AWS.GuardDuty reference

AcceptAdministratorInvitation

Source: src/AWS/GuardDuty/AcceptAdministratorInvitation.ts

Runtime binding for guardduty:AcceptAdministratorInvitation.

Accepts a GuardDuty administrator invitation — the member-account side of the invitation handshake. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.AcceptAdministratorInvitationHttp).

AcceptAdministratorInvitation: Administrator & Invitations

// init
const acceptAdministratorInvitation = yield* AWS.GuardDuty.AcceptAdministratorInvitation(detector);

// runtime
yield* acceptAdministratorInvitation({
  AdministratorId: adminAccountId,
  InvitationId: invitationId,
});

ArchiveFindings

Source: src/AWS/GuardDuty/ArchiveFindings.ts

Runtime binding for guardduty:ArchiveFindings.

Archives triaged findings so they stop surfacing in the active queue. Only the administrator account owning the detector can archive. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.ArchiveFindingsHttp).

ArchiveFindings: Working with Findings

// init
const archiveFindings = yield* AWS.GuardDuty.ArchiveFindings(detector);

// runtime
yield* archiveFindings({ FindingIds: findingIds });

CreateInvestigation

Source: src/AWS/GuardDuty/CreateInvestigation.ts

Runtime binding for guardduty:CreateInvestigation.

Starts a GuardDuty Extended Threat Detection investigation from a natural-language trigger prompt. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.CreateInvestigationHttp).

CreateInvestigation: Extended Threat Detection

// init
const createInvestigation = yield* AWS.GuardDuty.CreateInvestigation(detector);

// runtime
const { InvestigationId } = yield* createInvestigation({
  TriggerPrompt: "Investigate the port probe findings on my web tier",
});

CreateMembers

Source: src/AWS/GuardDuty/CreateMembers.ts

Runtime binding for guardduty:CreateMembers.

Associates member accounts with this administrator detector (organization-managed or invitation flow). The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.CreateMembersHttp).

CreateMembers: Member Administration

// init
const createMembers = yield* AWS.GuardDuty.CreateMembers(detector);

// runtime
yield* createMembers({
  AccountDetails: [{ AccountId: "111122223333", Email: "security@example.com" }],
});

CreateSampleFindings

Source: src/AWS/GuardDuty/CreateSampleFindings.ts

Runtime binding for guardduty:CreateSampleFindings.

Generates sample findings of the requested types — the standard way to exercise a finding-consumer pipeline end-to-end without staging a real threat. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.CreateSampleFindingsHttp).

CreateSampleFindings: Working with Findings

// init
const createSampleFindings = yield* AWS.GuardDuty.CreateSampleFindings(detector);

// runtime
yield* createSampleFindings({
  FindingTypes: ["Recon:EC2/PortProbeUnprotectedPort"],
});

DeclineInvitations

Source: src/AWS/GuardDuty/DeclineInvitations.ts

Runtime binding for guardduty:DeclineInvitations.

Declines membership invitations from the given administrator account ids. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.DeclineInvitationsHttp).

DeclineInvitations: Administrator & Invitations

// init
// init — account-level binding, no resource argument
const declineInvitations = yield* AWS.GuardDuty.DeclineInvitations();

// runtime
yield* declineInvitations({ AccountIds: ["111122223333"] });

DeleteInvitations

Source: src/AWS/GuardDuty/DeleteInvitations.ts

Runtime binding for guardduty:DeleteInvitations.

Deletes received membership invitations from the given administrator account ids. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.DeleteInvitationsHttp).

DeleteInvitations: Administrator & Invitations

// init
// init — account-level binding, no resource argument
const deleteInvitations = yield* AWS.GuardDuty.DeleteInvitations();

// runtime
yield* deleteInvitations({ AccountIds: ["111122223333"] });

DeleteMembers

Source: src/AWS/GuardDuty/DeleteMembers.ts

Runtime binding for guardduty:DeleteMembers.

Deletes member accounts from this administrator detector entirely. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.DeleteMembersHttp).

