Amazon GuardDuty Detector API
The Detector API from Amazon GuardDuty — 37 operation(s) for detector.
Amazon GuardDuty Detector API is one of 4 APIs that Amazon GuardDuty publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
This API exposes 1 JSON Schema definition.
Tagged areas include Detector. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, a getting-started guide, pricing, an API reference, authentication docs, and 1 JSON Schema.
This API exposes 57 operations across 37 paths, and defines 334 schemas. It is described by OpenAPI 3.2.0, at version 1.0.0.
Requests are made against 4 base URLs: http://guardduty.{region}.amazonaws.com, https://guardduty.{region}.amazonaws.com, http://guardduty.{region}.amazonaws.com.cn, https://guardduty.{region}.amazonaws.com.cn.
57 operations
37 paths
334 schemas
5 DELETE15 GET37 POST
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 1
Amazon GuardDuty Detector API declares
1 security scheme
for authenticating requests.
An API key is passed in the header as Authorization (hmac).
By default, every request must be authenticated.
hmac— Amazon Signature authorization v4
Paths & Operations 57
Across 37 paths, the API surfaces 57 operations — 5 DELETE, 15 GET, 37 POST. Each is listed below with its method, path, parameters, and response codes.
Detector 57
POST
/detector/{detectorId}/administrator
Amazon GuardDuty Accept Administrator Invitation
GET
/detector/{detectorId}/administrator
Amazon GuardDuty Get Administrator Account
POST
/detector/{detectorId}/masterdeprecated
Amazon GuardDuty Accept Invitation
GET
/detector/{detectorId}/masterdeprecated
Amazon GuardDuty Get Master Account
POST
/detector/{detectorId}/findings/archive
Amazon GuardDuty Archive Findings
POST
/detector
Amazon GuardDuty Create Detector
GET
/detector
Amazon GuardDuty List Detectors
POST
/detector/{detectorId}/filter
Amazon GuardDuty Create Filter
GET
/detector/{detectorId}/filter
Amazon GuardDuty List Filters
POST
/detector/{detectorId}/ipset
Amazon GuardDuty Create I P Set
GET
/detector/{detectorId}/ipset
Amazon GuardDuty List I P Sets
POST
/detector/{detectorId}/member
Amazon GuardDuty Create Members
GET
/detector/{detectorId}/member
Amazon GuardDuty List Members
POST
/detector/{detectorId}/publishingDestination
Amazon GuardDuty Create Publishing Destination
GET
/detector/{detectorId}/publishingDestination
Amazon GuardDuty List Publishing Destinations
POST
/detector/{detectorId}/findings/create
Amazon GuardDuty Create Sample Findings
POST
/detector/{detectorId}/threatintelset
Amazon GuardDuty Create Threat Intel Set
GET
/detector/{detectorId}/threatintelset
Amazon GuardDuty List Threat Intel Sets
DELETE
/detector/{detectorId}
Amazon GuardDuty Delete Detector
GET
/detector/{detectorId}
Amazon GuardDuty Get Detector
POST
/detector/{detectorId}
Amazon GuardDuty Update Detector
DELETE
/detector/{detectorId}/filter/{filterName}
Amazon GuardDuty Delete Filter
GET
/detector/{detectorId}/filter/{filterName}
Amazon GuardDuty Get Filter
POST
/detector/{detectorId}/filter/{filterName}
Amazon GuardDuty Update Filter
DELETE
/detector/{detectorId}/ipset/{ipSetId}
Amazon GuardDuty Delete I P Set
GET
/detector/{detectorId}/ipset/{ipSetId}
Amazon GuardDuty Get I P Set
POST
/detector/{detectorId}/ipset/{ipSetId}
Amazon GuardDuty Update I P Set
POST
/detector/{detectorId}/member/delete
Amazon GuardDuty Delete Members
DELETE
/detector/{detectorId}/publishingDestination/{destinationId}
Amazon GuardDuty Delete Publishing Destination
GET
/detector/{detectorId}/publishingDestination/{destinationId}
Amazon GuardDuty Describe Publishing Destination
POST
/detector/{detectorId}/publishingDestination/{destinationId}
Amazon GuardDuty Update Publishing Destination
DELETE
