2026/10/14 - Amazon GuardDuty - 3 updated api methods
Changes Releasing support for Custom Detection Rule Runtime Monitoring
{'Rule': {'DataSource': {'RuntimeMonitoring'},
'RuntimeMonitoringDetails': {'Platforms': {'Ec2': {'MinAgentVersion': 'string'},
'EcsFargate': {'MinAgentVersion': 'string'},
'Eks': {'MinAgentVersion': 'string'}}}}}
Returns details for a custom detection rule in GuardDuty, including its detection logic.
See also: AWS API Documentation
Request Syntax
client.get_custom_detection_rule(
RuleId='string'
)
string
[REQUIRED]
The unique identifier for the custom detection rule.
dict
Response Syntax
{
'Rule': {
'RuleId': 'string',
'Arn': 'string',
'Name': 'string',
'Description': 'string',
'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW',
'DataSource': 'CloudTrailManagementEvent'|'RuntimeMonitoring',
'Tactic': 'string',
'Technique': 'string',
'Service': 'string',
'Definition': {
'Expression': 'string'
},
'Language': 'SQL',
'Schema': 'CloudTrail',
'RuntimeMonitoringDetails': {
'Platforms': {
'Eks': {
'MinAgentVersion': 'string'
},
'Ec2': {
'MinAgentVersion': 'string'
},
'EcsFargate': {
'MinAgentVersion': 'string'
}
}
},
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Rule (dict) --
The details of the custom detection rule.
RuleId (string) --
The unique identifier for the rule.
Arn (string) --
The Amazon Resource Name (ARN) of the rule.
Name (string) --
The display name of the rule.
Description (string) --
A description of what the rule detects.
Severity (string) --
The severity level assigned to findings generated by this rule.
DataSource (string) --
The data source that the rule analyzes.
Tactic (string) --
The MITRE ATT&CK tactic associated with the rule.
Technique (string) --
The MITRE ATT&CK technique associated with the rule.
Service (string) --
The Amazon Web Services service associated with the rule.
Definition (dict) --
The detection logic definition for the rule.
Expression (string) --
The detection logic expression for the rule.
Language (string) --
The language used for the detection logic expression.
Schema (string) --
The schema version used by the rule definition.
RuntimeMonitoringDetails (dict) --
Runtime Monitoring-specific details for the rule, including the platforms on which the rule can run and the minimum GuardDuty agent version required on each.
Platforms (dict) --
The platforms on which the rule can run. The presence of a platform member indicates that the rule is supported on that platform; the absence of a member indicates that the rule cannot run on that platform at any agent version.
Eks (dict) --
The requirements for running the rule on Amazon EKS.
MinAgentVersion (string) --
The minimum GuardDuty agent version required to run the rule on Amazon EKS.
Ec2 (dict) --
The requirements for running the rule on Amazon EC2.
MinAgentVersion (string) --
The minimum GuardDuty agent version required to run the rule on Amazon EC2.
EcsFargate (dict) --
The requirements for running the rule on Amazon ECS with the Fargate launch type.
MinAgentVersion (string) --
The minimum GuardDuty agent version required to run the rule on Amazon ECS with the Fargate launch type.
CreatedAt (datetime) --
The timestamp when the rule was created.
UpdatedAt (datetime) --
The timestamp when the rule was last updated.
{'Findings': {'CustomDetectionRuleName': 'string'}}
Describes Amazon GuardDuty findings specified by finding IDs.
See also: AWS API Documentation
Request Syntax
client.get_findings(
DetectorId='string',
FindingIds=[
'string',
],
SortCriteria={
'AttributeName': 'string',
'OrderBy': 'ASC'|'DESC'
}
)
string
[REQUIRED]
The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
list
[REQUIRED]
The IDs of the findings that you want to retrieve.
(string) --
dict
Represents the criteria used for sorting findings.
AttributeName (string) --
Represents the finding attribute, such as accountId, that sorts the findings.