DeleteMembers: Member Administration

// init
const deleteMembers = yield* AWS.GuardDuty.DeleteMembers(detector);

// runtime
yield* deleteMembers({ AccountIds: ["111122223333"] });

DescribeMalwareScans

Source: src/AWS/GuardDuty/DescribeMalwareScans.ts

Runtime binding for guardduty:DescribeMalwareScans.

Lists EC2 malware scan results for the detector with optional filter and sort criteria. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.DescribeMalwareScansHttp).

DescribeMalwareScans: Malware Protection

// init
const describeMalwareScans = yield* AWS.GuardDuty.DescribeMalwareScans(detector);

// runtime
const { Scans } = yield* describeMalwareScans();

DescribeOrganizationConfiguration

Source: src/AWS/GuardDuty/DescribeOrganizationConfiguration.ts

Runtime binding for guardduty:DescribeOrganizationConfiguration.

Reads the organization’s GuardDuty auto-enable configuration (delegated administrator only). The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.DescribeOrganizationConfigurationHttp).

DescribeOrganizationConfiguration: Organization Administration

// init
const describeOrganizationConfiguration = yield* AWS.GuardDuty.DescribeOrganizationConfiguration(detector);

// runtime
const { AutoEnableOrganizationMembers } =
  yield* describeOrganizationConfiguration();

Detector

Source: src/AWS/GuardDuty/Detector.ts

A GuardDuty detector — the account/region singleton that enables Amazon GuardDuty threat detection. Only one detector can exist per region, so this resource is a capture-and-restore singleton: adopting a pre-existing detector that Alchemy did not create requires --adopt.

Detector: Enabling GuardDuty

Enable with default settings

const detector = yield* GuardDuty.Detector("Detector", {});

Frequent finding publishing

const detector = yield* GuardDuty.Detector("Detector", {
  enable: true,
  findingPublishingFrequency: "FIFTEEN_MINUTES",
  tags: { team: "security" },
});

DisableOrganizationAdminAccount

Source: src/AWS/GuardDuty/DisableOrganizationAdminAccount.ts

Runtime binding for guardduty:DisableOrganizationAdminAccount.

Removes an account’s delegation as the organization’s GuardDuty administrator (management account only). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.DisableOrganizationAdminAccountHttp).

DisableOrganizationAdminAccount: Organization Administration

// init
// init — account-level binding, no resource argument
const disableOrganizationAdminAccount = yield* AWS.GuardDuty.DisableOrganizationAdminAccount();

// runtime
yield* disableOrganizationAdminAccount({ AdminAccountId: "111122223333" });

DisassociateFromAdministratorAccount

Source: src/AWS/GuardDuty/DisassociateFromAdministratorAccount.ts

Runtime binding for guardduty:DisassociateFromAdministratorAccount.

Disassociates this member detector from its administrator account. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.DisassociateFromAdministratorAccountHttp).

DisassociateFromAdministratorAccount: Administrator & Invitations

// init
const disassociateFromAdministratorAccount = yield* AWS.GuardDuty.DisassociateFromAdministratorAccount(detector);

// runtime
yield* disassociateFromAdministratorAccount();

DisassociateMembers

Source: src/AWS/GuardDuty/DisassociateMembers.ts

Runtime binding for guardduty:DisassociateMembers.

Disassociates member accounts from this administrator detector without deleting them. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.DisassociateMembersHttp).

DisassociateMembers: Member Administration

// init
const disassociateMembers = yield* AWS.GuardDuty.DisassociateMembers(detector);

// runtime
yield* disassociateMembers({ AccountIds: ["111122223333"] });

EnableOrganizationAdminAccount

Source: src/AWS/GuardDuty/EnableOrganizationAdminAccount.ts

Runtime binding for guardduty:EnableOrganizationAdminAccount.

Delegates an account as the organization’s GuardDuty administrator (management account only). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.EnableOrganizationAdminAccountHttp).

EnableOrganizationAdminAccount: Organization Administration

// init
// init — account-level binding, no resource argument
const enableOrganizationAdminAccount = yield* AWS.GuardDuty.EnableOrganizationAdminAccount();

// runtime
yield* enableOrganizationAdminAccount({ AdminAccountId: "111122223333" });

Filter

Source: src/AWS/GuardDuty/Filter.ts

A GuardDuty findings filter — matches findings against criteria and either keeps (NOOP) or auto-archives (ARCHIVE) them. Identity is the (detectorId, name) pair; description, action, rank, and criteria are updatable in place.