/detector/{detectorId}/threatintelset/{threatIntelSetId}
Amazon GuardDuty Delete Threat Intel Set
GET
/detector/{detectorId}/threatintelset/{threatIntelSetId}
Amazon GuardDuty Get Threat Intel Set
POST
/detector/{detectorId}/threatintelset/{threatIntelSetId}
Amazon GuardDuty Update Threat Intel Set
POST
/detector/{detectorId}/malware-scans
Amazon GuardDuty Describe Malware Scans
GET
/detector/{detectorId}/admin
Amazon GuardDuty Describe Organization Configuration
POST
/detector/{detectorId}/admin
Amazon GuardDuty Update Organization Configuration
POST
/detector/{detectorId}/administrator/disassociate
Amazon GuardDuty Disassociate from Administrator Account
POST
/detector/{detectorId}/master/disassociatedeprecated
Amazon GuardDuty Disassociate from Master Account
POST
/detector/{detectorId}/member/disassociate
Amazon GuardDuty Disassociate Members
POST
/detector/{detectorId}/coverage/statistics
Amazon GuardDuty Get Coverage Statistics
POST
/detector/{detectorId}/findings/get
Amazon GuardDuty Get Findings
POST
/detector/{detectorId}/findings/statistics
Amazon GuardDuty Get Findings Statistics
GET
/detector/{detectorId}/malware-scan-settings
Amazon GuardDuty Get Malware Scan Settings
POST
/detector/{detectorId}/malware-scan-settings
Amazon GuardDuty Update Malware Scan Settings
POST
/detector/{detectorId}/member/detector/get
Amazon GuardDuty Get Member Detectors
POST
/detector/{detectorId}/member/get
Amazon GuardDuty Get Members
POST
/detector/{detectorId}/freeTrial/daysRemaining
Amazon GuardDuty Get Remaining Free Trial Days
POST
/detector/{detectorId}/usage/statistics
Amazon GuardDuty Get Usage Statistics
POST
/detector/{detectorId}/member/invite
Amazon GuardDuty Invite Members
POST
/detector/{detectorId}/coverage
Amazon GuardDuty List Coverage
POST
/detector/{detectorId}/findings
Amazon GuardDuty List Findings
POST
/detector/{detectorId}/member/start
Amazon GuardDuty Start Monitoring Members
POST
/detector/{detectorId}/member/stop
Amazon GuardDuty Stop Monitoring Members
POST
/detector/{detectorId}/findings/unarchive
Amazon GuardDuty Unarchive Findings
POST
/detector/{detectorId}/findings/feedback
Amazon GuardDuty Update Findings Feedback
POST
/detector/{detectorId}/member/detector/update
Amazon GuardDuty Update Member Detectors
Schemas 334
The contract defines 334 schemas that model the data the API accepts and returns. The most detailed are RuntimeContext (20 properties), Finding (15 properties), Service (14 properties), Scan (14 properties). Each schema is shown below with its type and property counts.
CoverageFilterCriterionKey
string
CoverageEksClusterDetails
object
Information about the EKS cluster that has a coverage status.
4 properties
OrganizationAdditionalConfiguration
object
A list of additional configurations which will be configured for the organization.
2 properties
Sources
array
CoverageFilterCriterion
object
Represents a condition that when matched will be added to the response of the operation.
2 properties
DataSourceList
array
AwsApiCallAction
object
Contains information about the API action.
9 properties
FreeTrialFeatureConfigurationResult
object
Contains information about the free trial period for a feature.
2 properties
IpSetFormat
string
FeatureAdditionalConfiguration
string
ScanEc2InstanceWithFindings
object
Describes whether Malware Protection for EC2 instances with findings will be enabled as a data source.
1 property
DetectorStatus
string
DataSourcesFreeTrial
object
Contains information about which data sources are enabled for the GuardDuty member account.
6 properties
ThreatIntelSetStatus
string
Resource
object
Contains information about the Amazon Web Services resource associated with the activity that prompted GuardDuty to generate a finding.