OrderBy (string) --
The order by which the sorted findings are to be displayed.
dict
Response Syntax
{
'Findings': [
{
'AccountId': 'string',
'Arn': 'string',
'Confidence': 123.0,
'CreatedAt': 'string',
'Description': 'string',
'Id': 'string',
'Partition': 'string',
'Region': 'string',
'Resource': {
'AccessKeyDetails': {
'AccessKeyId': 'string',
'PrincipalId': 'string',
'UserName': 'string',
'UserType': 'string'
},
'S3BucketDetails': [
{
'Arn': 'string',
'Name': 'string',
'Type': 'string',
'CreatedAt': datetime(2015, 1, 1),
'Owner': {
'Id': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'DefaultServerSideEncryption': {
'EncryptionType': 'string',
'KmsMasterKeyArn': 'string'
},
'PublicAccess': {
'PermissionConfiguration': {
'BucketLevelPermissions': {
'AccessControlList': {
'AllowsPublicReadAccess': True|False,
'AllowsPublicWriteAccess': True|False
},
'BucketPolicy': {
'AllowsPublicReadAccess': True|False,
'AllowsPublicWriteAccess': True|False
},
'BlockPublicAccess': {
'IgnorePublicAcls': True|False,
'RestrictPublicBuckets': True|False,
'BlockPublicAcls': True|False,
'BlockPublicPolicy': True|False
}
},
'AccountLevelPermissions': {
'BlockPublicAccess': {
'IgnorePublicAcls': True|False,
'RestrictPublicBuckets': True|False,
'BlockPublicAcls': True|False,
'BlockPublicPolicy': True|False
}
}
},
'EffectivePermission': 'string'
},
'S3ObjectDetails': [
{
'ObjectArn': 'string',
'Key': 'string',
'ETag': 'string',
'Hash': 'string',
'VersionId': 'string'
},
]
},
],
'InstanceDetails': {
'AvailabilityZone': 'string',
'IamInstanceProfile': {
'Arn': 'string',
'Id': 'string'
},
'ImageDescription': 'string',
'ImageId': 'string',
'InstanceId': 'string',
'InstanceState': 'string',
'InstanceType': 'string',
'OutpostArn': 'string',
'LaunchTime': 'string',
'NetworkInterfaces': [
{
'Ipv6Addresses': [
'string',
],
'NetworkInterfaceId': 'string',
'PrivateDnsName': 'string',
'PrivateIpAddress': 'string',
'PrivateIpAddresses': [
{
'PrivateDnsName': 'string',
'PrivateIpAddress': 'string'
},
],
'PublicDnsName': 'string',
'PublicIp': 'string',
'SecurityGroups': [
{
'GroupId': 'string',
'GroupName': 'string'
},
],
'SubnetId': 'string',
'VpcId': 'string'
},
],
'Platform': 'string',
'ProductCodes': [
{
'Code': 'string',
'ProductType': 'string'
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
'EksClusterDetails': {
'Name': 'string',
'Arn': 'string',
'VpcId': 'string',
'Status': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'CreatedAt': datetime(2015, 1, 1)
},
'KubernetesDetails': {
'KubernetesUserDetails': {
'Username': 'string',
'Uid': 'string',
'Groups': [
'string',
],
'SessionName': [
'string',
],
'ImpersonatedUser': {
'Username': 'string',
'Groups': [
'string',
]
}
},
'KubernetesWorkloadDetails': {
'Name': 'string',
'Type': 'string',
'Uid': 'string',
'Namespace': 'string',
'HostNetwork': True|False,
'ServiceAccountName': 'string',
'Containers': [
{
'ContainerRuntime': 'string',
'Id': 'string',
'Name': 'string',
'Image': 'string',
'ImagePrefix': 'string',
'VolumeMounts': [
{
'Name': 'string',
'MountPath': 'string'
},
],
'SecurityContext': {
'Privileged': True|False,
'AllowPrivilegeEscalation': True|False
}
},
],
'Volumes': [
{
'Name': 'string',
'HostPath': {
'Path': 'string'
}
},
],
'HostIPC': True|False,
'HostPID': True|False
}
},
'ResourceType': 'string',
'EbsVolumeDetails': {
'ScannedVolumeDetails': [
