findings

Creates, updates, deletes, gets or lists a findings resource.

Overview

Name	findings
Type	Resource
Id	aws.guardduty.findings

Fields

The following fields are returned by SELECT queries:

get_findings

Name	Datatype	Description
findings	array	A list of findings.

list_findings

Name	Datatype	Description
finding_id	string	The IDs of the findings that you're listing.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_findings	select	detector_id, region		Describes Amazon GuardDuty findings specified by finding IDs.
list_findings	select	detector_id, region		Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.
create_sample_findings	insert	detector_id, region		Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.
update_findings_feedback	update	detector_id, region, FindingIds, Feedback		Marks the specified GuardDuty findings as useful or not useful.
archive_findings	exec	detector_id, region, FindingIds		Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.
unarchive_findings	exec	detector_id, region, FindingIds		Unarchives GuardDuty findings specified by the findingIds.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The ID of the detector associated with the findings to unarchive. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)

SELECT examples

get_findings

Describes Amazon GuardDuty findings specified by finding IDs.

SELECT
findings
FROM aws.guardduty.findings
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
;

list_findings

Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

SELECT
finding_id
FROM aws.guardduty.findings
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
;

INSERT examples

create_sample_findings

Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.

INSERT INTO aws.guardduty.findings (
FindingTypes,
detector_id,
region
)
SELECT 
'{{ FindingTypes }}',
'{{ detector_id }}',
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: findings
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the findings resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the findings resource.
  - name: FindingTypes
    value:
      - "{{ FindingTypes }}"

UPDATE examples

update_findings_feedback

Marks the specified GuardDuty findings as useful or not useful.

UPDATE aws.guardduty.findings
SET 
FindingIds = '{{ FindingIds }}',
Feedback = '{{ Feedback }}',
Comments = '{{ Comments }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND region = '{{ region }}' --required
AND FindingIds = '{{ FindingIds }}' --required
AND Feedback = '{{ Feedback }}' --required;

Lifecycle Methods

archive_findings

Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.

EXEC aws.guardduty.findings.archive_findings 
@detector_id='{{ detector_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"FindingIds": "{{ FindingIds }}"
}'
;

unarchive_findings

Unarchives GuardDuty findings specified by the findingIds.

EXEC aws.guardduty.findings.unarchive_findings 
@detector_id='{{ detector_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"FindingIds": "{{ FindingIds }}"
}'
;