12 properties
RuntimeContext
object
Additional information about the suspicious activity.
20 properties
Scan
object
Contains information about a malware scan.
14 properties
DeleteFilterResponse
object
VolumeDetails
array
ScanEc2InstanceWithFindingsResult
object
An object that contains information on the status of whether Malware Protection for EC2 instances with findings will be enabled as a data source.
1 property
StartMonitoringMembersResponse
object
1 property
1 required
CountBySeverity
object
GetThreatIntelSetResponse
object
5 properties
4 required
OrganizationAdditionalConfigurationResults
array
NetworkInterface
object
Contains information about the elastic network interface of the EC2 instance.
10 properties
DetectorIds
array
ListCoverageResponse
object
2 properties
1 required
ScanResult
string
Volume
object
Volume used by the Kubernetes workload.
2 properties
LocalIpDetails
object
Contains information about the local IP address of the connection.
1 property
PermissionConfiguration
object
Contains information about how permissions are configured for the S3 bucket.
2 properties
VolumeMount
object
Container volume mount.
2 properties
StopMonitoringMembersResponse
object
1 property
1 required
DefaultServerSideEncryption
object
Contains information on the server side encryption method used in the S3 bucket. See S3 Server-Side Encryption for more information.
2 properties
GetFindingsResponse
object
1 property
1 required
MemberDataSourceConfiguration
object
Contains information on which data sources are enabled for a member account.
3 properties
1 required
Boolean
boolean
ResourceDetails
object
Represents the resources that were scanned in the scan entry.
1 property
PrivateIpAddresses
array
ScanFilePath
object
Contains details of infected file including name, file path and hash.
4 properties
OrganizationS3LogsConfiguration
object
Describes whether S3 data event logs will be automatically enabled for new members of the organization.
1 property
1 required
OrganizationMalwareProtectionConfigurationResult
object
An object that contains information on the status of all Malware Protection data source for an organization.
1 property
VpcConfig
object
Amazon Virtual Private Cloud configuration details associated with your Lambda function.
3 properties
ScanResourceCriteria
object
Contains information about criteria used to filter resources before triggering malware scan.
2 properties
Service
object
Contains additional information about the generated finding.
14 properties
MemberDataSourceConfigurations
array
DisassociateMembersResponse
object
1 property
1 required
Member
object
Contains information about the member account.
8 properties
5 required
Location
string
ListMembersResponse
object
2 properties
TagValue
string
UsageResourceResultList
array
FilterNames
array
OrganizationS3LogsConfigurationResult
object
The current configuration of S3 data event logs as a data source for the organization.
1 property
1 required
LoginAttribute
object
Information about the login attempts.
4 properties
DetectorAdditionalConfigurationResult
object
Information about the additional configuration.
3 properties
MalwareProtectionDataSourceFreeTrial
object
Provides details about Malware Protection when it is enabled as a data source.
1 property
LocalPortDetails
object
Contains information about the port for the local connection.
2 properties
Volumes
array
AccountLevelPermissions
object
Contains information about the account level permissions on the S3 bucket.
1 property
CoverageStatistics
object
Information about the coverage statistics for a resource.
2 properties
UnprocessedAccounts
array
Integer
integer
UsageDataSourceResultList
array
AccountIds
array
OrganizationKubernetesConfigurationResult
object
The current configuration of all Kubernetes data sources for the organization.
1 property
1 required
FreeTrialFeatureResult
string
Destination
object
Contains information about the publishing destination, including the ID, type, and status.
3 properties
3 required
HighestSeverityThreatDetails
object
Contains details of the highest severity threat detected during scan and number of infected files.
3 properties
Owner
object
Contains information on the owner of the bucket.
1 property
AccountDetail
object
Contains information about the account.
2 properties
2 required
IamInstanceProfile
object
Contains information about the EC2 instance profile.
2 properties
FlagsList
array
MemberAdditionalConfiguration
object
Information about the additional configuration for the member account.
