Values (p.awso.0.9.1.doc.awso.guardduty.Awso

Sourceval service : Awso.Service.t

Sourceval apiVersion : string

Sourceval endpointPrefix : string

Sourceval serviceFullName : string

Sourceval signatureVersion : string

Sourceval protocol : string

Sourceval globalEndpoint : string

Sourceval simple_to_json : ('a -> Awso__Botodata.value) -> 'a -> Yojson.Safe.t

Sourceval composed_to_json : ('a -> Awso__Botodata.value) -> 'a -> Yojson.Safe.t

Sourceval to_query : ('a -> Awso.Client.Query.value) -> 'a -> Awso.Client.Query.t

Source

val structure_to_value_aux : 
  ('a * 'b option) list ->
  f:(('a * 'b) list -> 'c) ->
  [> `Structure of 'c ]

Source

val structure_to_value : 
  ('a * 'b option) list ->
  [> `Structure of ('a * 'b) list ]

Source

val structure_to_wrapped_value : 
  wrapper:'a ->
  response:'a ->
  ('b * 'c option) list ->
  [> `Structure of ('a * [> `Structure of ('b * 'c) list ]) list ]

Sourcemodule String_ : sig ... end

Sourcemodule SensitiveString : sig ... end

Sourcemodule ObservationTexts : sig ... end

Sourcemodule Ec2InstanceUid : sig ... end

Sourcemodule ProductCode : sig ... end

Contains information about the product code for the EC2 instance.

Sourcemodule PrivateIpAddressDetails : sig ... end

Contains other private IP address information of the EC2 instance.

Sourcemodule SecurityGroup : sig ... end

Contains information about the security groups associated with the EC2 instance.

Sourcemodule ContainerUid : sig ... end

Sourcemodule PublicAccessStatus : sig ... end

Sourcemodule PublicAclIgnoreBehavior : sig ... end

Sourcemodule PublicBucketRestrictBehavior : sig ... end

Sourcemodule IndicatorValueString : sig ... end

Sourcemodule Boolean : sig ... end

Sourcemodule Double : sig ... end

Sourcemodule Observations : sig ... end

Contains information about the observed behavior.

Sourcemodule ProfileSubtype : sig ... end

Sourcemodule ProfileType : sig ... end

Sourcemodule Ec2InstanceUids : sig ... end

Sourcemodule ContainerImageUid : sig ... end

Sourcemodule Ec2NetworkInterfaceUids : sig ... end

Sourcemodule IamInstanceProfile : sig ... end

Contains information about the EC2 instance profile.

Sourcemodule ProductCodes : sig ... end

Sourcemodule LaunchTemplateVersion : sig ... end

Sourcemodule Ipv6Addresses : sig ... end

Sourcemodule PrivateIpAddresses : sig ... end

Sourcemodule SecurityGroups : sig ... end

Sourcemodule EcsClusterStatus : sig ... end

Sourcemodule ContainerUids : sig ... end

Sourcemodule EcsLaunchType : sig ... end

Sourcemodule Timestamp : sig ... end

Sourcemodule ClusterStatus : sig ... end

Sourcemodule KubernetesResourcesTypes : sig ... end

Sourcemodule PublicAccessConfiguration : sig ... end

Describes public access policies that apply to the Amazon S3 bucket. For information about each of the following settings, see Blocking public access to your Amazon S3 storage in the Amazon S3 User Guide.

Sourcemodule S3ObjectUids : sig ... end

Sourcemodule IndicatorTitle : sig ... end

Sourcemodule IndicatorType : sig ... end

Sourcemodule IndicatorValues : sig ... end

Sourcemodule ScanFilePath : sig ... end

Contains details of infected file including name, file path and hash.

Sourcemodule NonEmptyString : sig ... end

Sourcemodule VolumeMount : sig ... end

Container volume mount.

Sourcemodule BlockPublicAccess : sig ... end

Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access for more information.

Sourcemodule AccessControlList : sig ... end

Contains information on the current access control policies for the bucket.

Sourcemodule BucketPolicy : sig ... end

Contains information on the current bucket policies for the S3 bucket.

Sourcemodule Integer : sig ... end

Sourcemodule City : sig ... end

Contains information about the city associated with the IP address.

Sourcemodule Country : sig ... end

Contains information about the country where the remote IP address is located.

Sourcemodule GeoLocation : sig ... end

Contains information about the location of the remote IP address. By default, GuardDuty returns Geolocation with Lat and Lon as 0.0.

Sourcemodule Organization : sig ... end

Contains information about the ISP organization of the remote IP address.

Sourcemodule AnomalyObject : sig ... end

Contains information about the unusual anomalies.

Sourcemodule ProcessName : sig ... end

Sourcemodule ProcessPath : sig ... end

Sourcemodule ProcessSha256 : sig ... end

Sourcemodule MfaStatus : sig ... end

Sourcemodule Account : sig ... end

Contains information about the Amazon Web Services account within which the activity took place.

Sourcemodule NetworkDirection : sig ... end

Sourcemodule AccessKey : sig ... end

Contains information about the access keys.

Sourcemodule AutoscalingAutoScalingGroup : sig ... end

Contains information about the Auto Scaling Group involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule CloudformationStack : sig ... end

Contains information about the CloudFormation stack involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule ContainerFindingResource : sig ... end

Contains information about container resources involved in a GuardDuty finding. This structure provides details about containers that were identified as part of suspicious or malicious activity.

Sourcemodule Ec2Image : sig ... end

Contains information about the Amazon EC2 Image involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule Ec2Instance : sig ... end

Details about the potentially impacted Amazon EC2 instance resource.

Sourcemodule Ec2LaunchTemplate : sig ... end

Contains information about the Amazon EC2 launch template involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule Ec2NetworkInterface : sig ... end

Contains information about the elastic network interface of the Amazon EC2 instance.

Sourcemodule Ec2Vpc : sig ... end

Contains information about the Amazon EC2 VPC involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule EcsCluster : sig ... end

Contains information about the Amazon ECS cluster involved in a GuardDuty finding, including cluster identification and status.

Sourcemodule EcsTask : sig ... end

Contains information about Amazon ECS task involved in a GuardDuty finding, including task definition and container identifiers.

Sourcemodule EksCluster : sig ... end

Contains information about the Amazon EKS cluster involved in a GuardDuty finding, including cluster identification, status, and network configuration.

Sourcemodule IamInstanceProfileV2 : sig ... end

Contains information about the IAM instance profile involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.

Sourcemodule KubernetesWorkload : sig ... end

Contains information about Kubernetes workloads involved in a GuardDuty finding, including pods, deployments, and other Kubernetes resources.

Sourcemodule S3Bucket : sig ... end

Contains information about the Amazon S3 bucket policies and encryption.

Sourcemodule S3Object : sig ... end

Contains information about the Amazon S3 object.

Sourcemodule Tag : sig ... end

Contains information about a tag key-value pair.

Sourcemodule Indicator : sig ... end

Contains information about the indicators that include a set of signals observed in an attack sequence.

Sourcemodule FilePaths : sig ... end

Sourcemodule AdditionalInfo : sig ... end

Contains additional information about the detected threat.

Sourcemodule SecurityContext : sig ... end

Container security context.

