GuardDuty / Paginator / ListCustomDetectionRules

ListCustomDetectionRules¶

class GuardDuty.Paginator.ListCustomDetectionRules¶

paginator = client.get_paginator('list_custom_detection_rules')

paginate(**kwargs)¶

Creates an iterator that will paginate through responses from GuardDuty.Client.list_custom_detection_rules().

Request Syntax

response_iterator = paginator.paginate(
    Filters=[
        {
            'Name': 'name'|'description'|'dataSource'|'severity'|'tactic'|'technique'|'service',
            'Values': [
                'string',
            ],
            'Condition': 'EQUALS'|'CONTAINS'
        },
    ],
    PaginationConfig={
        'MaxItems': 123,
        'PageSize': 123,
        'StartingToken': 'string'
    }
)

Parameters:

Filters (list) –
A list of filter criteria to apply when listing custom detection rules.
- (dict) –
  
  Contains filter criteria for listing custom detection rules or associations.
  - Name (string) – [REQUIRED]
    
    The name of the field to filter by.
  - Values (list) – [REQUIRED]
    
    The values to match against the specified filter name.
    - (string) –
  - Condition (string) –
    
    The condition to apply to the filter. For example, EQUALS or CONTAINS.
PaginationConfig (dict) –
A dictionary that provides parameters to control pagination.
- MaxItems (integer) –
  
  The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.
- PageSize (integer) –
  
  The size of each page.
- StartingToken (string) –
  
  A token to specify where to start paginating. This is the NextToken from a previous response.

Return type:

dict

Returns:

Response Syntax

{
    'Rules': [
        {
            'RuleId': 'string',
            'Arn': 'string',
            'Name': 'string',
            'Description': 'string',
            'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW',
            'DataSource': 'CloudTrailManagementEvent',
            'Tactic': 'string',
            'Technique': 'string',
            'Service': 'string',
            'Language': 'SQL',
            'Schema': 'CloudTrail',
            'CreatedAt': datetime(2015, 1, 1),
            'UpdatedAt': datetime(2015, 1, 1)
        },
    ],

}

Response Structure

(dict) –
- Rules (list) –
  
  A list of custom detection rule summaries.
  - (dict) –
    
    Contains summary information about a custom detection rule.
    - RuleId (string) –
      
      The unique identifier for the rule.
    - Arn (string) –
      
      The Amazon Resource Name (ARN) of the rule.
    - Name (string) –
      
      The display name of the rule.
    - Description (string) –
      
      A description of what the rule detects.
    - Severity (string) –
      
      The severity level assigned to findings generated by this rule.
    - DataSource (string) –
      
      The data source that the rule analyzes.
    - Tactic (string) –
      
      The MITRE ATT&CK tactic associated with the rule.
    - Technique (string) –
      
      The MITRE ATT&CK technique associated with the rule.
    - Service (string) –
      
      The Amazon Web Services service associated with the rule.
    - Language (string) –
      
      The language used for the detection logic expression.
    - Schema (string) –
      
      The schema version used by the rule definition.
    - CreatedAt (datetime) –
      
      The timestamp when the rule was created.
    - UpdatedAt (datetime) –
      
      The timestamp when the rule was last updated.