Module Awso_guardduty_syncSource

Contains information about the product code for the EC2 instance.

Contains other private IP address information of the EC2 instance.

Contains information about the security groups associated with the EC2 instance.

Contains information about the observed behavior.

Contains information about the EC2 instance profile.

Describes public access policies that apply to the Amazon S3 bucket. For information about each of the following settings, see Blocking public access to your Amazon S3 storage in the Amazon S3 User Guide.

Contains details of infected file including name, file path and hash.

Container volume mount.

Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access for more information.

Contains information on the current access control policies for the bucket.

Contains information on the current bucket policies for the S3 bucket.

Contains information about the city associated with the IP address.

Contains information about the country where the remote IP address is located.

Contains information about the location of the remote IP address. By default, GuardDuty returns Geolocation with Lat and Lon as 0.0.

Contains information about the ISP organization of the remote IP address.

Contains information about the unusual anomalies.

Contains information about the Amazon Web Services account within which the activity took place.

Contains information about the access keys.

Contains information about the Auto Scaling Group involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Contains information about the CloudFormation stack involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Contains information about container resources involved in a GuardDuty finding. This structure provides details about containers that were identified as part of suspicious or malicious activity.

Contains information about the Amazon EC2 Image involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Details about the potentially impacted Amazon EC2 instance resource.

Contains information about the Amazon EC2 launch template involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Contains information about the elastic network interface of the Amazon EC2 instance.

Contains information about the Amazon EC2 VPC involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Contains information about the Amazon ECS cluster involved in a GuardDuty finding, including cluster identification and status.

Contains information about Amazon ECS task involved in a GuardDuty finding, including task definition and container identifiers.

Contains information about the Amazon EKS cluster involved in a GuardDuty finding, including cluster identification, status, and network configuration.

Contains information about the IAM instance profile involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Contains information about Kubernetes workloads involved in a GuardDuty finding, including pods, deployments, and other Kubernetes resources.

Contains information about the Amazon S3 bucket policies and encryption.

Contains information about the Amazon S3 object.

Contains information about a tag key-value pair.

Contains information about the indicators that include a set of signals observed in an attack sequence.

Contains additional information about the detected threat.

Container security context.

Represents a pre-existing file or directory on the host machine that the volume maps to.

Contains information about the account level permissions on the S3 bucket.

Contains information about the bucket level permissions for the S3 bucket.

Contains information about the local IP address of the connection.

Contains information about the port for the local connection.

Contains information about the remote IP address of the connection.

Contains information about a process involved in a GuardDuty finding, including process identification, execution details, and file information.

Contains information about the authenticated session.

Contains information about the user involved in the attack sequence.

Contains information about the Autonomous System (AS) associated with the network endpoints involved in an attack sequence.

Contains information about the network connection.

Contains information about network endpoint location.

Contains information about the Amazon Web Services resource that is associated with the activity that prompted GuardDuty to generate a finding.

Contains files infected with the given threat providing details of malware name and severity.

Contains detailed information about where a threat was detected.

Information about the nested item path and hash of the protected resource.

Information about the runtime process details.

Details of a container.

Volume used by the Kubernetes workload.

Contains information about how permissions are configured for the S3 bucket.

Information about the S3 object that was scanned

Contains information about the port probe details.

Information about the login attempts.

Information about the actors involved in an attack sequence.

Contains information about network endpoints that were observed in the attack sequence.

Contains information about the Amazon Web Services resource that is associated with the GuardDuty finding.

Contains information about the signals involved in the attack sequence.

Contains the total usage with the corresponding currency unit for that value.

Information about the coverage statistic for the additional configuration of the feature.

Describes the configuration of scanning EBS volumes as a data source.

Information about the additional configuration for the member account.

Contains EBS volume details.

Contains information about the elastic network interface of the EC2 instance.

Contains information about the impersonated user.

Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption for more information.

Contains information on the owner of the bucket.

Describes the public access policies that apply to the S3 bucket.

Contains information about the domain.

Contains details about the remote Amazon Web Services account that made the API call.

Contains information about the remote port.

Contains information about the behavior of the anomaly that is new to GuardDuty.

Contains details of the highest severity threat detected during scan and number of infected files.

Total number of scanned files.

Contains details about identified threats organized by threat name.

Contains total number of infected files.

An instance of a threat intelligence detail that constitutes evidence for the finding.

Contains information about the incremental scan configuration.

Information about the detected threats associated with the generated finding.

Information about the observed process.

Represents the key:value pair to be matched against given resource property.

Information about the installed GuardDuty security agent.

Contains information about the Amazon EC2 instance that is running the Amazon ECS container.

Contains information about Amazon Web Services Fargate details associated with an Amazon ECS cluster.

Information about the installed EKS add-on (GuardDuty security agent).

Contains information on the total of usage based on the topmost 50 account IDs.

Contains information about which data sources are enabled for the GuardDuty member account.

