GuardDuty / Client / get_custom_detection_rule

get_custom_detection_rule

GuardDuty.Client.get_custom_detection_rule(**kwargs)

Returns details for a custom detection rule in GuardDuty, including its detection logic.

See also: AWS API Documentation

Request Syntax

response = client.get_custom_detection_rule(
    RuleId='string'
)
Parameters:

RuleId (string) –

[REQUIRED]

The unique identifier for the custom detection rule.

Return type:

dict

Returns:

Response Syntax

{
    'Rule': {
        'RuleId': 'string',
        'Arn': 'string',
        'Name': 'string',
        'Description': 'string',
        'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW',
        'DataSource': 'CloudTrailManagementEvent',
        'Tactic': 'string',
        'Technique': 'string',
        'Service': 'string',
        'Definition': {
            'Expression': 'string'
        },
        'Language': 'SQL',
        'Schema': 'CloudTrail',
        'CreatedAt': datetime(2015, 1, 1),
        'UpdatedAt': datetime(2015, 1, 1)
    }
}

Response Structure

  • (dict) –

    • Rule (dict) –

      The details of the custom detection rule.

      • RuleId (string) –

        The unique identifier for the rule.

      • Arn (string) –

        The Amazon Resource Name (ARN) of the rule.

      • Name (string) –

        The display name of the rule.

      • Description (string) –

        A description of what the rule detects.

      • Severity (string) –

        The severity level assigned to findings generated by this rule.

      • DataSource (string) –

        The data source that the rule analyzes.

      • Tactic (string) –

        The MITRE ATT&CK tactic associated with the rule.

      • Technique (string) –

        The MITRE ATT&CK technique associated with the rule.

      • Service (string) –

        The Amazon Web Services service associated with the rule.

      • Definition (dict) –

        The detection logic definition for the rule.

        • Expression (string) –

          The detection logic expression for the rule.

      • Language (string) –

        The language used for the detection logic expression.

      • Schema (string) –

        The schema version used by the rule definition.

      • CreatedAt (datetime) –

        The timestamp when the rule was created.

      • UpdatedAt (datetime) –

        The timestamp when the rule was last updated.

Exceptions