get-malware-scan¶

Description¶

Retrieves the detailed information for a specific malware scan. Each member account can view the malware scan details for their own account. An administrator can view malware scan details for all accounts in the organization.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints .

Synopsis¶

  get-malware-scan
--scan-id <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Options¶

--scan-id (string) [required]

A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options¶

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

json
text
table
yaml
yaml-stream

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

on
off
auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

base64
raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

Output¶

ScanId -> (string)

A unique identifier associated with the malware scan. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.

Constraints:

min: 1

max: 200

DetectorId -> (string)

The unique ID of the detector that is associated with the request, if it belongs to an account which is a GuardDuty customer.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Constraints:

min: 1

max: 300

AdminDetectorId -> (string)

The unique detector ID of the administrator account that the request is associated with. If the account is an administrator, the AdminDetectorId will be the same as the one used for DetectorId. If the customer is not a GuardDuty customer, this field will not be present. .

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Constraints:

min: 1

max: 300

ResourceArn -> (string)

Amazon Resource Name (ARN) of the resource on which a malware scan was invoked.

Constraints:

min: 1

max: 200

ResourceType -> (string)

The type of resource that was scanned for malware.

Possible values:

EBS_RECOVERY_POINT

EBS_SNAPSHOT

EBS_VOLUME

EC2_AMI

EC2_INSTANCE

EC2_RECOVERY_POINT

S3_RECOVERY_POINT

S3_BUCKET

ScannedResourcesCount -> (integer)

The total number of resources that were successfully scanned. This is dependent on the resource type.

Constraints:

min: 0

SkippedResourcesCount -> (integer)

The total number of resources that were skipped during the scan.

Constraints:

min: 0

FailedResourcesCount -> (integer)

The total number of resources that failed to be scanned.

Constraints:

min: 0

ScannedResources -> (list)

A list of resources along with their metadata that were scanned as part of the malware scan operation.

(structure)

Contains information about a resource that was scanned as part of the malware scan operation.

ScannedResourceArn -> (string)

Amazon Resource Name (ARN) of the scanned resource.

Constraints:

min: 1

max: 200

ScannedResourceType -> (string)

The resource type of the scanned resource.

Possible values:

EBS_RECOVERY_POINT

EBS_SNAPSHOT

EBS_VOLUME

EC2_AMI

EC2_INSTANCE

EC2_RECOVERY_POINT

S3_RECOVERY_POINT

S3_BUCKET

ScannedResourceStatus -> (string)

The status of the scanned resource.

Possible values:

RUNNING

COMPLETED

COMPLETED_WITH_ISSUES

FAILED

SKIPPED

ScanStatusReason -> (string)

The reason for the scan status of this particular resource, if applicable.

Possible values:

ACCESS_DENIED

RESOURCE_NOT_FOUND

SNAPSHOT_SIZE_LIMIT_EXCEEDED

RESOURCE_UNAVAILABLE

INCONSISTENT_SOURCE

INCREMENTAL_NO_DIFFERENCE

NO_EBS_VOLUMES_FOUND

UNSUPPORTED_PRODUCT_CODE_TYPE

AMI_SNAPSHOT_LIMIT_EXCEEDED

UNRELATED_RESOURCES

BASE_RESOURCE_NOT_SCANNED

BASE_CREATED_AFTER_TARGET

UNSUPPORTED_FOR_INCREMENTAL

UNSUPPORTED_AMI

UNSUPPORTED_SNAPSHOT

UNSUPPORTED_COMPOSITE_RECOVERY_POINT

ResourceDetails -> (structure)

Information about the scanned resource.

EbsVolume -> (structure)

Contains information about the EBS volume that was scanned.

VolumeArn -> (string)

EBS volume ARN information.

VolumeType -> (string)

The EBS volume type.

DeviceName -> (string)

The device name for the EBS volume.

VolumeSizeInGB -> (integer)

EBS volume size in GB.

EncryptionType -> (string)

EBS volume encryption type.

SnapshotArn -> (string)

Snapshot ARN of the EBS volume.

KmsKeyArn -> (string)

KMS key ARN used to encrypt the EBS volume.

EbsSnapshot -> (structure)

Contains information about the EBS snapshot that was scanned.

DeviceName -> (string)

The device name of the EBS snapshot that was scanned.

Constraints:

min: 1

max: 200

ScanConfiguration -> (structure)

Information about the scan configuration used for the malware scan.

Role -> (string)

Amazon Resource Name (ARN) of the IAM role that should contain the required permissions for the scan.

Constraints:

min: 1

max: 200

TriggerDetails -> (structure)

Information about the entity that triggered the malware scan.