{
'VolumeArn': 'string',
'VolumeType': 'string',
'DeviceName': 'string',
'VolumeSizeInGB': 123,
'EncryptionType': 'string',
'SnapshotArn': 'string',
'KmsKeyArn': 'string'
},
],
'SkippedVolumeDetails': [
{
'VolumeArn': 'string',
'VolumeType': 'string',
'DeviceName': 'string',
'VolumeSizeInGB': 123,
'EncryptionType': 'string',
'SnapshotArn': 'string',
'KmsKeyArn': 'string'
},
]
},
'EcsClusterDetails': {
'Name': 'string',
'Arn': 'string',
'Status': 'string',
'ActiveServicesCount': 123,
'RegisteredContainerInstancesCount': 123,
'RunningTasksCount': 123,
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'TaskDetails': {
'Arn': 'string',
'DefinitionArn': 'string',
'Version': 'string',
'TaskCreatedAt': datetime(2015, 1, 1),
'StartedAt': datetime(2015, 1, 1),
'StartedBy': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'Volumes': [
{
'Name': 'string',
'HostPath': {
'Path': 'string'
}
},
],
'Containers': [
{
'ContainerRuntime': 'string',
'Id': 'string',
'Name': 'string',
'Image': 'string',
'ImagePrefix': 'string',
'VolumeMounts': [
{
'Name': 'string',
'MountPath': 'string'
},
],
'SecurityContext': {
'Privileged': True|False,
'AllowPrivilegeEscalation': True|False
}
},
],
'Group': 'string',
'LaunchType': 'string'
}
},
'ContainerDetails': {
'ContainerRuntime': 'string',
'Id': 'string',
'Name': 'string',
'Image': 'string',
'ImagePrefix': 'string',
'VolumeMounts': [
{
'Name': 'string',
'MountPath': 'string'
},
],
'SecurityContext': {
'Privileged': True|False,
'AllowPrivilegeEscalation': True|False
}
},
'LambdaDetails': {
'FunctionArn': 'string',
'FunctionName': 'string',
'Description': 'string',
'LastModifiedAt': datetime(2015, 1, 1),
'RevisionId': 'string',
'FunctionVersion': 'string',
'Role': 'string',
'VpcConfig': {
'SubnetIds': [
'string',
],
'VpcId': 'string',
'SecurityGroups': [
{
'GroupId': 'string',
'GroupName': 'string'
},
]
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
'RdsDbInstanceDetails': {
'DbInstanceIdentifier': 'string',
'Engine': 'string',
'EngineVersion': 'string',
'DbClusterIdentifier': 'string',
'DbInstanceArn': 'string',
'DbiResourceId': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
'RdsLimitlessDbDetails': {
'DbShardGroupIdentifier': 'string',
'DbShardGroupResourceId': 'string',
'DbShardGroupArn': 'string',
'Engine': 'string',
'EngineVersion': 'string',
'DbClusterIdentifier': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
'RdsDbUserDetails': {
'User': 'string',
'Application': 'string',
'Database': 'string',
'Ssl': 'string',
'AuthMethod': 'string'
},
'EbsSnapshotDetails': {
'SnapshotArn': 'string'
},
'Ec2ImageDetails': {
'ImageArn': 'string'
},
'RecoveryPointDetails': {
'RecoveryPointArn': 'string',
'BackupVaultName': 'string',
'ContinuousScanDetails': {
'StartTime': datetime(2015, 1, 1),
'EndTime': datetime(2015, 1, 1)
}
},
'BedrockGuardrailDetails': {
'GuardrailArn': 'string',
'GuardrailVersion': 'string',
'Guardrails': [
{
'Arn': 'string',
'Version': 'string'
},
],
'GuardrailAction': 'GUARDRAIL_INTERVENED'|'NONE',
'GuardrailSource': 'INPUT'|'OUTPUT',
'ContentPolicyFilters': [
{
'Type': 'PROMPT_ATTACK'|'JAILBREAK'|'HATE'|'INSULTS'|'SEXUAL'|'VIOLENCE'|'MISCONDUCT',
'Confidence': 'HIGH'|'MEDIUM'|'LOW'|'NONE',
'Action': 'BLOCKED'|'NONE'
},
]
},
'ModelDetails': [
{
'ModelId': 'string'
},
]
},
'SchemaVersion': 'string',
'Service': {
'Action': {