Sourcemodule VolumeMounts : sig ... end

Sourcemodule HostPath : sig ... end

Represents a pre-existing file or directory on the host machine that the volume maps to.

Sourcemodule AccountLevelPermissions : sig ... end

Contains information about the account level permissions on the S3 bucket.

Sourcemodule BucketLevelPermissions : sig ... end

Contains information about the bucket level permissions for the S3 bucket.

Sourcemodule LocalIpDetails : sig ... end

Contains information about the local IP address of the connection.

Sourcemodule LocalPortDetails : sig ... end

Contains information about the port for the local connection.

Sourcemodule RemoteIpDetails : sig ... end

Contains information about the remote IP address of the connection.

Sourcemodule AnomalyProfileFeatureObjects : sig ... end

Sourcemodule AnomalyUnusualBehaviorFeature : sig ... end

Sourcemodule ActorProcess : sig ... end

Contains information about a process involved in a GuardDuty finding, including process identification, execution details, and file information.

Sourcemodule Session : sig ... end

Contains information about the authenticated session.

Sourcemodule User : sig ... end

Contains information about the user involved in the attack sequence.

Sourcemodule AutonomousSystem : sig ... end

Contains information about the Autonomous System (AS) associated with the network endpoints involved in an attack sequence.

Sourcemodule NetworkConnection : sig ... end

Contains information about the network connection.

Sourcemodule NetworkGeoLocation : sig ... end

Contains information about network endpoint location.

Sourcemodule FindingResourceType : sig ... end

Sourcemodule ResourceData : sig ... end

Contains information about the Amazon Web Services resource that is associated with the activity that prompted GuardDuty to generate a finding.

Sourcemodule Tags : sig ... end

Sourcemodule ActorIds : sig ... end

Sourcemodule EndpointIds : sig ... end

Sourcemodule Indicators : sig ... end

Sourcemodule ResourceUids : sig ... end

Sourcemodule SignalDescription : sig ... end

Sourcemodule SignalType : sig ... end

Sourcemodule ScanThreatName : sig ... end

Contains files infected with the given threat providing details of malware name and severity.

Sourcemodule ItemDetails : sig ... end

Contains detailed information about where a threat was detected.

Sourcemodule ItemPath : sig ... end

Information about the nested item path and hash of the protected resource.

Sourcemodule LineageObject : sig ... end

Information about the runtime process details.

Sourcemodule OrgFeatureAdditionalConfiguration : sig ... end

Sourcemodule DataSourceStatus : sig ... end

Sourcemodule FeatureStatus : sig ... end

Sourcemodule Container : sig ... end

Details of a container.

Sourcemodule Volume : sig ... end

Volume used by the Kubernetes workload.

Sourcemodule Groups : sig ... end

Sourcemodule PermissionConfiguration : sig ... end

Contains information about how permissions are configured for the S3 bucket.

Sourcemodule S3ObjectDetail : sig ... end

Information about the S3 object that was scanned

Sourcemodule PortProbeDetail : sig ... end

Contains information about the port probe details.

Sourcemodule LoginAttribute : sig ... end

Information about the login attempts.

Sourcemodule AnomalyProfileFeatures : sig ... end

Sourcemodule Behavior : sig ... end

Sourcemodule Actor : sig ... end

Information about the actors involved in an attack sequence.

Sourcemodule FindingType : sig ... end

Sourcemodule NetworkEndpoint : sig ... end

Contains information about network endpoints that were observed in the attack sequence.

Sourcemodule ResourceV2 : sig ... end

Contains information about the Amazon Web Services resource that is associated with the GuardDuty finding.

Sourcemodule Signal : sig ... end

Contains information about the signals involved in the attack sequence.

Sourcemodule ScanThreatNames : sig ... end

Sourcemodule ThreatNames : sig ... end

Sourcemodule ItemDetailsList : sig ... end

Sourcemodule ItemPaths : sig ... end

Sourcemodule Long : sig ... end

Sourcemodule Lineage : sig ... end

Sourcemodule TagKey : sig ... end

Sourcemodule TagValue : sig ... end

Sourcemodule Issues : sig ... end

Sourcemodule ManagementType : sig ... end

Sourcemodule AccountId : sig ... end

Sourcemodule Total : sig ... end

Contains the total usage with the corresponding currency unit for that value.

Sourcemodule OrganizationFeatureStatisticsAdditionalConfiguration : sig ... end

Information about the coverage statistic for the additional configuration of the feature.

Sourcemodule EbsVolumesResult : sig ... end

Describes the configuration of scanning EBS volumes as a data source.

Sourcemodule MemberAdditionalConfigurationResult : sig ... end

Information about the additional configuration for the member account.

Sourcemodule VolumeDetail : sig ... end

Contains EBS volume details.

Sourcemodule Containers : sig ... end

Sourcemodule Volumes : sig ... end

Sourcemodule NetworkInterface : sig ... end

Contains information about the elastic network interface of the EC2 instance.

Sourcemodule ImpersonatedUser : sig ... end

Contains information about the impersonated user.

Sourcemodule SessionNameList : sig ... end

Sourcemodule SubnetIds : sig ... end

Sourcemodule DefaultServerSideEncryption : sig ... end

Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption for more information.

Sourcemodule Owner : sig ... end

Contains information on the owner of the bucket.

Sourcemodule PublicAccess : sig ... end

Describes the public access policies that apply to the S3 bucket.

Sourcemodule S3ObjectDetails : sig ... end

Sourcemodule AffectedResources : sig ... end

Sourcemodule DomainDetails : sig ... end

Contains information about the domain.

Sourcemodule RemoteAccountDetails : sig ... end

Contains details about the remote Amazon Web Services account that made the API call.

Sourcemodule SourceIps : sig ... end

Sourcemodule RemotePortDetails : sig ... end

Contains information about the remote port.

Sourcemodule PortProbeDetails : sig ... end

Sourcemodule LoginAttributes : sig ... end

Sourcemodule AnomalyProfiles : sig ... end

Sourcemodule AnomalyUnusual : sig ... end

Contains information about the behavior of the anomaly that is new to GuardDuty.

Sourcemodule Actors : sig ... end

Sourcemodule AdditionalSequenceTypes : sig ... end

Sourcemodule NetworkEndpoints : sig ... end

Sourcemodule Resources : sig ... end

Sourcemodule SequenceDescription : sig ... end

Sourcemodule Signals : sig ... end

Sourcemodule HighestSeverityThreatDetails : sig ... end

Contains details of the highest severity threat detected during scan and number of infected files.

Sourcemodule ScannedItemCount : sig ... end

Total number of scanned files.

Sourcemodule ThreatDetectedByName : sig ... end

Contains details about identified threats organized by threat name.

Sourcemodule ThreatsDetectedItemCount : sig ... end

Contains total number of infected files.

Sourcemodule ThreatIntelligenceDetail : sig ... end

An instance of a threat intelligence detail that constitutes evidence for the finding.

Sourcemodule IncrementalScanDetails : sig ... end

Contains information about the incremental scan configuration.

Sourcemodule TriggerType : sig ... end

Sourcemodule Threat : sig ... end

Information about the detected threats associated with the generated finding.

Sourcemodule FlagsList : sig ... end

Sourcemodule MemoryRegionsList : sig ... end

Sourcemodule ProcessDetails : sig ... end

Information about the observed process.