GuardDutyFindingId -> (string)

The ID of the GuardDuty finding that triggered the malware scan.

Constraints:

min: 1

max: 200

Description -> (string)

The description of the scan trigger.

Constraints:

min: 1

max: 200

TriggerType -> (string)

Specifies the trigger type that started the malware scan.

Possible values:

BACKUP

GUARDDUTY

IncrementalScanDetails -> (structure)

Information about the incremental scan configuration, if applicable.

BaselineResourceArn -> (string) [required]

Amazon Resource Name (ARN) of the baseline resource used for incremental scanning. The scan will only process changes since this baseline resource was created.

Constraints:

min: 1

max: 200

RecoveryPoint -> (structure)

Information about the recovery point configuration used for the scan, if applicable.

BackupVaultName -> (string)

The name of the Amazon Web Services Backup vault that contains the recovery point for the scanned.

Constraints:

min: 1

max: 200

ScanCategory -> (string)

The category of the malware scan, indicating the type of scan performed.

Possible values:

FULL_SCAN

INCREMENTAL_SCAN

ScanStatus -> (string)

A value representing the current status of the malware scan.

Possible values:

RUNNING

COMPLETED

COMPLETED_WITH_ISSUES

FAILED

SKIPPED

ScanStatusReason -> (string)

Represents the reason for the current scan status, if applicable.

Possible values:

ACCESS_DENIED

RESOURCE_NOT_FOUND

SNAPSHOT_SIZE_LIMIT_EXCEEDED

RESOURCE_UNAVAILABLE

INCONSISTENT_SOURCE

INCREMENTAL_NO_DIFFERENCE

NO_EBS_VOLUMES_FOUND

UNSUPPORTED_PRODUCT_CODE_TYPE

AMI_SNAPSHOT_LIMIT_EXCEEDED

UNRELATED_RESOURCES

BASE_RESOURCE_NOT_SCANNED

BASE_CREATED_AFTER_TARGET

UNSUPPORTED_FOR_INCREMENTAL

UNSUPPORTED_AMI

UNSUPPORTED_SNAPSHOT

UNSUPPORTED_COMPOSITE_RECOVERY_POINT

ScanType -> (string)

A value representing the initiator of the scan.

Possible values:

BACKUP_INITIATED

ON_DEMAND

GUARDDUTY_INITIATED

ScanStartedAt -> (timestamp)

The timestamp representing when the malware scan was started.

ScanCompletedAt -> (timestamp)

The timestamp representing when the malware scan was completed.

ScanResultDetails -> (structure)

Detailed information about the results of the malware scan, if the scan completed.

ScanResultStatus -> (string)

Status indicating whether threats were found for a completed scan.

Possible values:

NO_THREATS_FOUND

THREATS_FOUND

SkippedFileCount -> (long)

The total number of files that were skipped during the scan.

Constraints:

min: 0

FailedFileCount -> (long)

The total number of files that failed to be scanned.

Constraints:

min: 0

ThreatFoundFileCount -> (long)

The total number of files in which threats were detected.

Constraints:

min: 0

TotalFileCount -> (long)

The total number of files that were processed during the scan.

Constraints:

min: 0

TotalBytes -> (long)

The total number of bytes that were scanned.

Constraints:

min: 0

UniqueThreatCount -> (long)

The total number of unique threats that were detected during the scan.

Constraints:

min: 0

Threats -> (list)

The threats that were detected during the malware scan.

(structure)

Contains information about a specific threat that was detected during the malware scan.

Name -> (string)

The name of the detected threat.

Constraints:

min: 1

max: 200

Source -> (string)

The source that detected this threat.

Possible values:

AMAZON

BITDEFENDER

Count -> (long)

The number of instances of this threat that were detected.

Constraints:

min: 0

Hash -> (string)

The hash value associated with the detected threat.

Constraints:

min: 1

max: 200

ItemDetails -> (list)

Additional information about where this threat was detected.

(structure)

Contains detailed information about where a threat was detected.

ResourceArn -> (string)

Amazon Resource Name (ARN) of the resource where the threat was detected.

Constraints:

min: 1

max: 200

ItemPath -> (string)

The path where the threat was detected.

Constraints:

min: 1

max: 200

Hash -> (string)

The hash value of the infected item.

AdditionalInfo -> (structure)

Additional information about the detected threat item.

VersionId -> (string)

The version ID of the S3 object, if applicable.

Constraints:

min: 1

max: 200

DeviceName -> (string)

The device name of the EBS volume, if applicable.

Constraints:

min: 1

max: 200

Table of Contents

Feedback

User Guide