector that is associated with this filter.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

type FilterName:

string

param FilterName:

[REQUIRED]

The name of the filter you want to get.

rtype:

dict

returns:

Response Syntax

{
    'Name': 'string',
    'Description': 'string',
    'Action': 'NOOP'|'ARCHIVE',
    'Rank': 123,
    'FindingCriteria': {
        'Criterion': {
            'string': {
                'Eq': [
                    'string',
                ],
                'Neq': [
                    'string',
                ],
                'Gt': 123,
                'Gte': 123,
                'Lt': 123,
                'Lte': 123,
                'Equals': [
                    'string',
                ],
                'NotEquals': [
                    'string',
                ],
                'GreaterThan': 123,
                'GreaterThanOrEqual': 123,
                'LessThan': 123,
                'LessThanOrEqual': 123,
                'Matches': [
                    'string',
                ],
                'NotMatches': [
                    'string',
                ]
            }
        }
    },
    'Tags': {
        'string': 'string'
    },
    'CreatedAt': datetime(2015, 1, 1),
    'UpdatedAt': datetime(2015, 1, 1),
    'Version': 123
}

Response Structure

• (dict) --

  • Name (string) --

    The name of the filter.

  • Description (string) --

    The description of the filter.

  • Action (string) --

    Specifies the action that is to be applied to the findings that match the filter.

  • Rank (integer) --

    Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.

  • FindingCriteria (dict) --

    Represents the criteria to be used in the filter for querying findings.

    • Criterion (dict) --

      Represents a map of finding properties that match specified conditions and values when querying findings.

      • (string) --

        • (dict) --

          Contains information about the condition.

          • Eq (list) --

            Represents the equal condition to be applied to a single field when querying for findings.

            Max values: 50

            • (string) --

          • Neq (list) --

            Represents the not equal condition to be applied to a single field when querying for findings.

            Max values: 50

            • (string) --

          • Gt (integer) --

            Represents a greater than condition to be applied to a single field when querying for findings.

          • Gte (integer) --

            Represents a greater than or equal condition to be applied to a single field when querying for findings.

          • Lt (integer) --

            Represents a less than condition to be applied to a single field when querying for findings.

          • Lte (integer) --

            Represents a less than or equal condition to be applied to a single field when querying for findings.

          • Equals (list) --

            Represents an equal condition to be applied to a single field when querying for findings.

            Max values: 50

            • (string) --

          • NotEquals (list) --

            Represents a not equal condition to be applied to a single field when querying for findings.

            Max values: 50

            • (string) --

          • GreaterThan (integer) --

            Represents a greater than condition to be applied to a single field when querying for findings.

          • GreaterThanOrEqual (integer) --

            Represents a greater than or equal condition to be applied to a single field when querying for findings.

          • LessThan (integer) --

            Represents a less than condition to be applied to a single field when querying for findings.

          • LessThanOrEqual (integer) --

            Represents a less than or equal condition to be applied to a single field when querying for findings.

          • Matches (list) --

            Represents the match condition to be applied to a single field when querying for findings.

            • (string) --

          • NotMatches (list) --

            Represents the not match condition to be applied to a single field when querying for findings.

            • (string) --

  • Tags (dict) --

    The tags of the filter resource.

    • (string) --

      • (string) --

  • CreatedAt (datetime) --

    The timestamp when the filter was created. This field is not available for filters that were created before the lifecycle metadata feature was enabled (legacy filters).

  • UpdatedAt (datetime) --

    The timestamp when the filter was last updated. For legacy filters, this field is present only after the filter has been updated at least once since the lifecycle metadata feature was enabled.

  • Version (integer) --

    The version of the filter. Every time the filter is updated, the version increments by 1. This field is not available for legacy filters that were created before the lifecycle metadata feature was enabled.