GuardDuty / Client / list_custom_detection_rules

list_custom_detection_rules¶

GuardDuty.Client.list_custom_detection_rules(**kwargs)¶

Returns all available custom detection rules in GuardDuty. You can filter the results by data source, severity, tactic, technique, and service.

Request Syntax

response = client.list_custom_detection_rules(
    MaxResults=123,
    NextToken='string',
    Filters=[
        {
            'Name': 'name'|'description'|'dataSource'|'severity'|'tactic'|'technique'|'service',
            'Values': [
                'string',
            ],
            'Condition': 'EQUALS'|'CONTAINS'
        },
    ]
)

Parameters:

MaxResults (integer) – The maximum number of results to return in a single page. Minimum value of 1, maximum value of 100.
NextToken (string) – A pagination token from a previous response. Use this token to retrieve the next page of results.
Filters (list) –
A list of filter criteria to apply when listing custom detection rules.
- (dict) –
  
  Contains filter criteria for listing custom detection rules or associations.
  - Name (string) – [REQUIRED]
    
    The name of the field to filter by.
  - Values (list) – [REQUIRED]
    
    The values to match against the specified filter name.
    - (string) –
  - Condition (string) –
    
    The condition to apply to the filter. For example, EQUALS or CONTAINS.

Return type:

dict

Returns:

Response Syntax

{
    'Rules': [
        {
            'RuleId': 'string',
            'Arn': 'string',
            'Name': 'string',
            'Description': 'string',
            'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW',
            'DataSource': 'CloudTrailManagementEvent',
            'Tactic': 'string',
            'Technique': 'string',
            'Service': 'string',
            'Language': 'SQL',
            'Schema': 'CloudTrail',
            'CreatedAt': datetime(2015, 1, 1),
            'UpdatedAt': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) –
- Rules (list) –
  
  A list of custom detection rule summaries.
  - (dict) –
    
    Contains summary information about a custom detection rule.
    - RuleId (string) –
      
      The unique identifier for the rule.
    - Arn (string) –
      
      The Amazon Resource Name (ARN) of the rule.
    - Name (string) –
      
      The display name of the rule.
    - Description (string) –
      
      A description of what the rule detects.
    - Severity (string) –
      
      The severity level assigned to findings generated by this rule.
    - DataSource (string) –
      
      The data source that the rule analyzes.
    - Tactic (string) –
      
      The MITRE ATT&CK tactic associated with the rule.
    - Technique (string) –
      
      The MITRE ATT&CK technique associated with the rule.
    - Service (string) –
      
      The Amazon Web Services service associated with the rule.
    - Language (string) –
      
      The language used for the detection logic expression.
    - Schema (string) –
      
      The schema version used by the rule definition.
    - CreatedAt (datetime) –
      
      The timestamp when the rule was created.
    - UpdatedAt (datetime) –
      
      The timestamp when the rule was last updated.
- NextToken (string) –
  
  A pagination token to retrieve the next page of results. If this field is empty, there are no additional results.

Exceptions

GuardDuty.Client.exceptions.BadRequestException
GuardDuty.Client.exceptions.InternalServerErrorException
GuardDuty.Client.exceptions.AccessDeniedException