malware_scans

Creates, updates, deletes, gets or lists a malware_scans resource.

Overview

Name	malware_scans
Type	Resource
Id	aws.guardduty.malware_scans

Fields

The following fields are returned by SELECT queries:

describe_malware_scans

Name	Datatype	Description
account_id	string	The ID for the account that belongs to the scan.
admin_detector_id	string	The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
attached_volumes	array	List of volumes that were attached to the original instance to be scanned.
detector_id	string	The unique ID of the detector that is associated with the request. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
failure_reason	string	Represents the reason for FAILED scan status.
file_count	integer (int64)	Represents the number of files that were scanned.
resource_details	object	Represents the resources that were scanned in the scan entry.
scan_end_time	string (date-time)	The timestamp of when the scan was finished.
scan_id	string	The unique scan ID associated with a scan entry.
scan_result_details	object	Represents the result of the scan.
scan_start_time	string (date-time)	The timestamp of when the scan was triggered.
scan_status	string	An enum value representing possible scan statuses. (RUNNING, COMPLETED, FAILED, SKIPPED)
scan_type	string	Specifies the scan type that invoked the malware scan. (GUARDDUTY_INITIATED, ON_DEMAND)
total_bytes	integer (int64)	Represents total bytes that were scanned.
trigger_details	object	Specifies the reason why the scan was initiated.

get_malware_scan

Name	Datatype	Description
admin_detector_id	string	The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. If the customer is not a GuardDuty customer, this field will not be present.. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
detector_id	string	The unique ID of the detector that is associated with the request, if it belongs to an account which is a GuardDuty customer. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
failed_resources_count	integer	The total number of resources that failed to be scanned.
resource_arn	string	Amazon Resource Name (ARN) of the resource on which a malware scan was invoked.
resource_type	string	The type of resource that was scanned for malware. (EBS_RECOVERY_POINT, EBS_SNAPSHOT, EBS_VOLUME, EC2_AMI, EC2_INSTANCE, EC2_RECOVERY_POINT, S3_RECOVERY_POINT, S3_BUCKET, S3_POINT_IN_TIME_RECOVERY)
scan_category	string	The category of the malware scan, indicating the type of scan performed. (FULL_SCAN, INCREMENTAL_SCAN)
scan_completed_at	string (date-time)	The timestamp representing when the malware scan was completed.
scan_configuration	object	Information about the scan configuration used for the malware scan.
scan_id	string	A unique identifier associated with the malware scan. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
scan_result_details	object	Detailed information about the results of the malware scan, if the scan completed.
scan_started_at	string (date-time)	The timestamp representing when the malware scan was started.
scan_status	string	A value representing the current status of the malware scan. (RUNNING, COMPLETED, COMPLETED_WITH_ISSUES, FAILED, SKIPPED)
scan_status_reason	string	Represents the reason for the current scan status, if applicable. (ACCESS_DENIED, RESOURCE_NOT_FOUND, SNAPSHOT_SIZE_LIMIT_EXCEEDED, RESOURCE_UNAVAILABLE, INCONSISTENT_SOURCE, INCREMENTAL_NO_DIFFERENCE, NO_EBS_VOLUMES_FOUND, UNSUPPORTED_PRODUCT_CODE_TYPE, AMI_SNAPSHOT_LIMIT_EXCEEDED, UNRELATED_RESOURCES, BASE_RESOURCE_NOT_SCANNED, BASE_CREATED_AFTER_TARGET, UNSUPPORTED_FOR_INCREMENTAL, UNSUPPORTED_AMI, UNSUPPORTED_SNAPSHOT, UNSUPPORTED_COMPOSITE_RECOVERY_POINT, ALL_FILES_SKIPPED_OR_FAILED)
scan_type	string	A value representing the initiator of the scan. (BACKUP_INITIATED, ON_DEMAND, GUARDDUTY_INITIATED)
scanned_resources	array	A list of resources along with their metadata that were scanned as part of the malware scan operation.
scanned_resources_count	integer	The total number of resources that were successfully scanned. This is dependent on the resource type.
skipped_resources_count	integer	The total number of resources that were skipped during the scan.

list_malware_scans

Name	Datatype	Description
resource_arn	string	Amazon Resource Name (ARN) of the resource for the given malware scan.
resource_type	string	The type of resource that was scanned for malware. (EBS_RECOVERY_POINT, EBS_SNAPSHOT, EBS_VOLUME, EC2_AMI, EC2_INSTANCE, EC2_RECOVERY_POINT, S3_RECOVERY_POINT, S3_BUCKET, S3_POINT_IN_TIME_RECOVERY)
scan_completed_at	string (date-time)	The timestamp representing when the malware scan was completed.
scan_id	string	A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
scan_result_status	string	An enum value representing the result of the malware scan. (NO_THREATS_FOUND, THREATS_FOUND)
scan_started_at	string (date-time)	The timestamp representing when the malware scan was started.
scan_status	string	An enum value representing the current status of the malware scan. (RUNNING, COMPLETED, COMPLETED_WITH_ISSUES, FAILED, SKIPPED)
scan_type	string	An enum value representing the type of scan that was initiated. (BACKUP_INITIATED, ON_DEMAND, GUARDDUTY_INITIATED)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_malware_scans	select	detector_id, region		Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
get_malware_scan	select	scan_id, region		Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
list_malware_scans	select	region	maxResults, nextToken	Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector that the request is associated with. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
scan_id	string	A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.
maxResults	integer	You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing results.

SELECT examples

describe_malware_scans

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

SELECT
account_id,
admin_detector_id,
attached_volumes,
detector_id,
failure_reason,
file_count,
resource_details,
scan_end_time,
scan_id,
scan_result_details,
scan_start_time,
scan_status,
scan_type,
total_bytes,
trigger_details
FROM aws.guardduty.malware_scans
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
;

get_malware_scan

Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

SELECT
admin_detector_id,
detector_id,
failed_resources_count,
resource_arn,
resource_type,
scan_category,
scan_completed_at,
scan_configuration,
scan_id,
scan_result_details,
scan_started_at,
scan_status,
scan_status_reason,
scan_type,
scanned_resources,
scanned_resources_count,
skipped_resources_count
FROM aws.guardduty.malware_scans
WHERE scan_id = '{{ scan_id }}' -- required
AND region = '{{ region }}' -- required
;

list_malware_scans

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

SELECT
resource_arn,
resource_type,
scan_completed_at,
scan_id,
scan_result_status,
scan_started_at,
scan_status,
scan_type
FROM aws.guardduty.malware_scans
WHERE region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;