threat_entity_sets

Creates, updates, deletes, gets or lists a threat_entity_sets resource.

Overview

Name	threat_entity_sets
Type	Resource
Id	aws.guardduty.threat_entity_sets

Fields

The following fields are returned by SELECT queries:

get_threat_entity_set

Name	Datatype	Description
created_at	string (date-time)	The timestamp when the associated threat entity set was created.
error_details	string	The error details when the status is shown as ERROR.
expected_bucket_owner	string	The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. (pattern: <code>[0-9]+</code>)
format	string	The format of the file that contains the threat entity set. (TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)
location	string	The URI of the file that contains the threat entity set.
name	string	The name of the threat entity set associated with the specified threatEntitySetId.
status	string	The status of the associated threat entity set. (INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)
tags	object	The tags associated with the threat entity set resource.
updated_at	string (date-time)	The timestamp when the associated threat entity set was updated.

list_threat_entity_sets

Name	Datatype	Description
threat_entity_set_id	string	The IDs of the threat entity set resources.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_threat_entity_set	select	detector_id, threat_entity_set_id, region		Retrieves the threat entity set associated with the specified threatEntitySetId.
list_threat_entity_sets	select	detector_id, region	maxResults, nextToken	Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.
create_threat_entity_set	insert	detector_id, region, Activate		Creates a new threat entity set. In a threat entity set, you can provide known malicious threat entities for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts.
update_threat_entity_set	update	detector_id, threat_entity_set_id, region		Updates the threat entity set associated with the specified threatEntitySetId.
delete_threat_entity_set	delete	detector_id, threat_entity_set_id, region		Deletes the threat entity set that is associated with the specified threatEntitySetId.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector associated with the threat entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
threat_entity_set_id	string	The unique ID that helps GuardDuty identify which threat entity set needs to be deleted.
maxResults	integer	You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

get_threat_entity_set

Retrieves the threat entity set associated with the specified threatEntitySetId.

SELECT
created_at,
error_details,
expected_bucket_owner,
format,
location,
name,
status,
tags,
updated_at
FROM aws.guardduty.threat_entity_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND threat_entity_set_id = '{{ threat_entity_set_id }}' -- required
AND region = '{{ region }}' -- required
;

list_threat_entity_sets

Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.

SELECT
threat_entity_set_id
FROM aws.guardduty.threat_entity_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_threat_entity_set

Creates a new threat entity set. In a threat entity set, you can provide known malicious threat entities for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts.

INSERT INTO aws.guardduty.threat_entity_sets (
Name,
Format,
Location,
ExpectedBucketOwner,
Activate,
ClientToken,
Tags,
detector_id,
region
)
SELECT 
'{{ Name }}',
'{{ Format }}',
'{{ Location }}',
'{{ ExpectedBucketOwner }}',
{{ Activate }} /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
threat_entity_set_id
;

Manifest

# Description fields are for documentation purposes
- name: threat_entity_sets
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the threat_entity_sets resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the threat_entity_sets resource.
  - name: Name
    value: "{{ Name }}"
  - name: Format
    value: "{{ Format }}"
    valid_values: ['TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE']
  - name: Location
    value: "{{ Location }}"
  - name: ExpectedBucketOwner
    value: "{{ ExpectedBucketOwner }}"
  - name: Activate
    value: {{ Activate }}
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"

UPDATE examples

update_threat_entity_set

Updates the threat entity set associated with the specified threatEntitySetId.

UPDATE aws.guardduty.threat_entity_sets
SET 
Name = '{{ Name }}',
Location = '{{ Location }}',
ExpectedBucketOwner = '{{ ExpectedBucketOwner }}',
Activate = {{ Activate }}
WHERE 
detector_id = '{{ detector_id }}' --required
AND threat_entity_set_id = '{{ threat_entity_set_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_threat_entity_set

Deletes the threat entity set that is associated with the specified threatEntitySetId.

DELETE FROM aws.guardduty.threat_entity_sets
WHERE detector_id = '{{ detector_id }}' --required
AND threat_entity_set_id = '{{ threat_entity_set_id }}' --required
AND region = '{{ region }}' --required
;