Sourcemodule OrgFeatureStatus : sig ... end

Sourcemodule ScanConditionPair : sig ... end

Represents the key:value pair to be matched against given resource property.

Sourcemodule Match : sig ... end

Sourcemodule NotMatch : sig ... end

Sourcemodule FeatureAdditionalConfiguration : sig ... end

Sourcemodule LongValue : sig ... end

Sourcemodule AgentDetails : sig ... end

Information about the installed GuardDuty security agent.

Sourcemodule ContainerInstanceDetails : sig ... end

Contains information about the Amazon EC2 instance that is running the Amazon ECS container.

Sourcemodule FargateDetails : sig ... end

Contains information about Amazon Web Services Fargate details associated with an Amazon ECS cluster.

Sourcemodule AddonDetails : sig ... end

Information about the installed EKS add-on (GuardDuty security agent).

Sourcemodule Equals : sig ... end

Sourcemodule NotEquals : sig ... end

Sourcemodule UsageTopAccountResult : sig ... end

Contains information on the total of usage based on the topmost 50 account IDs.

Sourcemodule DataSourceFreeTrial : sig ... end

Contains information about which data sources are enabled for the GuardDuty member account.

Sourcemodule FreeTrialFeatureResult : sig ... end

Sourcemodule OrgFeature : sig ... end

Sourcemodule OrganizationFeatureStatisticsAdditionalConfigurations : sig ... end

Sourcemodule KubernetesAuditLogsConfigurationResult : sig ... end

Describes whether Kubernetes audit logs are enabled as a data source.

Sourcemodule ScanEc2InstanceWithFindingsResult : sig ... end

An object that contains information on the status of whether Malware Protection for EC2 instances with findings will be enabled as a data source.

Sourcemodule MemberAdditionalConfigurationResults : sig ... end

Sourcemodule VolumeDetails : sig ... end

Sourcemodule EcsTaskDetails : sig ... end

Contains information about the task in an ECS cluster.

Sourcemodule NetworkInterfaces : sig ... end

Sourcemodule KubernetesUserDetails : sig ... end

Details about the Kubernetes user involved in a Kubernetes finding.

Sourcemodule KubernetesWorkloadDetails : sig ... end

Details about the Kubernetes workload involved in a Kubernetes finding.

Sourcemodule VpcConfig : sig ... end

Amazon Virtual Private Cloud configuration details associated with your Lambda function.

Sourcemodule S3BucketDetail : sig ... end

Contains information on the S3 bucket.

Sourcemodule AwsApiCallAction : sig ... end

Contains information about the API action.

Sourcemodule DnsRequestAction : sig ... end

Contains information about the DNS_REQUEST action described in this finding.

Sourcemodule KubernetesApiCallAction : sig ... end

Information about the Kubernetes API call action described in this finding.

Sourcemodule KubernetesPermissionCheckedDetails : sig ... end

Information about the Kubernetes API for which you check if you have permission to call.

Sourcemodule KubernetesRoleBindingDetails : sig ... end

Contains information about the role binding that grants the permission defined in a Kubernetes role.

Sourcemodule KubernetesRoleDetails : sig ... end

Information about the Kubernetes role name and role type.

Sourcemodule NetworkConnectionAction : sig ... end

Contains information about the NETWORK_CONNECTION action described in the finding.

Sourcemodule PortProbeAction : sig ... end

Contains information about the PORT_PROBE action described in the finding.

Sourcemodule RdsLoginAttemptAction : sig ... end

Indicates that a login attempt was made to the potentially compromised database from a remote IP address.

Sourcemodule Anomaly : sig ... end

Contains information about the anomalies.

Sourcemodule Sequence : sig ... end

Contains information about the GuardDuty attack sequence finding.

Sourcemodule ScanDetections : sig ... end

Contains a complete view providing malware scan result details.

Sourcemodule ScanType : sig ... end

Sourcemodule Sources : sig ... end

Sourcemodule ThreatIntelligenceDetails : sig ... end

Sourcemodule MalwareProtectionFindingsScanConfiguration : sig ... end

Contains finding configuration details about the malware scan.

Sourcemodule MalwareProtectionScanType : sig ... end

Sourcemodule ScanCategory : sig ... end

Sourcemodule Threats : sig ... end

Sourcemodule RuntimeContext : sig ... end

Additional information about the suspicious activity.

Sourcemodule OrganizationEbsVolumes : sig ... end

Organization-wide EBS volumes scan configuration.

Sourcemodule OrganizationAdditionalConfiguration : sig ... end

A list of additional configurations which will be configured for the organization. Additional configuration applies to only GuardDuty Runtime Monitoring protection plan.

Sourcemodule MemberAdditionalConfiguration : sig ... end

Information about the additional configuration for the member account.

Sourcemodule MapEquals : sig ... end

Sourcemodule Eq : sig ... end

Sourcemodule Matches : sig ... end

Sourcemodule Neq : sig ... end

Sourcemodule NotMatches : sig ... end

Sourcemodule DetectorAdditionalConfiguration : sig ... end

Information about the additional configuration for a feature in your GuardDuty account.

Sourcemodule FilterCondition : sig ... end

Contains information about the condition.

Sourcemodule ListMalwareScansCriterionKey : sig ... end

Sourcemodule CoverageEc2InstanceDetails : sig ... end

Contains information about the Amazon EC2 instance runtime coverage details.

Sourcemodule CoverageEcsClusterDetails : sig ... end

Contains information about Amazon ECS cluster runtime coverage details.

Sourcemodule CoverageEksClusterDetails : sig ... end

Information about the EKS cluster that has a coverage status.

Sourcemodule ResourceType : sig ... end

Sourcemodule CoverageFilterCondition : sig ... end

Represents a condition that when matched will be added to the response of the operation.

Sourcemodule CoverageFilterCriterionKey : sig ... end

Sourcemodule DataSource : sig ... end

Sourcemodule UsageFeature : sig ... end

Sourcemodule UsageTopAccountsByFeatureList : sig ... end

Sourcemodule KubernetesDataSourceFreeTrial : sig ... end

Provides details about the Kubernetes resources when it is enabled as a data source.

Sourcemodule MalwareProtectionDataSourceFreeTrial : sig ... end

Provides details about Malware Protection when it is enabled as a data source.

Sourcemodule FreeTrialFeatureConfigurationResult : sig ... end

Contains information about the free trial period for a feature.

Sourcemodule OrganizationFeatureStatistics : sig ... end

Information about the number of accounts that have enabled a specific feature.

Sourcemodule CloudTrailConfigurationResult : sig ... end

Contains information on the status of CloudTrail as a data source for the detector.

Sourcemodule DNSLogsConfigurationResult : sig ... end

Contains information on the status of DNS logs as a data source.

Sourcemodule FlowLogsConfigurationResult : sig ... end

Contains information on the status of VPC flow logs as a data source.

Sourcemodule KubernetesConfigurationResult : sig ... end

Describes whether any Kubernetes logs will be enabled as a data source.

Sourcemodule MalwareProtectionConfigurationResult : sig ... end

An object that contains information on the status of all Malware Protection data sources.

Sourcemodule S3LogsConfigurationResult : sig ... end

Describes whether S3 data event logs will be enabled as a data source.

Sourcemodule MemberFeaturesConfigurationResult : sig ... end

Contains information about the features for the member account.

