member_detectors

Creates, updates, deletes, gets or lists a member_detectors resource.

Overview

Name	member_detectors
Type	Resource
Id	aws.guardduty.member_detectors

Fields

The following fields are returned by SELECT queries:

get_member_detectors

Name	Datatype	Description
member_data_source_configurations	array	An object that describes which data sources are enabled for a member account.
unprocessed_accounts	array	A list of member account IDs that were unable to be processed along with an explanation for why they were not processed.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_member_detectors	select	detector_id, region		Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
update_member_detectors	update	detector_id, region, AccountIds		Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The detector ID of the administrator account. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)

SELECT examples

get_member_detectors

Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

SELECT
member_data_source_configurations,
unprocessed_accounts
FROM aws.guardduty.member_detectors
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
;

UPDATE examples

update_member_detectors

Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

UPDATE aws.guardduty.member_detectors
SET 
AccountIds = '{{ AccountIds }}',
DataSources = '{{ DataSources }}',
Features = '{{ Features }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND region = '{{ region }}' --required
AND AccountIds = '{{ AccountIds }}' --required
RETURNING
unprocessed_accounts;