2 properties
UpdatePublishingDestinationResponse
object
DisassociateFromMasterAccountResponse
object
This output is deprecated, use DisassociateFromAdministratorAccountResponse instead
KubernetesAuditLogsConfigurationResult
object
Describes whether Kubernetes audit logs are enabled as a data source.
1 property
1 required
GetCoverageStatisticsResponse
object
1 property
InstanceDetails
object
Contains information about the details of an instance.
13 properties
MemberAdditionalConfigurations
array
FindingStatistics
object
Contains information about finding statistics.
1 property
DestinationType
string
FilterAction
string
IpSetIds
array
BlockPublicAccess
object
Contains information on how the bucker owner's S3 Block Public Access settings are being applied to the S3 bucket. See S3 Block Public Access for more informat…
4 properties
GetRemainingFreeTrialDaysResponse
object
2 properties
Master
object
Contains information about the administrator account and invitation.
4 properties
NetworkInterfaces
array
Total
object
Contains the total usage with the corresponding currency unit for that value.
2 properties
Findings
array
OrganizationAdditionalConfigurations
array
InternalServerErrorException
InviteMembersResponse
object
1 property
1 required
S3BucketDetails
array
GetUsageStatisticsResponse
object
2 properties
OrgFeature
string
OrganizationScanEc2InstanceWithFindings
object
Organization-wide EC2 instances with findings scan configuration.
1 property
CreateSampleFindingsResponse
object
KubernetesAuditLogsConfiguration
object
Describes whether Kubernetes audit logs are enabled as a data source.
1 property
1 required
DetectorAdditionalConfiguration
object
Information about the additional configuration for a feature in your GuardDuty account.
2 properties
BucketLevelPermissions
object
Contains information about the bucket level permissions for the S3 bucket.
3 properties
SubnetIds
array
SecurityGroup
object
Contains information about the security groups associated with the EC2 instance.
2 properties
AffectedResources
object
GetAdministratorAccountResponse
object
1 property
1 required
UsageAccountResult
object
Contains information on the total of usage based on account IDs.
2 properties
GetDetectorResponse
object
8 properties
2 required
DetectorAdditionalConfigurations
array
Tag
object
Contains information about a tag associated with the EC2 instance.
2 properties
CoverageResources
array
ScanConditionPair
object
Represents key, value pair to be matched against given resource property.
2 properties
1 required
DetectorFeature
string
NetworkConnectionAction
object
Contains information about the NETWORKCONNECTION action described in the finding.
7 properties
Double
number
Groups
array
ScannedItemCount
object
Total number of scanned files.
3 properties
ThreatsDetectedItemCount
object
Contains total number of infected files.
1 property
BadRequestException
ThreatIntelligenceDetails
array
FilterRank
integer
ScanCondition
object
Contains information about the condition.
1 property
1 required
DeletePublishingDestinationResponse
object
ProductCodes
array
OrganizationFeatureConfiguration
object
A list of features which will be configured for the organization.
3 properties
RdsDbUserDetails
object
Contains information about the user and authentication details for a database instance involved in the finding.
5 properties
AccountFreeTrialInfo
object
Provides details of the GuardDuty member account that uses a free trial service.
3 properties
DetectorId
string
AccessControlList
object
Contains information on the current access control policies for the bucket.
2 properties
CoverageFilterCondition
object
Represents a condition that when matched will be added to the response of the operation.
2 properties
FindingType
string
PublicAccess
object
Describes the public access policies that apply to the S3 bucket.
2 properties
UpdateMemberDetectorsResponse
object
1 property
1 required
SecurityGroups
array
ScanThreatName
object
Contains files infected with the given threat providing details of malware name and severity.
4 properties
EbsVolumesResult
object
Describes the configuration of scanning EBS volumes as a data source.
2 properties
OrganizationKubernetesAuditLogsConfigurationResult
object
The current configuration of Kubernetes audit logs as a data source for the organization.
1 property
1 required
CreateFilterResponse
object
1 property
1 required
CoverageStatisticsType
string
ScanDetections
object
Contains a complete view providing malware scan result details.