'ActionType': 'string',
'AwsApiCallAction': {
'Api': 'string',
'CallerType': 'string',
'DomainDetails': {
'Domain': 'string'
},
'ErrorCode': 'string',
'UserAgent': 'string',
'RemoteIpDetails': {
'City': {
'CityName': 'string'
},
'Country': {
'CountryCode': 'string',
'CountryName': 'string'
},
'GeoLocation': {
'Lat': 123.0,
'Lon': 123.0
},
'IpAddressV4': 'string',
'IpAddressV6': 'string',
'Organization': {
'Asn': 'string',
'AsnOrg': 'string',
'Isp': 'string',
'Org': 'string'
}
},
'ServiceName': 'string',
'RemoteAccountDetails': {
'AccountId': 'string',
'Affiliated': True|False,
'AwsServiceName': 'string'
},
'AffectedResources': {
'string': 'string'
}
},
'DnsRequestAction': {
'Domain': 'string',
'Protocol': 'string',
'Blocked': True|False,
'DomainWithSuffix': 'string',
'VpcOwnerAccountId': 'string'
},
'NetworkConnectionAction': {
'Blocked': True|False,
'ConnectionDirection': 'string',
'LocalPortDetails': {
'Port': 123,
'PortName': 'string'
},
'Protocol': 'string',
'LocalIpDetails': {
'IpAddressV4': 'string',
'IpAddressV6': 'string'
},
'LocalNetworkInterface': 'string',
'RemoteIpDetails': {
'City': {
'CityName': 'string'
},
'Country': {
'CountryCode': 'string',
'CountryName': 'string'
},
'GeoLocation': {
'Lat': 123.0,
'Lon': 123.0
},
'IpAddressV4': 'string',
'IpAddressV6': 'string',
'Organization': {
'Asn': 'string',
'AsnOrg': 'string',
'Isp': 'string',
'Org': 'string'
}
},
'RemotePortDetails': {
'Port': 123,
'PortName': 'string'
}
},
'PortProbeAction': {
'Blocked': True|False,
'PortProbeDetails': [
{
'LocalPortDetails': {
'Port': 123,
'PortName': 'string'
},
'LocalIpDetails': {
'IpAddressV4': 'string',
'IpAddressV6': 'string'
},
'RemoteIpDetails': {
'City': {
'CityName': 'string'
},
'Country': {
'CountryCode': 'string',
'CountryName': 'string'
},
'GeoLocation': {
'Lat': 123.0,
'Lon': 123.0
},
'IpAddressV4': 'string',
'IpAddressV6': 'string',
'Organization': {
'Asn': 'string',
'AsnOrg': 'string',
'Isp': 'string',
'Org': 'string'
}
}
},
]
},
'KubernetesApiCallAction': {
'RequestUri': 'string',
'Verb': 'string',
'Resource': 'string',
'Subresource': 'string',
'Namespace': 'string',
'ResourceName': 'string',
'SourceIps': [
'string',
],
'UserAgent': 'string',
'RemoteIpDetails': {
'City': {
'CityName': 'string'
},
'Country': {
'CountryCode': 'string',
'CountryName': 'string'
},
'GeoLocation': {
'Lat': 123.0,
'Lon': 123.0
},
'IpAddressV4': 'string',
'IpAddressV6': 'string',
'Organization': {
'Asn': 'string',
'AsnOrg': 'string',
'Isp': 'string',
'Org': 'string'
}
},
'StatusCode': 123,
'Parameters': 'string'
},
'KubernetesPermissionCheckedDetails': {
'Verb': 'string',
'Resource': 'string',
'Namespace': 'string',
'Allowed': True|False
},
'KubernetesRoleBindingDetails': {
'Kind': 'string',
'Name': 'string',
'Uid': 'string',
'RoleRefName': 'string',
'RoleRefKind': 'string'
},
'KubernetesRoleDetails': {
'Kind': 'string',
'Name': 'string',
'Uid': 'string'
},
'RdsLoginAttemptAction': {
'RemoteIpDetails': {
'City': {
'CityName': 'string'
},
'Country': {
'CountryCode': 'string',
'CountryName': 'string'
},
'GeoLocation': {
'Lat': 123.0,
'Lon': 123.0
},
'IpAddressV4': 'string',
'IpAddressV6': 'string',
'Organization': {
'Asn': 'string',
'AsnOrg': 'string',
'Isp': 'string',
'Org': 'string'
}
},
'LoginAttributes': [
{
'User': 'string',
'Application': 'string',
'FailedLoginAttempts': 123,
'SuccessfulLoginAttempts': 123