Filter: Filtering Findings

Auto-archive low-severity findings

const detector = yield* AWS.GuardDuty.Detector("Detector", {});
const filter = yield* AWS.GuardDuty.Filter("LowSeverity", {
  detectorId: detector.detectorId,
  action: "ARCHIVE",
  rank: 1,
  findingCriteria: { Criterion: { severity: { LessThan: 4 } } },
});

Keep a named filter for the console

const filter = yield* AWS.GuardDuty.Filter("ProdOnly", {
  detectorId: detector.detectorId,
  name: "prod-only",
  description: "Findings on production resources",
  findingCriteria: {
    Criterion: { "resource.instanceDetails.tags.value": { Equals: ["prod"] } },
  },
});

GetAdministratorAccount

Source: src/AWS/GuardDuty/GetAdministratorAccount.ts

Runtime binding for guardduty:GetAdministratorAccount.

Reads the administrator account managing this detector (empty relationship for a standalone account). The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetAdministratorAccountHttp).

GetAdministratorAccount: Administrator & Invitations

// init
const getAdministratorAccount = yield* AWS.GuardDuty.GetAdministratorAccount(detector);

// runtime
const { Administrator } = yield* getAdministratorAccount();

GetCoverageStatistics

Source: src/AWS/GuardDuty/GetCoverageStatistics.ts

Runtime binding for guardduty:GetCoverageStatistics.

Aggregates runtime-monitoring coverage counts (healthy vs unhealthy) for the detector’s monitored resources. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetCoverageStatisticsHttp).

GetCoverageStatistics: Usage & Coverage

// init
const getCoverageStatistics = yield* AWS.GuardDuty.GetCoverageStatistics(detector);

// runtime
const { CoverageStatistics } = yield* getCoverageStatistics({
  StatisticsType: ["COUNT_BY_RESOURCE_TYPE"],
});

GetFindings

Source: src/AWS/GuardDuty/GetFindings.ts

Runtime binding for guardduty:GetFindings.

Hydrates full finding details for a batch of finding ids returned by ListFindings. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetFindingsHttp).

GetFindings: Working with Findings

// init
const getFindings = yield* AWS.GuardDuty.GetFindings(detector);

// runtime
const { Findings } = yield* getFindings({ FindingIds: findingIds });

GetFindingsStatistics

Source: src/AWS/GuardDuty/GetFindingsStatistics.ts

Runtime binding for guardduty:GetFindingsStatistics.

Aggregates the detector’s findings into statistics (grouped by severity, account, resource, or finding type) for dashboards and alert thresholds. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetFindingsStatisticsHttp).

GetFindingsStatistics: Working with Findings

// init
const getFindingsStatistics = yield* AWS.GuardDuty.GetFindingsStatistics(detector);

// runtime
const { FindingStatistics } = yield* getFindingsStatistics({
  GroupBy: "SEVERITY",
});

GetInvestigation

Source: src/AWS/GuardDuty/GetInvestigation.ts

Runtime binding for guardduty:GetInvestigation.

Reads an investigation’s status, risk details, and results by investigation id. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetInvestigationHttp).

GetInvestigation: Extended Threat Detection

// init
const getInvestigation = yield* AWS.GuardDuty.GetInvestigation(detector);

// runtime
const { Investigation } = yield* getInvestigation({
  InvestigationId: investigationId,
});

GetInvitationsCount

Source: src/AWS/GuardDuty/GetInvitationsCount.ts

Runtime binding for guardduty:GetInvitationsCount.

Counts the membership invitations received by this account, excluding deleted ones. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.GetInvitationsCountHttp).

GetInvitationsCount: Administrator & Invitations

// init
// init — account-level binding, no resource argument
const getInvitationsCount = yield* AWS.GuardDuty.GetInvitationsCount();

// runtime
const { InvitationsCount } = yield* getInvitationsCount();

GetMalwareScan

Source: src/AWS/GuardDuty/GetMalwareScan.ts

Runtime binding for guardduty:GetMalwareScan.

