threat_intel_sets

Creates, updates, deletes, gets or lists a threat_intel_sets resource.

Overview

Name	threat_intel_sets
Type	Resource
Id	aws.guardduty.threat_intel_sets

Fields

The following fields are returned by SELECT queries:

get_threat_intel_set

Name	Datatype	Description
expected_bucket_owner	string	The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during ThreatIntelSet creation or update.
format	string	The format of the threatIntelSet. (TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)
location	string	The URI of the file that contains the ThreatIntelSet.
name	string	A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
status	string	The status of threatIntelSet file uploaded. (INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)
tags	object	The tags of the threat list resource.

list_threat_intel_sets

Name	Datatype	Description
threat_intel_set_id	string	The IDs of the ThreatIntelSet resources.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_threat_intel_set	select	detector_id, threat_intel_set_id, region		Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.
list_threat_intel_sets	select	detector_id, region	maxResults, nextToken	Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.
create_threat_intel_set	insert	detector_id, region, Activate		Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.
update_threat_intel_set	update	detector_id, threat_intel_set_id, region		Updates the ThreatIntelSet specified by the ThreatIntelSet ID.
delete_threat_intel_set	delete	detector_id, threat_intel_set_id, region		Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
threat_intel_set_id	string	The unique ID of the threatIntelSet that you want to delete.
maxResults	integer	You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
nextToken	string	You can use this parameter to paginate results in the response. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

get_threat_intel_set

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

SELECT
expected_bucket_owner,
format,
location,
name,
status,
tags
FROM aws.guardduty.threat_intel_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND threat_intel_set_id = '{{ threat_intel_set_id }}' -- required
AND region = '{{ region }}' -- required
;

list_threat_intel_sets

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

SELECT
threat_intel_set_id
FROM aws.guardduty.threat_intel_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_threat_intel_set

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

INSERT INTO aws.guardduty.threat_intel_sets (
Name,
Format,
Location,
Activate,
ClientToken,
Tags,
ExpectedBucketOwner,
detector_id,
region
)
SELECT 
'{{ Name }}',
'{{ Format }}',
'{{ Location }}',
{{ Activate }} /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ ExpectedBucketOwner }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
threat_intel_set_id
;

Manifest

# Description fields are for documentation purposes
- name: threat_intel_sets
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the threat_intel_sets resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the threat_intel_sets resource.
  - name: Name
    value: "{{ Name }}"
  - name: Format
    value: "{{ Format }}"
    valid_values: ['TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE']
  - name: Location
    value: "{{ Location }}"
  - name: Activate
    value: {{ Activate }}
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"
  - name: ExpectedBucketOwner
    value: "{{ ExpectedBucketOwner }}"

UPDATE examples

update_threat_intel_set

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

UPDATE aws.guardduty.threat_intel_sets
SET 
Name = '{{ Name }}',
Location = '{{ Location }}',
Activate = {{ Activate }},
ExpectedBucketOwner = '{{ ExpectedBucketOwner }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND threat_intel_set_id = '{{ threat_intel_set_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_threat_intel_set

Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

DELETE FROM aws.guardduty.threat_intel_sets
WHERE detector_id = '{{ detector_id }}' --required
AND threat_intel_set_id = '{{ threat_intel_set_id }}' --required
AND region = '{{ region }}' --required
;