4 properties
ListFindingsResponse
object
2 properties
1 required
IpSetStatus
string
GetMembersResponse
object
2 properties
2 required
CreateThreatIntelSetResponse
object
1 property
1 required
DataSourceFreeTrial
object
Contains information about which data sources are enabled for the GuardDuty member account.
1 property
OrganizationFeaturesConfigurationsResults
array
MemberFeaturesConfiguration
object
Contains information about the features for the member account.
3 properties
ThreatNames
array
UsageFeature
string
CountByCoverageStatus
object
ListDetectorsResponse
object
2 properties
1 required
DataSourceConfigurationsResult
object
Contains information on the status of data sources for the detector.
6 properties
4 required
ListPublishingDestinationsResponse
object
2 properties
1 required
FlowLogsConfigurationResult
object
Contains information on the status of VPC flow logs as a data source.
1 property
1 required
Email
string
ListThreatIntelSetsResponse
object
2 properties
1 required
FilterCriterionList
array
MemberFeaturesConfigurationsResults
array
KubernetesUserDetails
object
Details about the Kubernetes user involved in a Kubernetes finding.
3 properties
PortProbeDetails
array
FindingCriteria
object
Contains information about the criteria used for querying findings.
1 property
KubernetesDataSourceFreeTrial
object
Provides details about the Kubernetes resources when it is enabled as a data source.
1 property
ScanCriterion
object
Represents a map of resource properties that match specified conditions and values when triggering malware scans.
LineageObject
object
Information about the runtime process details.
9 properties
UsageFeatureList
array
ThreatIntelSetIds
array
ResourceType
string
Administrator
object
Contains information about the administrator account and invitation.
4 properties
OrganizationDataSourceConfigurationsResult
object
An object that contains information on which data sources are automatically enabled for new members within the organization.
3 properties
1 required
Name
string
DeleteDetectorResponse
object
GetIPSetResponse
object
5 properties
4 required
EksClusterDetails
object
Details about the EKS cluster involved in a Kubernetes finding.
6 properties
S3LogsConfiguration
object
Describes whether S3 data event logs will be enabled as a data source.
1 property
1 required
DescribeOrganizationConfigurationResponse
object
6 properties
1 required
ThreatDetectedByName
object
Contains details about identified threats organized by threat name.
4 properties
SourceIps
array
DescribePublishingDestinationResponse
object
5 properties
5 required
PrivateIpAddressDetails
object
Contains other private IP address information of the EC2 instance.
2 properties
UsageFeatureResult
object
Contains information about the result of the total usage based on the feature.
2 properties
DestinationProperties
object
Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
2 properties
OrganizationEbsVolumesResult
object
An object that contains information on the status of whether EBS volumes scanning will be enabled as a data source for an organization.
1 property
UsageStatistics
object
Contains the result of GuardDuty usage. If a UsageStatisticType is provided the result for other types will be null.
5 properties
MemoryRegionsList
array
OrganizationKubernetesAuditLogsConfiguration
object
Organization-wide Kubernetes audit logs configuration.
1 property
1 required
ScanStatus
string
UpdateThreatIntelSetResponse
object
InstanceArn
string
DescribeMalwareScansResponse
object
2 properties
1 required
Destinations
array
KubernetesConfigurationResult
object
Describes whether any Kubernetes logs will be enabled as a data source.
1 property
1 required
DnsRequestAction
object
Contains information about the DNSREQUEST action described in this finding.
3 properties
DNSLogsConfigurationResult
object
Contains information on the status of DNS logs as a data source.
1 property
1 required
OrgFeatureStatus
string
SecurityContext
object
Container security context.
1 property
MemberAdditionalConfigurationResult
object
Information about the additional configuration for the member account.
3 properties
MapEquals
array
GetFindingsStatisticsResponse
object
1 property
1 required
PortProbeAction
object
Contains information about the PORTPROBE action described in the finding.
2 properties
S3BucketDetail
object
Contains information on the S3 bucket.
8 properties
AccountId
string
Container
object
Details of a container.
7 properties
String
string
OrganizationEbsVolumes
object
Organization-wide EBS volumes scan configuration.