Describes whether Kubernetes audit logs are enabled as a data source.

An object that contains information on the status of whether Malware Protection for EC2 instances with findings will be enabled as a data source.

Contains information about the task in an ECS cluster.

Details about the Kubernetes user involved in a Kubernetes finding.

Details about the Kubernetes workload involved in a Kubernetes finding.

Amazon Virtual Private Cloud configuration details associated with your Lambda function.

Contains information on the S3 bucket.

Contains information about the API action.

Contains information about the DNS_REQUEST action described in this finding.

Information about the Kubernetes API call action described in this finding.

Information about the Kubernetes API for which you check if you have permission to call.

Contains information about the role binding that grants the permission defined in a Kubernetes role.

Information about the Kubernetes role name and role type.

Contains information about the NETWORK_CONNECTION action described in the finding.

Contains information about the PORT_PROBE action described in the finding.

Indicates that a login attempt was made to the potentially compromised database from a remote IP address.

Contains information about the anomalies.

Contains information about the GuardDuty attack sequence finding.

Contains a complete view providing malware scan result details.

Contains finding configuration details about the malware scan.

Additional information about the suspicious activity.

Organization-wide EBS volumes scan configuration.

A list of additional configurations which will be configured for the organization. Additional configuration applies to only GuardDuty Runtime Monitoring protection plan.

Information about the additional configuration for the member account.

Information about the additional configuration for a feature in your GuardDuty account.

Contains information about the condition.

Contains information about the Amazon EC2 instance runtime coverage details.

Contains information about Amazon ECS cluster runtime coverage details.

Information about the EKS cluster that has a coverage status.

Represents a condition that when matched will be added to the response of the operation.

Provides details about the Kubernetes resources when it is enabled as a data source.

Provides details about Malware Protection when it is enabled as a data source.

Contains information about the free trial period for a feature.

Information about the number of accounts that have enabled a specific feature.

Contains information on the status of CloudTrail as a data source for the detector.

Contains information on the status of DNS logs as a data source.

Contains information on the status of VPC flow logs as a data source.

Describes whether any Kubernetes logs will be enabled as a data source.

An object that contains information on the status of all Malware Protection data sources.

Describes whether S3 data event logs will be enabled as a data source.

Contains information about the features for the member account.

Contains information about an EBS snapshot that was scanned for malware.

Contains information about the access keys.

Contains details about the EBS snapshot that was scanned for malware.

Contains list of scanned and skipped EBS volumes with details.

Contains details about the EC2 AMI that was scanned.

Contains information about the details of the ECS Cluster.

Details about the EKS cluster involved in a Kubernetes finding.

Contains information about the details of an instance.

Details about Kubernetes resources such as a Kubernetes user or workload resource involved in a Kubernetes finding.

Information about the Lambda function involved in the finding.

Contains information about the resource type RDSDBInstance involved in a GuardDuty finding.

Contains information about the user and authentication details for a database instance involved in the finding.

Contains information about the resource type RDSLimitlessDB that is involved in a GuardDuty finding.

Contains details about the backup recovery point.

Contains information about actions.

Contains information about the detected behavior.

Contains details from the malware scan that created a finding.

Contains information about the reason that the finding was generated.

Information about the malware scan that generated a GuardDuty finding.

Information about the process and any required context values for a specific finding.

Additional information about the generated finding.

Information about the additional configuration.

An object that contains information on the status of whether EBS volumes scanning will be enabled as a data source for an organization.

A list of additional configuration which will be configured for the organization.

Organization-wide Kubernetes audit logs configuration.

Organization-wide EC2 instances with findings scan configuration.

Describes whether Kubernetes audit logs are enabled as a data source.

Describes whether Malware Protection for EC2 instances with findings will be enabled as a data source.

Contains information about the condition.

Contains information about the condition.

Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account.

Information about the resource for each individual EKS cluster.

Represents a condition that when matched will be added to the response of the operation.

Contains information on the total of usage based on account IDs.

Contains information on the result of usage based on data source type.

Contains information about the result of the total usage based on the feature.

Contains information on the sum of usage based on an Amazon Web Services resource.

Information about the usage statistics, calculated by top accounts by feature.

Contains information about which data sources are enabled for the GuardDuty member account.

Contains information on the status of data sources for the detector.

Contains information about a specific threat that was detected during the malware scan.

Contains additional information about a resource that was scanned.

Represents a list of map of accounts with the number of findings associated with each account.

Represents list a map of dates with a count of total findings generated on each date.

Information about each finding type associated with the groupedByFindingType statistics.

Information about each resource type associated with the groupedByResource statistics.

Information about severity level for each finding type.

Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.

Contains additional information about the generated finding.

The current configuration of Kubernetes audit logs as a data source for the organization.

An object that contains information on the status of scanning EC2 instances with findings for an organization.

Represents the resources that were scanned in the scan entry.

Represents the result of the scan.

Represents the reason the scan was triggered.

Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account.