Sourcemodule DetectionSource : sig ... end

Sourcemodule PositiveLong : sig ... end

Sourcemodule EbsSnapshot : sig ... end

Contains information about an EBS snapshot that was scanned for malware.

Sourcemodule AccessKeyDetails : sig ... end

Contains information about the access keys.

Sourcemodule EbsSnapshotDetails : sig ... end

Contains details about the EBS snapshot that was scanned for malware.

Sourcemodule EbsVolumeDetails : sig ... end

Contains list of scanned and skipped EBS volumes with details.

Sourcemodule Ec2ImageDetails : sig ... end

Contains details about the EC2 AMI that was scanned.

Sourcemodule EcsClusterDetails : sig ... end

Contains information about the details of the ECS Cluster.

Sourcemodule EksClusterDetails : sig ... end

Details about the EKS cluster involved in a Kubernetes finding.

Sourcemodule InstanceDetails : sig ... end

Contains information about the details of an instance.

Sourcemodule KubernetesDetails : sig ... end

Details about Kubernetes resources such as a Kubernetes user or workload resource involved in a Kubernetes finding.

Sourcemodule LambdaDetails : sig ... end

Information about the Lambda function involved in the finding.

Sourcemodule RdsDbInstanceDetails : sig ... end

Contains information about the resource type RDSDBInstance involved in a GuardDuty finding.

Sourcemodule RdsDbUserDetails : sig ... end

Contains information about the user and authentication details for a database instance involved in the finding.

Sourcemodule RdsLimitlessDbDetails : sig ... end

Contains information about the resource type RDSLimitlessDB that is involved in a GuardDuty finding.

Sourcemodule RecoveryPointDetails : sig ... end

Contains details about the backup recovery point.

Sourcemodule S3BucketDetails : sig ... end

Sourcemodule Action : sig ... end

Contains information about actions.

Sourcemodule Detection : sig ... end

Contains information about the detected behavior.

Sourcemodule DetectorId : sig ... end

Sourcemodule EbsVolumeScanDetails : sig ... end

Contains details from the malware scan that created a finding.

Sourcemodule Evidence : sig ... end

Contains information about the reason that the finding was generated.

Sourcemodule MalwareScanDetails : sig ... end

Information about the malware scan that generated a GuardDuty finding.

Sourcemodule RuntimeDetails : sig ... end

Information about the process and any required context values for a specific finding.

Sourcemodule ServiceAdditionalInfo : sig ... end

Additional information about the generated finding.

Sourcemodule DetectorAdditionalConfigurationResult : sig ... end

Information about the additional configuration.

Sourcemodule OrganizationEbsVolumesResult : sig ... end

An object that contains information on the status of whether EBS volumes scanning will be enabled as a data source for an organization.

Sourcemodule OrganizationAdditionalConfigurationResult : sig ... end

A list of additional configuration which will be configured for the organization.

Sourcemodule InstanceArn : sig ... end

Sourcemodule ScanResult : sig ... end

Sourcemodule CriterionKey : sig ... end

Sourcemodule OrganizationKubernetesAuditLogsConfiguration : sig ... end

Organization-wide Kubernetes audit logs configuration.

Sourcemodule OrganizationScanEc2InstanceWithFindings : sig ... end

Organization-wide EC2 instances with findings scan configuration.

Sourcemodule OrganizationAdditionalConfigurations : sig ... end

Sourcemodule KubernetesAuditLogsConfiguration : sig ... end

Describes whether Kubernetes audit logs are enabled as a data source.

Sourcemodule ScanEc2InstanceWithFindings : sig ... end

Describes whether Malware Protection for EC2 instances with findings will be enabled as a data source.

Sourcemodule MemberAdditionalConfigurations : sig ... end

Sourcemodule ScanCondition : sig ... end

Contains information about the condition.

Sourcemodule ScanCriterionKey : sig ... end

Sourcemodule MalwareProtectionPlanTaggingActionStatus : sig ... end

Sourcemodule MalwareProtectionPlanObjectPrefixesList : sig ... end

Sourcemodule Condition : sig ... end

Contains information about the condition.

Sourcemodule DetectorAdditionalConfigurations : sig ... end

Sourcemodule DetectorFeature : sig ... end

Sourcemodule DestinationType : sig ... end

Sourcemodule PublishingStatus : sig ... end

Sourcemodule AdminStatus : sig ... end

Sourcemodule Email : sig ... end

Sourcemodule MalwareProtectionResourceType : sig ... end

Sourcemodule MalwareProtectionScanStatus : sig ... end

Sourcemodule ScanResultStatus : sig ... end

Sourcemodule ListMalwareScansFilterCriterion : sig ... end

Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account.

Sourcemodule CoverageResourceDetails : sig ... end

Information about the resource for each individual EKS cluster.

Sourcemodule CoverageStatus : sig ... end

Sourcemodule CoverageFilterCriterion : sig ... end

Represents a condition that when matched will be added to the response of the operation.

Sourcemodule UsageAccountResult : sig ... end

Contains information on the total of usage based on account IDs.

Sourcemodule UsageDataSourceResult : sig ... end

Contains information on the result of usage based on data source type.

Sourcemodule UsageFeatureResult : sig ... end

Contains information about the result of the total usage based on the feature.

Sourcemodule UsageResourceResult : sig ... end

Contains information on the sum of usage based on an Amazon Web Services resource.

Sourcemodule UsageTopAccountsResult : sig ... end

Information about the usage statistics, calculated by top accounts by feature.

Sourcemodule DataSourcesFreeTrial : sig ... end

Contains information about which data sources are enabled for the GuardDuty member account.

Sourcemodule FreeTrialFeatureConfigurationsResults : sig ... end

Sourcemodule OrganizationFeatureStatisticsResults : sig ... end

Sourcemodule DataSourceConfigurationsResult : sig ... end

Contains information on the status of data sources for the detector.

Sourcemodule MemberFeaturesConfigurationsResults : sig ... end

Sourcemodule ScanResultThreat : sig ... end

Contains information about a specific threat that was detected during the malware scan.

Sourcemodule ScanStatusReason : sig ... end

Sourcemodule ScannedResourceDetails : sig ... end

Contains additional information about a resource that was scanned.

Sourcemodule AccountStatistics : sig ... end

Represents a list of map of accounts with the number of findings associated with each account.

Sourcemodule DateStatistics : sig ... end

Represents list a map of dates with a count of total findings generated on each date.

Sourcemodule FindingTypeStatistics : sig ... end

Information about each finding type associated with the groupedByFindingType statistics.

Sourcemodule ResourceStatistics : sig ... end

Information about each resource type associated with the groupedByResource statistics.

Sourcemodule SeverityStatistics : sig ... end

Information about severity level for each finding type.

Sourcemodule Resource : sig ... end

Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.

Sourcemodule Service : sig ... end

Contains additional information about the generated finding.

Sourcemodule DetectorAdditionalConfigurationResults : sig ... end

Sourcemodule DetectorFeatureResult : sig ... end

Sourcemodule OrganizationKubernetesAuditLogsConfigurationResult : sig ... end

The current configuration of Kubernetes audit logs as a data source for the organization.

Sourcemodule OrganizationScanEc2InstanceWithFindingsResult : sig ... end

An object that contains information on the status of scanning EC2 instances with findings for an organization.