},
]
}
},
'Evidence': {
'ThreatIntelligenceDetails': [
{
'ThreatListName': 'string',
'ThreatNames': [
'string',
],
'ThreatFileSha256': 'string'
},
]
},
'Archived': True|False,
'Count': 123,
'DetectorId': 'string',
'EventFirstSeen': 'string',
'EventLastSeen': 'string',
'ResourceRole': 'string',
'ServiceName': 'string',
'UserFeedback': 'string',
'AdditionalInfo': {
'Value': 'string',
'Type': 'string'
},
'FeatureName': 'string',
'EbsVolumeScanDetails': {
'ScanId': 'string',
'ScanStartedAt': datetime(2015, 1, 1),
'ScanCompletedAt': datetime(2015, 1, 1),
'TriggerFindingId': 'string',
'Sources': [
'string',
],
'ScanDetections': {
'ScannedItemCount': {
'TotalGb': 123,
'Files': 123,
'Volumes': 123
},
'ThreatsDetectedItemCount': {
'Files': 123
},
'HighestSeverityThreatDetails': {
'Severity': 'string',
'ThreatName': 'string',
'Count': 123
},
'ThreatDetectedByName': {
'ItemCount': 123,
'UniqueThreatNameCount': 123,
'Shortened': True|False,
'ThreatNames': [
{
'Name': 'string',
'Severity': 'string',
'ItemCount': 123,
'FilePaths': [
{
'FilePath': 'string',
'VolumeArn': 'string',
'Hash': 'string',
'FileName': 'string'
},
]
},
]
}
},
'ScanType': 'GUARDDUTY_INITIATED'|'ON_DEMAND'
},
'RuntimeDetails': {
'Process': {
'Name': 'string',
'ExecutablePath': 'string',
'ExecutableSha256': 'string',
'NamespacePid': 123,
'Pwd': 'string',
'Pid': 123,
'StartTime': datetime(2015, 1, 1),
'Uuid': 'string',
'ParentUuid': 'string',
'User': 'string',
'UserId': 123,
'Euid': 123,
'Lineage': [
{
'StartTime': datetime(2015, 1, 1),
'NamespacePid': 123,
'UserId': 123,
'Name': 'string',
'Pid': 123,
'Uuid': 'string',
'ExecutablePath': 'string',
'Euid': 123,
'ParentUuid': 'string'
},
]
},
'Context': {
'ModifyingProcess': {
'Name': 'string',
'ExecutablePath': 'string',
'ExecutableSha256': 'string',
'NamespacePid': 123,
'Pwd': 'string',
'Pid': 123,
'StartTime': datetime(2015, 1, 1),
'Uuid': 'string',
'ParentUuid': 'string',
'User': 'string',
'UserId': 123,
'Euid': 123,
'Lineage': [
{
'StartTime': datetime(2015, 1, 1),
'NamespacePid': 123,
'UserId': 123,
'Name': 'string',
'Pid': 123,
'Uuid': 'string',
'ExecutablePath': 'string',
'Euid': 123,
'ParentUuid': 'string'
},
]
},
'ModifiedAt': datetime(2015, 1, 1),
'ScriptPath': 'string',
'LibraryPath': 'string',
'LdPreloadValue': 'string',
'SocketPath': 'string',
'RuncBinaryPath': 'string',
'ReleaseAgentPath': 'string',
'MountSource': 'string',
'MountTarget': 'string',
'FileSystemType': 'string',
'Flags': [
'string',
],
'ModuleName': 'string',
'ModuleFilePath': 'string',
'ModuleSha256': 'string',
'ShellHistoryFilePath': 'string',
'TargetProcess': {
'Name': 'string',
'ExecutablePath': 'string',
'ExecutableSha256': 'string',
'NamespacePid': 123,
'Pwd': 'string',
'Pid': 123,
'StartTime': datetime(2015, 1, 1),
'Uuid': 'string',
'ParentUuid': 'string',
'User': 'string',
'UserId': 123,
'Euid': 123,
'Lineage': [
{
'StartTime': datetime(2015, 1, 1),
'NamespacePid': 123,
'UserId': 123,
'Name': 'string',
'Pid': 123,
'Uuid': 'string',
'ExecutablePath': 'string',
'Euid': 123,
'ParentUuid': 'string'
},
]
},
'AddressFamily': 'string',
'IanaProtocolNumber': 123,
'MemoryRegions': [
'string',
],
'ToolName': 'string',
'ToolCategory': 'string',
'ServiceName': 'string',
'CommandLineExample': 'string',
'ThreatFilePath': 'string',
'FileOperation': 'string',
'FilePath': 'string',
'RelatedFilePaths': [
'string',