Organization-wide Kubernetes data sources configurations.

Organization-wide Malware Protection configurations.

Describes whether S3 data event logs will be automatically enabled for new members of the organization.

A list of features which will be configured for the organization.

Contains information about the accounts that weren't processed.

Describes whether any Kubernetes data sources are enabled.

Describes whether Malware Protection will be enabled as a data source.

Describes whether S3 data event logs will be enabled as a data source.

Contains information about the features for the member account.

Information about adding tags to the scanned S3 object after the scan result.

Information about the protected S3 bucket resource.

Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

Contains information about the recovery point configuration for scanning backup data from Amazon Web Services Backup.

Contains information about the publishing destination, including the ID, type, and status.

The account within the organization specified as the GuardDuty delegated administrator.

Contains information about the member account.

Contains information about a particular malware scan.

Information about the Malware Protection plan resource.

Contains information about the invitation to become a member account.

Information about the resource of the GuardDuty account.

Provides details of the GuardDuty member account that uses a free trial service.

Information about the coverage statistics of the features for the entire Amazon Web Services organization. When you create a new Amazon Web Services organization, it might take up to 24 hours to generate the statistics summary for this organization.

Contains information on which data sources are enabled for a member account.

Contains information about the recovery point configuration used in the scan.

Contains information about a resource that was scanned as part of the malware scan operation.

Information about the protected S3 bucket resource.

Information about the issue code and message associated to the status of your Malware Protection plan.

Contains information about the finding that is generated when abnormal or suspicious activity is detected.

Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

The current configuration of all Kubernetes data sources for the organization.

An object that contains information on the status of all Malware Protection data source for an organization.

The current configuration of S3 data event logs as a data source for the organization.

A list of features which will be configured for the organization.

Contains information about malware scans associated with GuardDuty Malware Protection for EC2.

Contains information about the account.

A bad request exception object.

An internal server error exception object.

An access denied exception object.

Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.

An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.

Contains information about which data sources are enabled.

Contains information about criteria used to filter resources before triggering malware scan.

Information about whether the tags will be added to the S3 object after scanning.

Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource.

Contains information about the criteria used for querying findings.

A request conflict exception object.

Contains information about the configuration to be used for the malware scan.

The S3 object path to initiate a scan, including bucket name, object key, and optional version ID.

Represents the criteria used to filter the malware scan entries.

Contains information about the criteria used for sorting findings.

Represents the criteria used in the filter.

Information about the sorting criteria used in the coverage statistics.

Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.

Contains information about the criteria used to query usage statistics.

Information about GuardDuty coverage statistics for members in your Amazon Web Services organization.

Contains information about the administrator account and invitation.

Contains information about the results of the malware scan.

The requested resource can't be found.

Contains information about the configuration used for the malware scan.

Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource.

Contains information about finding statistics.

Information about the coverage statistics for a resource.

Contains information about the administrator account and invitation.

An object that contains information on which data sources are automatically enabled for new members within the organization.

Represents the criteria to be used in the filter for describing scan entries.

Specifies the names of the data sources that couldn't be enabled.

Updates the trusted entity set associated with the specified trustedEntitySetId.

Updates the trusted entity set associated with the specified trustedEntitySetId.

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Updates the threat entity set associated with the specified threatEntitySetId.

Updates the threat entity set associated with the specified threatEntitySetId.

Updates information about the publishing destination specified by the destinationId.

Updates information about the publishing destination specified by the destinationId.

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Updates an existing Malware Protection plan resource.

Updates the IPSet specified by the IPSet ID.

Updates the IPSet specified by the IPSet ID.

Marks the specified GuardDuty findings as useful or not useful.

Marks the specified GuardDuty findings as useful or not useful.

Updates the filter specified by the filter name.

Updates the filter specified by the filter name.

Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Removes tags from a resource.

Removes tags from a resource.

Unarchives GuardDuty findings specified by the findingIds.

Unarchives GuardDuty findings specified by the findingIds.

Adds tags to a resource.

Adds tags to a resource.

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.

Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.

Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Returns a list of publishing destinations associated with the specified detectorId.

Returns a list of publishing destinations associated with the specified detectorId.

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

Lists details about all member accounts for the current GuardDuty administrator account.

Lists details about all member accounts for the current GuardDuty administrator account.

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.

Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Returns a paginated list of the current filters.

Returns a paginated list of the current filters.

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

Retrieves the trusted entity set associated with the specified trustedEntitySetId.

Retrieves the trusted entity set associated with the specified trustedEntitySetId.

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Retrieves the threat entity set associated with the specified threatEntitySetId.

Retrieves the threat entity set associated with the specified threatEntitySetId.

Provides the number of days left for each data source used in the free trial period.

Provides the number of days left for each data source used in the free trial period.

Retrieves how many active member accounts have each feature enabled within GuardDuty. Only a delegated GuardDuty administrator of an organization can run this API. When you create a new organization, it might take up to 24 hours to generate the statistics for the entire organization.

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.