GuardDuty / Client / create_custom_detection_rule_association

create_custom_detection_rule_association

GuardDuty.Client.create_custom_detection_rule_association(**kwargs)

Enables a custom detection rule for your account by creating an association. You specify the rule and the mode in which it operates.

See also: AWS API Documentation

Request Syntax

response = client.create_custom_detection_rule_association(
    RuleId='string',
    Mode='LIVE'|'DRY_RUN',
    ClientToken='string',
    Tags={
        'string': 'string'
    }
)
Parameters:

  • RuleId (string) –

    [REQUIRED]

    The unique identifier for the custom detection rule.

  • Mode (string) –

    [REQUIRED]

    The rule execution mode. Valid values: LIVE | DRY_RUN.

  • ClientToken (string) –

    A unique, case-sensitive identifier to ensure that the operation completes no more than one time. Maximum 64 characters.

    This field is autopopulated if not provided.

  • Tags (dict) –

    The tags to be added to the new custom detection rule association resource.

    • (string) –

      • (string) –

Return type:

dict

Returns:

Response Syntax

{
    'RuleAssociation': {
        'AssociationId': 'string',
        'Arn': 'string',
        'RuleId': 'string',
        'AccountId': 'string',
        'Mode': 'LIVE'|'DRY_RUN',
        'CreatedAt': datetime(2015, 1, 1),
        'UpdatedAt': datetime(2015, 1, 1),
        'ExpiresAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) –

    • RuleAssociation (dict) –

      The details of the newly created custom detection rule association.

      • AssociationId (string) –

        The unique identifier for the association.

      • Arn (string) –

        The Amazon Resource Name (ARN) of the association.

      • RuleId (string) –

        The unique identifier for the custom detection rule.

      • AccountId (string) –

        The Amazon Web Services account ID associated with this rule association.

      • Mode (string) –

        The rule execution mode. Valid values: LIVE | DRY_RUN.

      • CreatedAt (datetime) –

        The timestamp when the association was created.

      • UpdatedAt (datetime) –

        The timestamp when the association was last updated.

      • ExpiresAt (datetime) –

        The timestamp when the association expires.

Exceptions