]
}
},
'Detection': {
'Anomaly': {
'Profiles': {
'string': {
'string': [
{
'ProfileType': 'FREQUENCY'|'VOLUME',
'ProfileSubtype': 'FREQUENT'|'INFREQUENT'|'UNSEEN'|'RARE'|'COUNT'|'AVERAGE',
'Observations': {
'Text': [
'string',
],
'Number': [
123,
]
}
},
]
}
},
'Unusual': {
'Behavior': {
'string': {
'string': {
'ProfileType': 'FREQUENCY'|'VOLUME',
'ProfileSubtype': 'FREQUENT'|'INFREQUENT'|'UNSEEN'|'RARE'|'COUNT'|'AVERAGE',
'Observations': {
'Text': [
'string',
],
'Number': [
123,
]
}
}
}
}
}
},
'Sequence': {
'Uid': 'string',
'Description': 'string',
'Actors': [
{
'Id': 'string',
'User': {
'Name': 'string',
'Uid': 'string',
'Type': 'string',
'CredentialUid': 'string',
'Account': {
'Uid': 'string',
'Name': 'string'
}
},
'Session': {
'Uid': 'string',
'MfaStatus': 'ENABLED'|'DISABLED',
'CreatedTime': datetime(2015, 1, 1),
'Issuer': 'string'
},
'Process': {
'Name': 'string',
'Path': 'string',
'Sha256': 'string'
}
},
],
'Resources': [
{
'Uid': 'string',
'Name': 'string',
'AccountId': 'string',
'ResourceType': 'EC2_INSTANCE'|'EC2_NETWORK_INTERFACE'|'S3_BUCKET'|'S3_OBJECT'|'ACCESS_KEY'|'EKS_CLUSTER'|'KUBERNETES_WORKLOAD'|'CONTAINER'|'ECS_CLUSTER'|'ECS_TASK'|'AUTOSCALING_AUTO_SCALING_GROUP'|'IAM_INSTANCE_PROFILE'|'CLOUDFORMATION_STACK'|'EC2_LAUNCH_TEMPLATE'|'EC2_VPC'|'EC2_IMAGE'|'BEDROCK_CUSTOM_MODEL'|'BEDROCK_IMPORTED_MODEL'|'BEDROCK_PROVISIONED_MODEL'|'BEDROCK_CUSTOM_MODEL_DEPLOYMENT'|'BEDROCK_INFERENCE_PROFILE'|'BEDROCK_APPLICATION_INFERENCE_PROFILE'|'BEDROCK_PROMPT'|'BEDROCK_PROMPT_ROUTER'|'BEDROCK_GUARDRAIL'|'SAGEMAKER_ENDPOINT',
'Region': 'string',
'Service': 'string',
'CloudPartition': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'Data': {
'S3Bucket': {
'OwnerId': 'string',
'CreatedAt': datetime(2015, 1, 1),
'EncryptionType': 'string',
'EncryptionKeyArn': 'string',
'EffectivePermission': 'string',
'PublicReadAccess': 'BLOCKED'|'ALLOWED',
'PublicWriteAccess': 'BLOCKED'|'ALLOWED',
'AccountPublicAccess': {
'PublicAclAccess': 'BLOCKED'|'ALLOWED',
'PublicPolicyAccess': 'BLOCKED'|'ALLOWED',
'PublicAclIgnoreBehavior': 'IGNORED'|'NOT_IGNORED',
'PublicBucketRestrictBehavior': 'RESTRICTED'|'NOT_RESTRICTED'
},
'BucketPublicAccess': {
'PublicAclAccess': 'BLOCKED'|'ALLOWED',
'PublicPolicyAccess': 'BLOCKED'|'ALLOWED',
'PublicAclIgnoreBehavior': 'IGNORED'|'NOT_IGNORED',
'PublicBucketRestrictBehavior': 'RESTRICTED'|'NOT_RESTRICTED'
},
'S3ObjectUids': [
'string',
]
},
'Ec2Instance': {
'AvailabilityZone': 'string',
'ImageDescription': 'string',
'InstanceState': 'string',
'IamInstanceProfile': {
'Arn': 'string',
'Id': 'string'
},
'InstanceType': 'string',
'OutpostArn': 'string',
'Platform': 'string',
'ProductCodes': [
{
'Code': 'string',
'ProductType': 'string'
},
],
'Ec2NetworkInterfaceUids': [
'string',
]
},
'AccessKey': {
'PrincipalId': 'string',
'UserName': 'string',
'UserType': 'string'
},
'Ec2NetworkInterface': {
'Ipv6Addresses': [
'string',
],
'PrivateIpAddresses': [
{
'PrivateDnsName': 'string',
'PrivateIpAddress': 'string'
},
],
'PublicIp': 'string',
'SecurityGroups': [
{
'GroupId': 'string',
'GroupName': 'string'
},
],
'SubNetId': 'string',
'VpcId': 'string'
},
'S3Object': {
'ETag': 'string',
'Key': 'string',
'VersionId': 'string'
},
'EksCluster': {
'Arn': 'string',
'CreatedAt': datetime(2015, 1, 1),
'Status': 'CREATING'|'ACTIVE'|'DELETING'|'FAILED'|'UPDATING'|'PENDING',
'VpcId': 'string',