1 property
UsageResourceResult
object
Contains information on the sum of usage based on an Amazon Web Services resource.
2 properties
DetectorFeatureResult
string
CoverageResourceDetails
object
Information about the resource for each individual EKS cluster.
2 properties
NonEmptyString
string
BucketPolicy
object
Contains information on the current bucket policies for the S3 bucket.
2 properties
UpdateIPSetResponse
object
FindingId
string
DetectorFeatureConfiguration
object
Contains information about a GuardDuty feature.
3 properties
PositiveLong
integer
KubernetesConfiguration
object
Describes whether any Kubernetes data sources are enabled.
1 property
1 required
EcsTaskDetails
object
Contains information about the task in an ECS cluster.
10 properties
OrgFeatureAdditionalConfiguration
string
CoverageFilterCriterionList
array
KubernetesDetails
object
Details about Kubernetes resources such as a Kubernetes user or workload resource involved in a Kubernetes finding.
2 properties
CreateDetectorResponse
object
2 properties
PublishingStatus
string
DisassociateFromAdministratorAccountResponse
object
Organization
object
Contains information about the ISP organization of the remote IP address.
4 properties
EbsSnapshotPreservation
string
UnprocessedAccount
object
Contains information about the accounts that weren't processed.
2 properties
2 required
ListFiltersResponse
object
2 properties
1 required
CoverageSortKey
string
UnarchiveFindingsResponse
object
ProductCode
object
Contains information about the product code for the EC2 instance.
2 properties
TagMap
object
FindingIds
array
CountByResourceType
object
AutoEnableMembers
string
CreateIPSetResponse
object
1 property
1 required
UsageDataSourceResult
object
Contains information on the result of usage based on data source type.
2 properties
Eq
array
CriterionKey
string
DeleteIPSetResponse
object
DataSourceStatus
string
DetectorAdditionalConfigurationResults
array
Ipv6Addresses
array
AccountFreeTrialInfos
array
UpdateFindingsFeedbackResponse
object
TagKey
string
UpdateOrganizationConfigurationResponse
object
EbsVolumeScanDetails
object
Contains details from the malware scan that created a finding.
6 properties
GetMasterAccountResponse
object
This output is deprecated, use GetAdministratorAccountResponse instead
1 property
1 required
EbsVolumeDetails
object
Contains list of scanned and skipped EBS volumes with details.
2 properties
CreatePublishingDestinationResponse
object
1 property
1 required
OrganizationKubernetesConfiguration
object
Organization-wide Kubernetes data sources configurations.
1 property
1 required
Finding
object
Contains information about the finding, which is generated when abnormal or suspicious activity is detected.
15 properties
10 required
MemberFeaturesConfigurationResult
object
Contains information about the features for the member account.
4 properties
AcceptInvitationResponse
object
This output is deprecated, use AcceptAdministratorInvitationResponse instead
ProcessDetails
object
Information about the observed process.
13 properties
ListIPSetsResponse
object
2 properties
1 required
CoverageResource
object
Information about the resource of the GuardDuty account.
7 properties
GetFilterResponse
object
6 properties
3 required
ScanThreatNames
array
PortProbeDetail
object
Contains information about the port probe details.
3 properties
KubernetesApiCallAction
object
Information about the Kubernetes API call action described in this finding.
7 properties
RemoteIpDetails
object
Contains information about the remote IP address of the connection.
5 properties
CloudTrailConfigurationResult
object
Contains information on the status of CloudTrail as a data source for the detector.
1 property
1 required
MemberAdditionalConfigurationResults
array
UnprocessedDataSourcesResult
object
Specifies the names of the data sources that couldn't be enabled.
1 property
RdsDbInstanceDetails
object
Contains information about the resource type RDSDBInstance involved in a GuardDuty finding.
6 properties
HostPath
object
Represents a pre-existing file or directory on the host machine that the volume maps to.
1 property
OrganizationFeatureConfigurationResult
object
A list of features which will be configured for the organization.
3 properties
OrganizationAdditionalConfigurationResult
object
A list of additional configuration which will be configured for the organization.