Sourcemodule OrganizationAdditionalConfigurationResults : sig ... end

Sourcemodule ResourceDetails : sig ... end

Represents the resources that were scanned in the scan entry.

Sourcemodule ScanResultDetails : sig ... end

Represents the result of the scan.

Sourcemodule ScanStatus : sig ... end

Sourcemodule TriggerDetails : sig ... end

Represents the reason the scan was triggered.

Sourcemodule FilterCriterion : sig ... end

Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account can view the scan entries for all of its member accounts. However, each member account can view the scan entries only for their own account.

Sourcemodule OrganizationKubernetesConfiguration : sig ... end

Organization-wide Kubernetes data sources configurations.

Sourcemodule OrganizationMalwareProtectionConfiguration : sig ... end

Organization-wide Malware Protection configurations.

Sourcemodule OrganizationS3LogsConfiguration : sig ... end

Describes whether S3 data event logs will be automatically enabled for new members of the organization.

Sourcemodule OrganizationFeatureConfiguration : sig ... end

A list of features which will be configured for the organization.

Sourcemodule UnprocessedAccount : sig ... end

Contains information about the accounts that weren't processed.

Sourcemodule KubernetesConfiguration : sig ... end

Describes whether any Kubernetes data sources are enabled.

Sourcemodule MalwareProtectionConfiguration : sig ... end

Describes whether Malware Protection will be enabled as a data source.

Sourcemodule S3LogsConfiguration : sig ... end

Describes whether S3 data event logs will be enabled as a data source.

Sourcemodule MemberFeaturesConfiguration : sig ... end

Contains information about the features for the member account.

Sourcemodule ScanCriterion : sig ... end

Sourcemodule MalwareProtectionPlanTaggingAction : sig ... end

Information about adding tags to the scanned S3 object after the scan result.

Sourcemodule UpdateS3BucketResource : sig ... end

Information about the protected S3 bucket resource.

Sourcemodule FindingId : sig ... end

Sourcemodule Criterion : sig ... end

Sourcemodule DetectorFeatureConfiguration : sig ... end

Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

Sourcemodule RecoveryPoint : sig ... end

Contains information about the recovery point configuration for scanning backup data from Amazon Web Services Backup.

Sourcemodule Destination : sig ... end

Contains information about the publishing destination, including the ID, type, and status.

Sourcemodule AdminAccount : sig ... end

The account within the organization specified as the GuardDuty delegated administrator.

Sourcemodule Member : sig ... end

Contains information about the member account.

Sourcemodule MalwareScan : sig ... end

Contains information about a particular malware scan.

Sourcemodule ListMalwareScansFilterCriterionList : sig ... end

Sourcemodule OrderBy : sig ... end

Sourcemodule MalwareProtectionPlanSummary : sig ... end

Information about the Malware Protection plan resource.

Sourcemodule Invitation : sig ... end

Contains information about the invitation to become a member account.

Sourcemodule FilterName : sig ... end

Sourcemodule CoverageResource : sig ... end

Information about the resource of the GuardDuty account.

Sourcemodule CoverageFilterCriterionList : sig ... end

Sourcemodule CoverageSortKey : sig ... end

Sourcemodule UsageAccountResultList : sig ... end

Sourcemodule UsageDataSourceResultList : sig ... end

Sourcemodule UsageFeatureResultList : sig ... end

Sourcemodule UsageResourceResultList : sig ... end

Sourcemodule UsageTopAccountsResultList : sig ... end

Sourcemodule AccountIds : sig ... end

Sourcemodule DataSourceList : sig ... end

Sourcemodule ResourceList : sig ... end

Sourcemodule UsageFeatureList : sig ... end

Sourcemodule AccountFreeTrialInfo : sig ... end

Provides details of the GuardDuty member account that uses a free trial service.

Sourcemodule OrganizationStatistics : sig ... end

Information about the coverage statistics of the features for the entire Amazon Web Services organization. When you create a new Amazon Web Services organization, it might take up to 24 hours to generate the statistics summary for this organization.

Sourcemodule MemberDataSourceConfiguration : sig ... end

Contains information on which data sources are enabled for a member account.

Sourcemodule ScanResultThreats : sig ... end

Sourcemodule ScanConfigurationRecoveryPoint : sig ... end

Contains information about the recovery point configuration used in the scan.

Sourcemodule ScannedResource : sig ... end

Contains information about a resource that was scanned as part of the malware scan operation.

Sourcemodule CreateS3BucketResource : sig ... end

Information about the protected S3 bucket resource.

Sourcemodule MalwareProtectionPlanStatusReason : sig ... end

Information about the issue code and message associated to the status of your Malware Protection plan.

Sourcemodule CountBySeverity : sig ... end

Sourcemodule GroupedByAccount : sig ... end

Sourcemodule GroupedByDate : sig ... end

Sourcemodule GroupedByFindingType : sig ... end

Sourcemodule GroupedByResource : sig ... end

Sourcemodule GroupedBySeverity : sig ... end

Sourcemodule FindingStatisticType : sig ... end

Sourcemodule Finding : sig ... end

Contains information about the finding that is generated when abnormal or suspicious activity is detected.

Sourcemodule DetectorFeatureConfigurationResult : sig ... end

Contains information about a GuardDuty feature. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

Sourcemodule CountByCoverageStatus : sig ... end

Sourcemodule CountByResourceType : sig ... end

Sourcemodule CoverageStatisticsType : sig ... end

Sourcemodule OrganizationKubernetesConfigurationResult : sig ... end

The current configuration of all Kubernetes data sources for the organization.

Sourcemodule OrganizationMalwareProtectionConfigurationResult : sig ... end

An object that contains information on the status of all Malware Protection data source for an organization.

Sourcemodule OrganizationS3LogsConfigurationResult : sig ... end

The current configuration of S3 data event logs as a data source for the organization.

Sourcemodule OrganizationFeatureConfigurationResult : sig ... end

A list of features which will be configured for the organization.

Sourcemodule Scan : sig ... end

Contains information about malware scans associated with GuardDuty Malware Protection for EC2.

Sourcemodule FilterCriterionList : sig ... end

Sourcemodule AccountDetail : sig ... end

Contains information about the account.

Sourcemodule BadRequestException : sig ... end

A bad request exception object.

Sourcemodule InternalServerErrorException : sig ... end

An internal server error exception object.

Sourcemodule ExpectedBucketOwner : sig ... end

Sourcemodule Location : sig ... end

Sourcemodule Name : sig ... end

Sourcemodule AccessDeniedException : sig ... end

An access denied exception object.

Sourcemodule DestinationProperties : sig ... end

Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.

Sourcemodule AutoEnableMembers : sig ... end

Sourcemodule OrganizationDataSourceConfigurations : sig ... end

An object that contains information on which data sources will be configured to be automatically enabled for new members within the organization.

Sourcemodule OrganizationFeaturesConfigurations : sig ... end

Sourcemodule UnprocessedAccounts : sig ... end

Sourcemodule DataSourceConfigurations : sig ... end

Contains information about which data sources are enabled.

Sourcemodule MemberFeaturesConfigurations : sig ... end

Sourcemodule EbsSnapshotPreservation : sig ... end

Sourcemodule ScanResourceCriteria : sig ... end

Contains information about criteria used to filter resources before triggering malware scan.

Sourcemodule MalwareProtectionPlanActions : sig ... end

Information about whether the tags will be added to the S3 object after scanning.