'Ec2InstanceUids': [
'string',
]
},
'KubernetesWorkload': {
'ContainerUids': [
'string',
],
'Namespace': 'string',
'KubernetesResourcesTypes': 'PODS'|'JOBS'|'CRONJOBS'|'DEPLOYMENTS'|'DAEMONSETS'|'STATEFULSETS'|'REPLICASETS'|'REPLICATIONCONTROLLERS'
},
'Container': {
'Image': 'string',
'ImageUid': 'string'
},
'EcsCluster': {
'Status': 'ACTIVE'|'PROVISIONING'|'DEPROVISIONING'|'FAILED'|'INACTIVE',
'Ec2InstanceUids': [
'string',
]
},
'EcsTask': {
'CreatedAt': datetime(2015, 1, 1),
'TaskDefinitionArn': 'string',
'LaunchType': 'FARGATE'|'EC2',
'ContainerUids': [
'string',
]
},
'IamInstanceProfile': {
'Ec2InstanceUids': [
'string',
]
},
'AutoscalingAutoScalingGroup': {
'Ec2InstanceUids': [
'string',
]
},
'Ec2LaunchTemplate': {
'Ec2InstanceUids': [
'string',
],
'Version': 'string'
},
'Ec2Vpc': {
'Ec2InstanceUids': [
'string',
]
},
'Ec2Image': {
'Ec2InstanceUids': [
'string',
]
},
'CloudformationStack': {
'Ec2InstanceUids': [
'string',
]
},
'BedrockGuardrail': {
'Version': 'string',
'GuardrailAction': 'GUARDRAIL_INTERVENED'|'NONE',
'GuardrailSource': 'INPUT'|'OUTPUT'
}
}
},
],
'Endpoints': [
{
'Id': 'string',
'Ip': 'string',
'Domain': 'string',
'Port': 123,
'Location': {
'City': 'string',
'Country': 'string',
'Latitude': 123.0,
'Longitude': 123.0
},
'AutonomousSystem': {
'Name': 'string',
'Number': 123
},
'Connection': {
'Direction': 'INBOUND'|'OUTBOUND'
}
},
],
'Signals': [
{
'Uid': 'string',
'Type': 'FINDING'|'CLOUD_TRAIL'|'S3_DATA_EVENTS'|'EKS_AUDIT_LOGS'|'FLOW_LOGS'|'DNS_LOGS'|'RUNTIME_MONITORING',
'Description': 'string',
'Name': 'string',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1),
'FirstSeenAt': datetime(2015, 1, 1),
'LastSeenAt': datetime(2015, 1, 1),
'Severity': 123.0,
'Count': 123,
'ResourceUids': [
'string',
],
'ActorIds': [
'string',
],
'EndpointIds': [
'string',
],
'SignalIndicators': [
{
'Key': 'SUSPICIOUS_USER_AGENT'|'SUSPICIOUS_NETWORK'|'MALICIOUS_IP'|'TOR_IP'|'ATTACK_TACTIC'|'HIGH_RISK_API'|'ATTACK_TECHNIQUE'|'UNUSUAL_API_FOR_ACCOUNT'|'UNUSUAL_ASN_FOR_ACCOUNT'|'UNUSUAL_ASN_FOR_USER'|'SUSPICIOUS_PROCESS'|'MALICIOUS_DOMAIN'|'MALICIOUS_PROCESS'|'CRYPTOMINING_IP'|'CRYPTOMINING_DOMAIN'|'CRYPTOMINING_PROCESS'|'MALICIOUS_FILE'|'VULNERABILITY'|'MALICIOUS_PACKAGE'|'MISCONFIGURATION'|'REACHABILITY'|'SENSITIVE_DATA',
'Values': [
'string',
],
'Title': 'string'
},
],
'Activities': [
{
'Type': 'API_CALL',
'Api': {
'Operation': 'string',
'Service': 'string',
'Error': 'string',
'UserAgent': 'string'
}
},
]
},
],
'SequenceIndicators': [
{
'Key': 'SUSPICIOUS_USER_AGENT'|'SUSPICIOUS_NETWORK'|'MALICIOUS_IP'|'TOR_IP'|'ATTACK_TACTIC'|'HIGH_RISK_API'|'ATTACK_TECHNIQUE'|'UNUSUAL_API_FOR_ACCOUNT'|'UNUSUAL_ASN_FOR_ACCOUNT'|'UNUSUAL_ASN_FOR_USER'|'SUSPICIOUS_PROCESS'|'MALICIOUS_DOMAIN'|'MALICIOUS_PROCESS'|'CRYPTOMINING_IP'|'CRYPTOMINING_DOMAIN'|'CRYPTOMINING_PROCESS'|'MALICIOUS_FILE'|'VULNERABILITY'|'MALICIOUS_PACKAGE'|'MISCONFIGURATION'|'REACHABILITY'|'SENSITIVE_DATA',
'Values': [
'string',
],
'Title': 'string'
},
],
'AdditionalSequenceTypes': [
'string',
]
}
},
'MalwareScanDetails': {
'Threats': [
{
'Name': 'string',
'Source': 'string',
'ItemPaths': [
{
'NestedItemPath': 'string',
'Hash': 'string'
},
],
'Count': 123,
'Hash': 'string',
'ItemDetails': [
{
'ResourceArn': 'string',
'ItemPath': 'string',
'Hash': 'string',
'AdditionalInfo': {
'VersionId': 'string',
'DeviceName': 'string'
}
},
]
},
],
