2023/09/13 - Amazon GuardDuty - 2 updated api methods
Changes Add `managementType` field to ListCoverage API response.
{'FilterCriteria': {'FilterCriterion': {'CriterionKey': {'MANAGEMENT_TYPE'}}}}
Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled EKS Runtime Monitoring and have the GuardDuty agent running on their EKS nodes.
See also: AWS API Documentation
Request Syntax
client.get_coverage_statistics(
DetectorId='string',
FilterCriteria={
'FilterCriterion': [
{
'CriterionKey': 'ACCOUNT_ID'|'CLUSTER_NAME'|'RESOURCE_TYPE'|'COVERAGE_STATUS'|'ADDON_VERSION'|'MANAGEMENT_TYPE',
'FilterCondition': {
'Equals': [
'string',
],
'NotEquals': [
'string',
]
}
},
]
},
StatisticsType=[
'COUNT_BY_RESOURCE_TYPE'|'COUNT_BY_COVERAGE_STATUS',
]
)
string
[REQUIRED]
The unique ID of the GuardDuty detector associated to the coverage statistics.
dict
Represents the criteria used to filter the coverage statistics
FilterCriterion (list) --
Represents a condition that when matched will be added to the response of the operation.
(dict) --
Represents a condition that when matched will be added to the response of the operation.
CriterionKey (string) --
An enum value representing possible filter fields.
FilterCondition (dict) --
Contains information about the condition.
Equals (list) --
Represents an equal condition that is applied to a single field while retrieving the coverage details.
(string) --
NotEquals (list) --
Represents a not equal condition that is applied to a single field while retrieving the coverage details.
(string) --
list
[REQUIRED]
Represents the statistics type used to aggregate the coverage details.
(string) --
dict
Response Syntax
{
'CoverageStatistics': {
'CountByResourceType': {
'string': 123
},
'CountByCoverageStatus': {
'string': 123
}
}
}
Response Structure
(dict) --
CoverageStatistics (dict) --
Represents the count aggregated by the statusCode and resourceType.
CountByResourceType (dict) --
Represents coverage statistics for EKS clusters aggregated by resource type.
(string) --
(integer) --
CountByCoverageStatus (dict) --
Represents coverage statistics for EKS clusters aggregated by coverage status.
(string) --
(integer) --
{'FilterCriteria': {'FilterCriterion': {'CriterionKey': {'MANAGEMENT_TYPE'}}}}
Response {'Resources': {'ResourceDetails': {'EksClusterDetails': {'ManagementType': 'AUTO_MANAGED '
'| '
'MANUAL'}}}}
Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization.
Make sure the accounts have EKS Runtime Monitoring enabled and GuardDuty agent running on their EKS nodes.
See also: AWS API Documentation
Request Syntax
client.list_coverage(
DetectorId='string',
NextToken='string',
MaxResults=123,
FilterCriteria={
'FilterCriterion': [
{
'CriterionKey': 'ACCOUNT_ID'|'CLUSTER_NAME'|'RESOURCE_TYPE'|'COVERAGE_STATUS'|'ADDON_VERSION'|'MANAGEMENT_TYPE',
'FilterCondition': {
'Equals': [
'string',
],
'NotEquals': [
'string',
]
}
},
]
},
SortCriteria={
'AttributeName': 'ACCOUNT_ID'|'CLUSTER_NAME'|'COVERAGE_STATUS'|'ISSUE'|'ADDON_VERSION'|'UPDATED_AT',
'OrderBy': 'ASC'|'DESC'
}
)
string
[REQUIRED]
The unique ID of the detector whose coverage details you want to retrieve.
string
A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.
integer
The maximum number of results to return in the response.
dict
Represents the criteria used to filter the coverage details.
FilterCriterion (list) --
Represents a condition that when matched will be added to the response of the operation.
(dict) --
Represents a condition that when matched will be added to the response of the operation.
CriterionKey (string) --
An enum value representing possible filter fields.
FilterCondition (dict) --
Contains information about the condition.
Equals (list) --
Represents an equal condition that is applied to a single field while retrieving the coverage details.
(string) --
NotEquals (list) --
Represents a not equal condition that is applied to a single field while retrieving the coverage details.
(string) --
dict
Represents the criteria used to sort the coverage details.
AttributeName (string) --
Represents the field name used to sort the coverage details.
OrderBy (string) --
The order in which the sorted findings are to be displayed.
dict
Response Syntax
{
'Resources': [
{
'ResourceId': 'string',
'DetectorId': 'string',
'AccountId': 'string',
'ResourceDetails': {
'EksClusterDetails': {
'ClusterName': 'string',
'CoveredNodes': 123,
'CompatibleNodes': 123,
'AddonDetails': {
'AddonVersion': 'string',
'AddonStatus': 'string'
},
'ManagementType': 'AUTO_MANAGED'|'MANUAL'
},
'ResourceType': 'EKS'
},
'CoverageStatus': 'HEALTHY'|'UNHEALTHY',
'Issue': 'string',
'UpdatedAt': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Resources (list) --
A list of resources and their attributes providing cluster details.
(dict) --
Information about the resource of the GuardDuty account.
ResourceId (string) --
The unique ID of the resource.
DetectorId (string) --
The unique ID of the GuardDuty detector associated with the resource.
AccountId (string) --
The unique ID of the Amazon Web Services account.
ResourceDetails (dict) --
Information about the resource for which the coverage statistics are retrieved.
EksClusterDetails (dict) --
EKS cluster details involved in the coverage statistics.
ClusterName (string) --
Name of the EKS cluster.
CoveredNodes (integer) --
Represents the nodes within the EKS cluster that have a HEALTHY coverage status.
CompatibleNodes (integer) --
Represents all the nodes within the EKS cluster in your account.
AddonDetails (dict) --
Information about the installed EKS add-on.
AddonVersion (string) --
Version of the installed EKS add-on.
AddonStatus (string) --
Status of the installed EKS add-on.
ManagementType (string) --
Indicates how the Amazon EKS add-on GuardDuty agent is managed for this EKS cluster.
AUTO_MANAGED indicates GuardDuty deploys and manages updates for this resource.
MANUAL indicates that you are responsible to deploy, update, and manage the Amazon EKS add-on GuardDuty agent for this resource.
ResourceType (string) --
The type of Amazon Web Services resource.
CoverageStatus (string) --
Represents the status of the EKS cluster coverage.
Issue (string) --
Represents the reason why a coverage status was UNHEALTHY for the EKS cluster.
UpdatedAt (datetime) --
The timestamp at which the coverage details for the resource were last updated. This is in UTC format.
NextToken (string) --
The pagination parameter to be used on the next list operation to retrieve more items.