Sourcemodule UpdateProtectedResource : sig ... end

Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource.

Sourcemodule Feedback : sig ... end

Sourcemodule FindingIds : sig ... end

Sourcemodule FilterAction : sig ... end

Sourcemodule FilterDescription : sig ... end

Sourcemodule FilterRank : sig ... end

Sourcemodule FindingCriteria : sig ... end

Contains information about the criteria used for querying findings.

Sourcemodule DetectorFeatureConfigurations : sig ... end

Sourcemodule FindingPublishingFrequency : sig ... end

Sourcemodule GuardDutyArn : sig ... end

Sourcemodule TagKeyList : sig ... end

Sourcemodule TagMap : sig ... end

Sourcemodule ConflictException : sig ... end

A request conflict exception object.

Sourcemodule ClientToken : sig ... end

Sourcemodule ResourceArn : sig ... end

Sourcemodule StartMalwareScanConfiguration : sig ... end

Contains information about the configuration to be used for the malware scan.

Sourcemodule S3ObjectForSendObjectMalwareScan : sig ... end

The S3 object path to initiate a scan, including bucket name, object key, and optional version ID.

Sourcemodule TrustedEntitySetIds : sig ... end

Sourcemodule MaxResults : sig ... end

Sourcemodule ThreatIntelSetIds : sig ... end

Sourcemodule ThreatEntitySetIds : sig ... end

Sourcemodule Destinations : sig ... end

Sourcemodule AdminAccounts : sig ... end

Sourcemodule Members : sig ... end

Sourcemodule MalwareScans : sig ... end

Sourcemodule ListMalwareScansFilterCriteria : sig ... end

Represents the criteria used to filter the malware scan entries.

Sourcemodule SortCriteria : sig ... end

Contains information about the criteria used for sorting findings.

Sourcemodule MalwareProtectionPlansSummary : sig ... end

Sourcemodule Invitations : sig ... end

Sourcemodule IpSetIds : sig ... end

Sourcemodule FilterNames : sig ... end

Sourcemodule DetectorIds : sig ... end

Sourcemodule CoverageResources : sig ... end

Sourcemodule CoverageFilterCriteria : sig ... end

Represents the criteria used in the filter.

Sourcemodule CoverageSortCriteria : sig ... end

Information about the sorting criteria used in the coverage statistics.

Sourcemodule UsageStatistics : sig ... end

Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.

Sourcemodule UsageCriteria : sig ... end

Contains information about the criteria used to query usage statistics.

Sourcemodule UsageStatisticType : sig ... end

Sourcemodule TrustedEntitySetFormat : sig ... end

Sourcemodule TrustedEntitySetStatus : sig ... end

Sourcemodule ThreatIntelSetFormat : sig ... end

Sourcemodule ThreatIntelSetStatus : sig ... end

Sourcemodule ThreatEntitySetFormat : sig ... end

Sourcemodule ThreatEntitySetStatus : sig ... end

Sourcemodule AccountFreeTrialInfos : sig ... end

Sourcemodule OrganizationDetails : sig ... end

Information about GuardDuty coverage statistics for members in your Amazon Web Services organization.

Sourcemodule MemberDataSourceConfigurations : sig ... end

Sourcemodule Master : sig ... end

Contains information about the administrator account and invitation.

Sourcemodule GetMalwareScanResultDetails : sig ... end

Contains information about the results of the malware scan.

Sourcemodule NonNegativeInteger : sig ... end

Sourcemodule ResourceNotFoundException : sig ... end

The requested resource can't be found.

Sourcemodule ScanConfiguration : sig ... end

Contains information about the configuration used for the malware scan.

Sourcemodule ScannedResources : sig ... end

Sourcemodule CreateProtectedResource : sig ... end

Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource.

Sourcemodule MalwareProtectionPlanStatus : sig ... end

Sourcemodule MalwareProtectionPlanStatusReasonsList : sig ... end

Sourcemodule IpSetFormat : sig ... end

Sourcemodule IpSetStatus : sig ... end

Sourcemodule FindingStatistics : sig ... end

Contains information about finding statistics.

Sourcemodule FindingStatisticTypes : sig ... end

Sourcemodule GroupByType : sig ... end

Sourcemodule MaxResults100 : sig ... end

Sourcemodule Findings : sig ... end

Sourcemodule DetectorFeatureConfigurationsResults : sig ... end

Sourcemodule DetectorStatus : sig ... end

Sourcemodule CoverageStatistics : sig ... end

Information about the coverage statistics for a resource.

Sourcemodule CoverageStatisticsTypeList : sig ... end

Sourcemodule Administrator : sig ... end

Contains information about the administrator account and invitation.

Sourcemodule OrganizationDataSourceConfigurationsResult : sig ... end

An object that contains information on which data sources are automatically enabled for new members within the organization.

Sourcemodule OrganizationFeaturesConfigurationsResults : sig ... end

Sourcemodule Scans : sig ... end

Sourcemodule FilterCriteria : sig ... end

Represents the criteria to be used in the filter for describing scan entries.

Sourcemodule IntegerValueWithMax : sig ... end

Sourcemodule FindingTypes : sig ... end

Sourcemodule AccountDetails : sig ... end

Sourcemodule UnprocessedDataSourcesResult : sig ... end

Specifies the names of the data sources that couldn't be enabled.

Sourcemodule UpdateTrustedEntitySetResponse : sig ... end

Updates the trusted entity set associated with the specified trustedEntitySetId.

Sourcemodule UpdateTrustedEntitySetRequest : sig ... end

Updates the trusted entity set associated with the specified trustedEntitySetId.

Sourcemodule UpdateThreatIntelSetResponse : sig ... end

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Sourcemodule UpdateThreatIntelSetRequest : sig ... end

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Sourcemodule UpdateThreatEntitySetResponse : sig ... end

Updates the threat entity set associated with the specified threatEntitySetId.

Sourcemodule UpdateThreatEntitySetRequest : sig ... end

Updates the threat entity set associated with the specified threatEntitySetId.

Sourcemodule UpdatePublishingDestinationResponse : sig ... end

Updates information about the publishing destination specified by the destinationId.

Sourcemodule UpdatePublishingDestinationRequest : sig ... end

Updates information about the publishing destination specified by the destinationId.

Sourcemodule UpdateOrganizationConfigurationResponse : sig ... end

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateOrganizationConfigurationRequest : sig ... end

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateMemberDetectorsResponse : sig ... end

Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateMemberDetectorsRequest : sig ... end

Contains information on member accounts to be updated. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateMalwareScanSettingsResponse : sig ... end

Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateMalwareScanSettingsRequest : sig ... end

Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateMalwareProtectionPlanRequest : sig ... end

Updates an existing Malware Protection plan resource.

Sourcemodule UpdateIPSetResponse : sig ... end

Updates the IPSet specified by the IPSet ID.

Sourcemodule UpdateIPSetRequest : sig ... end

Updates the IPSet specified by the IPSet ID.

Sourcemodule UpdateFindingsFeedbackResponse : sig ... end

Marks the specified GuardDuty findings as useful or not useful.

Sourcemodule UpdateFindingsFeedbackRequest : sig ... end

Marks the specified GuardDuty findings as useful or not useful.

Sourcemodule UpdateFilterResponse : sig ... end

Updates the filter specified by the filter name.