'ScanId': 'string',
'ScanType': 'BACKUP_INITIATED'|'ON_DEMAND'|'GUARDDUTY_INITIATED',
'ScanCategory': 'FULL_SCAN'|'INCREMENTAL_SCAN',
'ScanConfiguration': {
'TriggerType': 'BACKUP'|'GUARDDUTY',
'IncrementalScanDetails': {
'BaselineResourceArn': 'string'
}
},
'UniqueThreatCount': 123
}
},
'Severity': 123.0,
'Title': 'string',
'Type': 'string',
'UpdatedAt': 'string',
'AssociatedAttackSequenceArn': 'string',
'CustomDetectionRuleName': 'string'
},
]
}
**Response Structure**
::
# This section is too large to render.
# Please see the AWS API Documentation linked below.
`AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/GetFindings>`_
{'Rules': {'DataSource': {'RuntimeMonitoring'}}}
Returns all available custom detection rules in GuardDuty. You can filter the results by data source, severity, tactic, technique, and service.
See also: AWS API Documentation
Request Syntax
client.list_custom_detection_rules(
MaxResults=123,
NextToken='string',
Filters=[
{
'Name': 'name'|'description'|'dataSource'|'severity'|'tactic'|'technique'|'service',
'Values': [
'string',
],
'Condition': 'EQUALS'|'CONTAINS'
},
]
)
integer
The maximum number of results to return in a single page. Minimum value of 1, maximum value of 100.
string
A pagination token from a previous response. Use this token to retrieve the next page of results.
list
A list of filter criteria to apply when listing custom detection rules.
(dict) --
Contains filter criteria for listing custom detection rules or associations.
Name (string) -- [REQUIRED]
The name of the field to filter by.
Values (list) -- [REQUIRED]
The values to match against the specified filter name.
(string) --
Condition (string) --
The condition to apply to the filter. For example, EQUALS or CONTAINS.
dict
Response Syntax
{
'Rules': [
{
'RuleId': 'string',
'Arn': 'string',
'Name': 'string',
'Description': 'string',
'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW',
'DataSource': 'CloudTrailManagementEvent'|'RuntimeMonitoring',
'Tactic': 'string',
'Technique': 'string',
'Service': 'string',
'Language': 'SQL',
'Schema': 'CloudTrail',
'CreatedAt': datetime(2015, 1, 1),
'UpdatedAt': datetime(2015, 1, 1)
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Rules (list) --
A list of custom detection rule summaries.
(dict) --
Contains summary information about a custom detection rule.
RuleId (string) --
The unique identifier for the rule.
Arn (string) --
The Amazon Resource Name (ARN) of the rule.
Name (string) --
The display name of the rule.
Description (string) --
A description of what the rule detects.
Severity (string) --
The severity level assigned to findings generated by this rule.
DataSource (string) --
The data source that the rule analyzes.
Tactic (string) --
The MITRE ATT&CK tactic associated with the rule.
Technique (string) --
The MITRE ATT&CK technique associated with the rule.
Service (string) --
The Amazon Web Services service associated with the rule.
Language (string) --
The language used for the detection logic expression.
Schema (string) --
The schema version used by the rule definition.
CreatedAt (datetime) --
The timestamp when the rule was created.
UpdatedAt (datetime) --
The timestamp when the rule was last updated.
NextToken (string) --
A pagination token to retrieve the next page of results. If this field is empty, there are no additional results.