filters

Creates, updates, deletes, gets or lists a filters resource.

Overview

Name	filters
Type	Resource
Id	aws.guardduty.filters

Fields

The following fields are returned by SELECT queries:

get_filter

Name	Datatype	Description
action	string	Specifies the action that is to be applied to the findings that match the filter. (NOOP, ARCHIVE)
created_at	string (date-time)	The timestamp when the filter was created. This field is not available for filters that were created before the lifecycle metadata feature was enabled (legacy filters).
description	string	The description of the filter.
finding_criteria	object	Contains information about the criteria used for querying findings.
name	string	The name of the filter.
rank	integer	Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
tags	object	The tags of the filter resource.
updated_at	string (date-time)	The timestamp when the filter was last updated. For legacy filters, this field is present only after the filter has been updated at least once since the lifecycle metadata feature was enabled.
version	integer (int64)	The version of the filter. Every time the filter is updated, the version increments by 1. This field is not available for legacy filters that were created before the lifecycle metadata feature was enabled.

list_filters

Name	Datatype	Description
filter_name	string	A list of filter names.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_filter	select	detector_id, filter_name, region		Returns the details of the filter specified by the filter name.
list_filters	select	detector_id, region	maxResults, nextToken	Returns a paginated list of the current filters.
create_filter	insert	detector_id, region, FindingCriteria		Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.
update_filter	update	detector_id, filter_name, region		Updates the filter specified by the filter name.
delete_filter	delete	detector_id, filter_name, region		Deletes the filter specified by the filter name.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector that is associated with the filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
filter_name	string	The name of the filter that you want to delete.
region	string	AWS region (default: us-east-1)
maxResults	integer	You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

get_filter

Returns the details of the filter specified by the filter name.

SELECT
action,
created_at,
description,
finding_criteria,
name,
rank,
tags,
updated_at,
version
FROM aws.guardduty.filters
WHERE detector_id = '{{ detector_id }}' -- required
AND filter_name = '{{ filter_name }}' -- required
AND region = '{{ region }}' -- required
;

list_filters

Returns a paginated list of the current filters.

SELECT
filter_name
FROM aws.guardduty.filters
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_filter

Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.

INSERT INTO aws.guardduty.filters (
Name,
Description,
Action,
Rank,
FindingCriteria,
ClientToken,
Tags,
detector_id,
region
)
SELECT 
'{{ Name }}',
'{{ Description }}',
'{{ Action }}',
{{ Rank }},
'{{ FindingCriteria }}' /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
name
;

Manifest

# Description fields are for documentation purposes
- name: filters
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the filters resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the filters resource.
  - name: Name
    value: "{{ Name }}"
  - name: Description
    value: "{{ Description }}"
  - name: Action
    value: "{{ Action }}"
    valid_values: ['NOOP', 'ARCHIVE']
  - name: Rank
    value: {{ Rank }}
  - name: FindingCriteria
    description: |
      Contains information about the criteria used for querying findings.
    value:
      Criterion: "{{ Criterion }}"
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"

UPDATE examples

update_filter

Updates the filter specified by the filter name.

UPDATE aws.guardduty.filters
SET 
Description = '{{ Description }}',
Action = '{{ Action }}',
Rank = {{ Rank }},
FindingCriteria = '{{ FindingCriteria }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND filter_name = '{{ filter_name }}' --required
AND region = '{{ region }}' --required
RETURNING
name;

DELETE examples

delete_filter

Deletes the filter specified by the filter name.

DELETE FROM aws.guardduty.filters
WHERE detector_id = '{{ detector_id }}' --required
AND filter_name = '{{ filter_name }}' --required
AND region = '{{ region }}' --required
;