Sourcemodule UpdateFilterRequest : sig ... end

Updates the filter specified by the filter name.

Sourcemodule UpdateDetectorResponse : sig ... end

Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UpdateDetectorRequest : sig ... end

Updates the GuardDuty detector specified by the detector ID. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule UntagResourceResponse : sig ... end

Removes tags from a resource.

Sourcemodule UntagResourceRequest : sig ... end

Removes tags from a resource.

Sourcemodule UnarchiveFindingsResponse : sig ... end

Unarchives GuardDuty findings specified by the findingIds.

Sourcemodule UnarchiveFindingsRequest : sig ... end

Unarchives GuardDuty findings specified by the findingIds.

Sourcemodule TagResourceResponse : sig ... end

Adds tags to a resource.

Sourcemodule TagResourceRequest : sig ... end

Adds tags to a resource.

Sourcemodule StopMonitoringMembersResponse : sig ... end

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Sourcemodule StopMonitoringMembersRequest : sig ... end

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Sourcemodule StartMonitoringMembersResponse : sig ... end

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Sourcemodule StartMonitoringMembersRequest : sig ... end

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Sourcemodule StartMalwareScanResponse : sig ... end

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule StartMalwareScanRequest : sig ... end

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account if the resourceArn belongs to an EC2 instance. When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see ListMalwareScans and GetMalwareScan. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule SendObjectMalwareScanResponse : sig ... end

Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule SendObjectMalwareScanRequest : sig ... end

Initiates a malware scan for a specific S3 object. This API allows you to perform on-demand malware scanning of individual objects in S3 buckets that have Malware Protection for S3 enabled. When you use this API, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule ListTrustedEntitySetsResponse : sig ... end

Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.

Sourcemodule ListTrustedEntitySetsRequest : sig ... end

Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.

Sourcemodule ListThreatIntelSetsResponse : sig ... end

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Sourcemodule ListThreatIntelSetsRequest : sig ... end

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Sourcemodule ListThreatEntitySetsResponse : sig ... end

Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.

Sourcemodule ListThreatEntitySetsRequest : sig ... end

Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.

Sourcemodule ListTagsForResourceResponse : sig ... end

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Sourcemodule ListTagsForResourceRequest : sig ... end

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Sourcemodule ListPublishingDestinationsResponse : sig ... end

Returns a list of publishing destinations associated with the specified detectorId.

Sourcemodule ListPublishingDestinationsRequest : sig ... end

Returns a list of publishing destinations associated with the specified detectorId.

Sourcemodule ListOrganizationAdminAccountsResponse : sig ... end

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

Sourcemodule ListOrganizationAdminAccountsRequest : sig ... end

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

Sourcemodule ListMembersResponse : sig ... end

Lists details about all member accounts for the current GuardDuty administrator account.

Sourcemodule ListMembersRequest : sig ... end

Lists details about all member accounts for the current GuardDuty administrator account.

Sourcemodule ListMalwareScansResponse : sig ... end

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

Sourcemodule ListMalwareScansRequest : sig ... end

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all of its members' accounts.

Sourcemodule ListMalwareProtectionPlansResponse : sig ... end

Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.

Sourcemodule ListMalwareProtectionPlansRequest : sig ... end

Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.

Sourcemodule ListInvitationsResponse : sig ... end

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

Sourcemodule ListInvitationsRequest : sig ... end

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

Sourcemodule ListIPSetsResponse : sig ... end

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

Sourcemodule ListIPSetsRequest : sig ... end

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

Sourcemodule ListFindingsResponse : sig ... end

Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Sourcemodule ListFindingsRequest : sig ... end

Lists GuardDuty findings for the specified detector ID. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Sourcemodule ListFiltersResponse : sig ... end

Returns a paginated list of the current filters.

Sourcemodule ListFiltersRequest : sig ... end

Returns a paginated list of the current filters.

Sourcemodule ListDetectorsResponse : sig ... end

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

Sourcemodule ListDetectorsRequest : sig ... end

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

Sourcemodule ListCoverageResponse : sig ... end

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

Sourcemodule ListCoverageRequest : sig ... end

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

Sourcemodule InviteMembersResponse : sig ... end

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule InviteMembersRequest : sig ... end

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule GetUsageStatisticsResponse : sig ... end

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

Sourcemodule GetUsageStatisticsRequest : sig ... end

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

Sourcemodule GetTrustedEntitySetResponse : sig ... end

Retrieves the trusted entity set associated with the specified trustedEntitySetId.

Sourcemodule GetTrustedEntitySetRequest : sig ... end

Retrieves the trusted entity set associated with the specified trustedEntitySetId.

Sourcemodule GetThreatIntelSetResponse : sig ... end

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Sourcemodule GetThreatIntelSetRequest : sig ... end

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Sourcemodule GetThreatEntitySetResponse : sig ... end

Retrieves the threat entity set associated with the specified threatEntitySetId.

Sourcemodule GetThreatEntitySetRequest : sig ... end

Retrieves the threat entity set associated with the specified threatEntitySetId.

Sourcemodule GetRemainingFreeTrialDaysResponse : sig ... end

Provides the number of days left for each data source used in the free trial period.

Sourcemodule GetRemainingFreeTrialDaysRequest : sig ... end

Provides the number of days left for each data source used in the free trial period.

Sourcemodule GetOrganizationStatisticsResponse : sig ... end

Retrieves how many active member accounts have each feature enabled within GuardDuty. Only a delegated GuardDuty administrator of an organization can run this API. When you create a new organization, it might take up to 24 hours to generate the statistics for the entire organization.

Sourcemodule GetMembersResponse : sig ... end

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Sourcemodule GetMembersRequest : sig ... end

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Sourcemodule GetMemberDetectorsResponse : sig ... end

Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMemberDetectorsRequest : sig ... end

Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMasterAccountResponse : sig ... end

Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.

Sourcemodule GetMasterAccountRequest : sig ... end

Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.

Sourcemodule GetMalwareScanSettingsResponse : sig ... end

Returns the details of the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMalwareScanSettingsRequest : sig ... end

Returns the details of the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMalwareScanResponse : sig ... end

Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMalwareScanRequest : sig ... end

Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetMalwareProtectionPlanResponse : sig ... end

Retrieves the Malware Protection plan details associated with a Malware Protection plan ID.

Sourcemodule GetMalwareProtectionPlanRequest : sig ... end

Retrieves the Malware Protection plan details associated with a Malware Protection plan ID.

Sourcemodule GetInvitationsCountResponse : sig ... end

Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.

Sourcemodule GetInvitationsCountRequest : sig ... end

Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.

Sourcemodule GetIPSetResponse : sig ... end

Retrieves the IPSet specified by the ipSetId.

Sourcemodule GetIPSetRequest : sig ... end

Retrieves the IPSet specified by the ipSetId.

Sourcemodule GetFindingsStatisticsResponse : sig ... end

Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Sourcemodule GetFindingsStatisticsRequest : sig ... end

Lists GuardDuty findings statistics for the specified detector ID. You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy. There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Sourcemodule GetFindingsResponse : sig ... end

Describes Amazon GuardDuty findings specified by finding IDs.

Sourcemodule GetFindingsRequest : sig ... end

Describes Amazon GuardDuty findings specified by finding IDs.

Sourcemodule GetFilterResponse : sig ... end

Returns the details of the filter specified by the filter name.

