aws guardduty
Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following foundational data sources - VPC flow logs, Amazon Web Services CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, DNS logs, Amazon EBS volume data, runtime activity belonging to container workloads, such as Amazon EKS, Amazon ECS (including Amazon Web Services Fargate), and Amazon EC2 instances. AWS CLI reference
102 commands Its page in the AWS CLI reference
Commands
accept-administrator-invitationAccepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.accept-invitationAccepts the invitation to be monitored by a GuardDuty administrator account.archive-findingsArchives GuardDuty findings that are specified by the list of finding IDs.create-custom-detection-rule-associationEnables a custom detection rule for your account by creating an association.create-custom-detection-rule-org-configurationCreates an organization-level configuration that enables a custom detection rule across your organization.create-detectorCreates a single GuardDuty detector.create-filterCreates a filter using the specified finding criteria.create-investigationThis API is currently available as a preview.create-ip-setCreates a new IPSet, which is called a trusted IP list in the console user interface.create-malware-protection-planCreates a new Malware Protection plan for the protected resource.create-membersCreates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs.create-publishing-destinationCreates a publishing destination where you can export your GuardDuty findings.create-sample-findingsGenerates sample findings of types specified by the list of finding types.create-threat-entity-setCreates a new threat entity set.create-threat-intel-setCreates a new ThreatIntelSet.create-trusted-entity-setCreates a new trusted entity set.decline-invitationsDeclines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.delete-custom-detection-rule-associationDisables a custom detection rule by deleting its association.delete-custom-detection-rule-org-configurationDeletes the organization-level configuration for a custom detection rule.delete-detectorDeletes an Amazon GuardDuty detector that is specified by the detector ID.delete-filterDeletes the filter specified by the filter name.delete-invitationsDeletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.delete-ip-setDeletes the IPSet specified by the ipSetId.delete-malware-protection-planDeletes the Malware Protection plan ID associated with the Malware Protection plan resource.delete-membersDeletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.delete-publishing-destinationDeletes the publishing definition with the specified destinationId.delete-threat-entity-setDeletes the threat entity set that is associated with the specified threatEntitySetId.delete-threat-intel-setDeletes the ThreatIntelSet specified by the ThreatIntelSet ID.delete-trusted-entity-setDeletes the trusted entity set that is associated with the specified trustedEntitySetId.describe-malware-scansReturns a list of malware scans.describe-organization-configurationReturns information about the account selected as the delegated administrator for GuardDuty.describe-publishing-destinationReturns information about the publishing destination specified by the provided destinationId.disable-organization-admin-accountRemoves the existing GuardDuty delegated administrator of the organization.disassociate-from-administrator-accountDisassociates the current GuardDuty member account from its administrator account.disassociate-from-master-accountDisassociates the current GuardDuty member account from its administrator account.disassociate-membersDisassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs.enable-organization-admin-accountDesignates an Amazon Web Services account within the organization as your GuardDuty delegated administrator.get-administrator-accountProvides the details of the GuardDuty administrator account associated with the current GuardDuty member account.get-coverage-statisticsRetrieves aggregated statistics for your account.get-custom-detection-ruleReturns details for a custom detection rule in GuardDuty, including its detection logic.get-custom-detection-rule-associationReturns details for a custom detection rule association.get-custom-detection-rule-org-configurationReturns the organization-level configuration for a custom detection rule.get-detectorRetrieves a GuardDuty detector specified by the detectorId.get-filterReturns the details of the filter specified by the filter name.get-findingsDescribes Amazon GuardDuty findings specified by finding IDs.get-findings-statisticsLists GuardDuty findings statistics for the specified detector ID.get-investigationThis API is currently available as a preview.get-invitations-countReturns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.get-ip-setRetrieves the IPSet specified by the ipSetId.get-malware-protection-planRetrieves the Malware Protection plan details associated with a Malware Protection plan ID.get-malware-scanRetrieves the detailed information for a specific malware scan.get-malware-scan-settingsReturns the details of the malware scan settings.get-master-accountProvides the details for the GuardDuty administrator account associated with the current GuardDuty member account.get-member-detectorsDescribes which data sources are enabled for the member account's detector.get-membersRetrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.get-organization-statisticsRetrieves how many active member accounts have each feature enabled within GuardDuty.get-remaining-free-trial-daysProvides the number of days left for each data source used in the free trial period.get-threat-entity-setRetrieves the threat entity set associated with the specified threatEntitySetId.get-threat-intel-setRetrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.get-trusted-entity-setRetrieves the trusted entity set associated with the specified trustedEntitySetId.get-usage-statisticsLists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID.invite-membersInvites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API.list-coverageLists coverage details for your GuardDuty account.list-custom-detection-rule-associationsReturns all custom detection rule associations for your account.list-custom-detection-rule-org-configurationsReturns all organization-level configurations for custom detection rules.list-custom-detection-rulesReturns all available custom detection rules in GuardDuty.list-detectorsLists detectorIds of all the existing Amazon GuardDuty detector resources.list-filtersReturns a paginated list of the current filters.list-findingsLists GuardDuty findings for the specified detector ID.list-investigationsThis API is currently available as a preview.list-invitationsLists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.list-ip-setsLists the IPSets of the GuardDuty service specified by the detector ID.list-malware-protection-plansLists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.list-malware-scansReturns a list of malware scans.list-membersLists details about all member accounts for the current GuardDuty administrator account.list-organization-admin-accountsLists the accounts designated as GuardDuty delegated administrators.list-publishing-destinationsReturns a list of publishing destinations associated with the specified detectorId.list-tags-for-resourceLists tags for a resource.list-threat-entity-setsLists the threat entity sets associated with the specified GuardDuty detector ID.list-threat-intel-setsLists the ThreatIntelSets of the GuardDuty service specified by the detector ID.list-trusted-entity-setsLists the trusted entity sets associated with the specified GuardDuty detector ID.send-object-malware-scanInitiates a malware scan for a specific S3 object.start-malware-scanInitiates the malware scan.start-monitoring-membersTurns on GuardDuty monitoring of the specified member accounts.stop-monitoring-membersStops GuardDuty monitoring for the specified member accounts.tag-resourceAdds tags to a resource.unarchive-findingsUnarchives GuardDuty findings specified by the findingIds.untag-resourceRemoves tags from a resource.update-custom-detection-rule-associationUpdates the mode of an existing custom detection rule association.update-custom-detection-rule-org-configurationUpdates the organization-level configuration for a custom detection rule, including the mode and include/exclude account lists.update-detectorUpdates the GuardDuty detector specified by the detector ID.update-filterUpdates the filter specified by the filter name.update-findings-feedbackMarks the specified GuardDuty findings as useful or not useful.update-ip-setUpdates the IPSet specified by the IPSet ID.update-malware-protection-planUpdates an existing Malware Protection plan resource.update-malware-scan-settingsUpdates the malware scan settings.update-member-detectorsContains information on member accounts to be updated.update-organization-configurationConfigures the delegated administrator account with the provided values.update-publishing-destinationUpdates information about the publishing destination specified by the destinationId.update-threat-entity-setUpdates the threat entity set associated with the specified threatEntitySetId.update-threat-intel-setUpdates the ThreatIntelSet specified by the ThreatIntelSet ID.update-trusted-entity-setUpdates the trusted entity set associated with the specified trustedEntitySetId.