This is the new AWS CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.
AWS::GuardDuty::ThreatEntitySet
The AWS::GuardDuty::ThreatEntitySet
resource helps you create a list of
known malicious IP addresses and domain names in your AWS environment. Once
you activate this list, GuardDuty will use the entries in this list as an
additional source of threat detection and generate findings when there is an activity
associated with these known malicious IP addresses and domain names. GuardDuty
continues to monitor independently of this custom threat entity set.
Only the users of the GuardDuty administrator account can manage this list. These settings automatically apply to the member accounts.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{ "Type" : "AWS::GuardDuty::ThreatEntitySet", "Properties" : { "Activate" :
Boolean
, "DetectorId" :String
, "ExpectedBucketOwner" :String
, "Format" :String
, "Location" :String
, "Name" :String
, "Tags" :[ TagItem, ... ]
} }
YAML
Type: AWS::GuardDuty::ThreatEntitySet Properties: Activate:
Boolean
DetectorId:String
ExpectedBucketOwner:String
Format:String
Location:String
Name:String
Tags:- TagItem
Properties
Activate
-
A boolean value that determines if GuardDuty can start using this list for custom threat detection. For GuardDuty to consider the entries in this list and generate findings based on associated activity, this list must be active.
Required: No
Type: Boolean
Update requires: No interruption
DetectorId
-
The unique regional detector ID of the GuardDuty account for which you want to create a threat entity set.
To find the
detectorId
in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.Required: No
Type: String
Minimum:
1
Maximum:
32
Update requires: Replacement
ExpectedBucketOwner
-
The AWS account ID that owns the Amazon S3 bucket specified in the Location field.
Whether or not you provide the account ID for this optional field, GuardDuty validates that the account ID associated with the
DetectorId
owns the S3 bucket in theLocation
field. If GuardDuty finds that this S3 bucket doesn't belong to the specified account ID, you will get an error at the time of activating this list.Required: No
Type: String
Update requires: No interruption
Format
-
The format of the file that contains the threat entity set. For information about supported formats, see List formats in the Amazon GuardDuty User Guide.
Required: Yes
Type: String
Minimum:
1
Maximum:
300
Update requires: Replacement
Location
-
The URI of the file that contains the threat entity set.
Required: Yes
Type: String
Minimum:
1
Maximum:
300
Update requires: No interruption
Name
-
The user-friendly name to identify the threat entity set. Valid characters are alphanumeric, whitespace, dash (-), and underscores (_).
Required: No
Type: String
Update requires: No interruption
-
The tags to be added to a new threat entity set resource. Each tag consists of a key and an optional value, both of which you define.
For more information, see Tag.
Required: No
Type: Array of TagItem
Update requires: No interruption
Return values
Ref
When you pass the logical ID of this resource to the intrinsic Ref
function, Ref
returns the unique ID associated with the newly created threat entity
set.
For more information about using the Ref
function, see Ref
.
Fn::GetAtt
The Fn::GetAtt
intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.
For more information about using the Fn::GetAtt
intrinsic function, see Fn::GetAtt
.
CreatedAt
-
The timestamp when the threat entity set was created.
ErrorDetails
-
The details associated with the Error status of your threat entity list.
Id
-
Returns the unique ID associated with the newly created threat entity set.
Status
-
The status of your
ThreatEntitySet
. For information about valid status values, see Understanding list statuses in the Amazon GuardDuty User Guide. UpdatedAt
-
The timestamp when the threat entity set was updated.