2 properties
OrganizationScanEc2InstanceWithFindingsResult
object
An object that contains information on the status of scanning EC2 instances with findings for an organization.
1 property
Tags
array
FeatureStatus
string
LoginAttributes
array
S3LogsConfigurationResult
object
Describes whether S3 data event logs will be enabled as a data source.
1 property
1 required
Neq
array
GetMemberDetectorsResponse
object
2 properties
2 required
CoverageStatus
string
FilterDescription
string
Action
object
Contains information about actions.
7 properties
MalwareProtectionConfigurationResult
object
An object that contains information on the status of all Malware Protection data sources.
2 properties
DetectorFeatureConfigurationResult
object
Contains information about a GuardDuty feature.
4 properties
Equals
array
ArchiveFindingsResponse
object
DetectorFeatureConfigurationsResults
array
EcsClusterDetails
object
Contains information about the details of the ECS Cluster.
8 properties
ResourceList
array
OrganizationMalwareProtectionConfiguration
object
Organization-wide Malware Protection configurations.
1 property
DataSource
string
GetMalwareScanSettingsResponse
object
2 properties
AccessKeyDetails
object
Contains information about the access keys.
4 properties
RemotePortDetails
object
Contains information about the remote port.
2 properties
KubernetesWorkloadDetails
object
Details about the Kubernetes workload involved in a Kubernetes finding.
7 properties
ServiceAdditionalInfo
object
Additional information about the generated finding.
2 properties
ThreatIntelSetFormat
string
DeleteThreatIntelSetResponse
object
FilterCriterion
object
Represents a condition that when matched will be added to the response of the operation. Irrespective of using any filter criteria, an administrator account ca…
2 properties
Condition
object
Contains information about the condition.
12 properties
VolumeMounts
array
LongValue
integer
MalwareProtectionConfiguration
object
Describes whether Malware Protection will be enabled as a data source.
1 property
Criterion
object
RdsLoginAttemptAction
object
Indicates that a login attempt was made to the potentially compromised database from a remote IP address.
2 properties
DomainDetails
object
Contains information about the domain.
1 property
ThreatIntelligenceDetail
object
An instance of a threat intelligence detail that constitutes evidence for the finding.
2 properties
FilePaths
array
UsageFeatureResultList
array
Scans
array
TriggerDetails
object
Represents the reason the scan was triggered.
2 properties
FreeTrialFeatureConfigurationsResults
array
Country
object
Contains information about the country where the remote IP address is located.
2 properties
City
object
Contains information about the city associated with the IP address.
1 property
VolumeDetail
object
Contains EBS volume details.
7 properties
AcceptAdministratorInvitationResponse
object
ScanResultDetails
object
Represents the result of the scan.
1 property
UpdateDetectorResponse
object
UsageAccountResultList
array
CreateMembersResponse
object
1 property
1 required
NotEquals
array
RuntimeDetails
object
Information about the process and any required context values for a specific finding.
2 properties
DeleteMembersResponse
object
1 property
1 required
OrderBy
string
LambdaDetails
object
Information about the Lambda function involved in the finding.
9 properties
Lineage
array
FilterName
string
Evidence
object
Contains information about the reason that the finding was generated.
1 property
Members
array
GeoLocation
object
Contains information about the location of the remote IP address.
2 properties
RemoteAccountDetails
object
Contains details about the remote Amazon Web Services account that made the API call.
2 properties
FilterCondition
object
Contains information about the condition.
3 properties
UpdateMalwareScanSettingsResponse
object
AddonDetails
object
Information about the installed EKS add-on (GuardDuty security agent).
2 properties
Long
integer
Timestamp
string
FindingPublishingFrequency
string
FindingStatisticType
string
Containers
array
UpdateFilterResponse
object
1 property
1 required
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Amazon GuardDuty 3
Other APIs Amazon GuardDuty publishes across the network.
Amazon GuardDuty Admin API
Amazon GuardDuty Invitation API
Amazon GuardDuty Tags API
#Detector
Where this information came from
This is an independent, third-party profile of Amazon GuardDuty Detector API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.