Sourcemodule GetFilterRequest : sig ... end

Returns the details of the filter specified by the filter name.

Sourcemodule GetDetectorResponse : sig ... end

Retrieves a GuardDuty detector specified by the detectorId. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetDetectorRequest : sig ... end

Retrieves a GuardDuty detector specified by the detectorId. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule GetCoverageStatisticsResponse : sig ... end

Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources.

Sourcemodule GetCoverageStatisticsRequest : sig ... end

Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources.

Sourcemodule GetAdministratorAccountResponse : sig ... end

Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account. Based on the type of account that runs this API, the following list shows how the API behavior varies: When the GuardDuty administrator account runs this API, it will return success (HTTP 200) but no content. When a member account runs this API, it will return the details of the GuardDuty administrator account that is associated with this calling member account. When an individual account (not associated with an organization) runs this API, it will return success (HTTP 200) but no content.

Sourcemodule GetAdministratorAccountRequest : sig ... end

Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account. Based on the type of account that runs this API, the following list shows how the API behavior varies: When the GuardDuty administrator account runs this API, it will return success (HTTP 200) but no content. When a member account runs this API, it will return the details of the GuardDuty administrator account that is associated with this calling member account. When an individual account (not associated with an organization) runs this API, it will return success (HTTP 200) but no content.

Sourcemodule EnableOrganizationAdminAccountResponse : sig ... end

Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation.

Sourcemodule EnableOrganizationAdminAccountRequest : sig ... end

Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation.

Sourcemodule DisassociateMembersResponse : sig ... end

Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule DisassociateMembersRequest : sig ... end

Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule DisassociateFromMasterAccountResponse : sig ... end

Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

Sourcemodule DisassociateFromMasterAccountRequest : sig ... end

Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

Sourcemodule DisassociateFromAdministratorAccountResponse : sig ... end

Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.

Sourcemodule DisassociateFromAdministratorAccountRequest : sig ... end

Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.

Sourcemodule DisableOrganizationAdminAccountResponse : sig ... end

Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation.

Sourcemodule DisableOrganizationAdminAccountRequest : sig ... end

Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation.

Sourcemodule DescribePublishingDestinationResponse : sig ... end

Returns information about the publishing destination specified by the provided destinationId.

Sourcemodule DescribePublishingDestinationRequest : sig ... end

Returns information about the publishing destination specified by the provided destinationId.

Sourcemodule DescribeOrganizationConfigurationResponse : sig ... end

Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule DescribeOrganizationConfigurationRequest : sig ... end

Returns information about the account selected as the delegated administrator for GuardDuty. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule DescribeMalwareScansResponse : sig ... end

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule DescribeMalwareScansRequest : sig ... end

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule DeleteTrustedEntitySetResponse : sig ... end

Deletes the trusted entity set that is associated with the specified trustedEntitySetId.

Sourcemodule DeleteTrustedEntitySetRequest : sig ... end

Deletes the trusted entity set that is associated with the specified trustedEntitySetId.

Sourcemodule DeleteThreatIntelSetResponse : sig ... end

Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

Sourcemodule DeleteThreatIntelSetRequest : sig ... end

Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

Sourcemodule DeleteThreatEntitySetResponse : sig ... end

Deletes the threat entity set that is associated with the specified threatEntitySetId.

Sourcemodule DeleteThreatEntitySetRequest : sig ... end

Deletes the threat entity set that is associated with the specified threatEntitySetId.

Sourcemodule DeletePublishingDestinationResponse : sig ... end

Deletes the publishing definition with the specified destinationId.

Sourcemodule DeletePublishingDestinationRequest : sig ... end

Deletes the publishing definition with the specified destinationId.

Sourcemodule DeleteMembersResponse : sig ... end

Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization.

Sourcemodule DeleteMembersRequest : sig ... end

Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization.

Sourcemodule DeleteMalwareProtectionPlanRequest : sig ... end

Deletes the Malware Protection plan ID associated with the Malware Protection plan resource. Use this API only when you no longer want to protect the resource associated with this Malware Protection plan ID.

Sourcemodule DeleteInvitationsResponse : sig ... end

Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Sourcemodule DeleteInvitationsRequest : sig ... end

Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Sourcemodule DeleteIPSetResponse : sig ... end

Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

Sourcemodule DeleteIPSetRequest : sig ... end

Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

Sourcemodule DeleteFilterResponse : sig ... end

Deletes the filter specified by the filter name.

Sourcemodule DeleteFilterRequest : sig ... end

Deletes the filter specified by the filter name.

Sourcemodule DeleteDetectorResponse : sig ... end

Deletes an Amazon GuardDuty detector that is specified by the detector ID.

Sourcemodule DeleteDetectorRequest : sig ... end

Deletes an Amazon GuardDuty detector that is specified by the detector ID.

Sourcemodule DeclineInvitationsResponse : sig ... end

Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Sourcemodule DeclineInvitationsRequest : sig ... end

Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Sourcemodule CreateTrustedEntitySetResponse : sig ... end

Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts.

Sourcemodule CreateTrustedEntitySetRequest : sig ... end

Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts.

Sourcemodule CreateThreatIntelSetResponse : sig ... end

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Sourcemodule CreateThreatIntelSetRequest : sig ... end

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Sourcemodule CreateThreatEntitySetResponse : sig ... end

Creates a new threat entity set. In a threat entity set, you can provide known malicious IP addresses and domains for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts.

Sourcemodule CreateThreatEntitySetRequest : sig ... end

Creates a new threat entity set. In a threat entity set, you can provide known malicious IP addresses and domains for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts.

Sourcemodule CreateSampleFindingsResponse : sig ... end

Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.

Sourcemodule CreateSampleFindingsRequest : sig ... end

Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.

Sourcemodule CreatePublishingDestinationResponse : sig ... end

Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.

Sourcemodule CreatePublishingDestinationRequest : sig ... end

Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.

Sourcemodule CreateMembersResponse : sig ... end

Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization. As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member. When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule CreateMembersRequest : sig ... end

Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization. As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member. When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration. If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API. When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Sourcemodule CreateMalwareProtectionPlanResponse : sig ... end

Creates a new Malware Protection plan for the protected resource. When you create a Malware Protection plan, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule CreateMalwareProtectionPlanRequest : sig ... end

Creates a new Malware Protection plan for the protected resource. When you create a Malware Protection plan, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Sourcemodule CreateIPSetResponse : sig ... end

Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.

Sourcemodule CreateIPSetRequest : sig ... end

Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.

Sourcemodule CreateFilterResponse : sig ... end

Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.

Sourcemodule CreateFilterRequest : sig ... end

Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.

Sourcemodule CreateDetectorResponse : sig ... end

Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default. When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default. When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule CreateDetectorRequest : sig ... end

Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default. When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default. When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING. Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Sourcemodule ArchiveFindingsResponse : sig ... end

Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.

Sourcemodule ArchiveFindingsRequest : sig ... end

Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.

Sourcemodule AcceptInvitationResponse : sig ... end

Accepts the invitation to be monitored by a GuardDuty administrator account.

Sourcemodule AcceptInvitationRequest : sig ... end

Accepts the invitation to be monitored by a GuardDuty administrator account.

Sourcemodule AcceptAdministratorInvitationResponse : sig ... end

Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.

Sourcemodule AcceptAdministratorInvitationRequest : sig ... end

Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.