Reads the status and result of an on-demand malware scan by scan id. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.GetMalwareScanHttp).

GetMalwareScan: Malware Protection

// init
// init — account-level binding, no resource argument
const getMalwareScan = yield* AWS.GuardDuty.GetMalwareScan();

// runtime
const { ScanStatus } = yield* getMalwareScan({ ScanId: scanId });

GetMalwareScanSettings

Source: src/AWS/GuardDuty/GetMalwareScanSettings.ts

Runtime binding for guardduty:GetMalwareScanSettings.

Reads the detector’s EC2 malware scan settings — scan resource criteria and EBS snapshot preservation. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetMalwareScanSettingsHttp).

GetMalwareScanSettings: Malware Protection

// init
const getMalwareScanSettings = yield* AWS.GuardDuty.GetMalwareScanSettings(detector);

// runtime
const { ScanResourceCriteria } = yield* getMalwareScanSettings();

GetMemberDetectors

Source: src/AWS/GuardDuty/GetMemberDetectors.ts

Runtime binding for guardduty:GetMemberDetectors.

Reads the data-source and feature configuration of member detectors. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetMemberDetectorsHttp).

GetMemberDetectors: Member Administration

// init
const getMemberDetectors = yield* AWS.GuardDuty.GetMemberDetectors(detector);

// runtime
const { MemberDataSourceConfigurations } = yield* getMemberDetectors({
  AccountIds: ["111122223333"],
});

GetMembers

Source: src/AWS/GuardDuty/GetMembers.ts

Runtime binding for guardduty:GetMembers.

Reads member account details for the given account ids; unknown accounts come back as UnprocessedAccounts. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetMembersHttp).

GetMembers: Member Administration

// init
const getMembers = yield* AWS.GuardDuty.GetMembers(detector);

// runtime
const { Members, UnprocessedAccounts } = yield* getMembers({
  AccountIds: ["111122223333"],
});

GetOrganizationStatistics

Source: src/AWS/GuardDuty/GetOrganizationStatistics.ts

Runtime binding for guardduty:GetOrganizationStatistics.

Reports organization-wide GuardDuty enablement statistics (delegated administrator only). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.GetOrganizationStatisticsHttp).

GetOrganizationStatistics: Organization Administration

// init
// init — account-level binding, no resource argument
const getOrganizationStatistics = yield* AWS.GuardDuty.GetOrganizationStatistics();

// runtime
const { OrganizationDetails } = yield* getOrganizationStatistics();

GetRemainingFreeTrialDays

Source: src/AWS/GuardDuty/GetRemainingFreeTrialDays.ts

Runtime binding for guardduty:GetRemainingFreeTrialDays.

Reports the remaining free-trial days per data source for the given member account ids. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetRemainingFreeTrialDaysHttp).

GetRemainingFreeTrialDays: Usage & Coverage

// init
const getRemainingFreeTrialDays = yield* AWS.GuardDuty.GetRemainingFreeTrialDays(detector);

// runtime
const { Accounts } = yield* getRemainingFreeTrialDays({
  AccountIds: ["111122223333"],
});

GetUsageStatistics

Source: src/AWS/GuardDuty/GetUsageStatistics.ts

Runtime binding for guardduty:GetUsageStatistics.

Reports GuardDuty usage (cost) statistics for the detector, grouped by data source, feature, or member account. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.GetUsageStatisticsHttp).

GetUsageStatistics: Usage & Coverage

// init
const getUsageStatistics = yield* AWS.GuardDuty.GetUsageStatistics(detector);

// runtime
const { UsageStatistics } = yield* getUsageStatistics({
  UsageStatisticType: "SUM_BY_DATA_SOURCE",
  UsageCriteria: { DataSources: ["FLOW_LOGS"] },
});

InviteMembers

Source: src/AWS/GuardDuty/InviteMembers.ts

Runtime binding for guardduty:InviteMembers.

Invites member accounts (created via CreateMembers) to enable GuardDuty under this administrator. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.InviteMembersHttp).

InviteMembers: Member Administration

// init
const inviteMembers = yield* AWS.GuardDuty.InviteMembers(detector);

// runtime
yield* inviteMembers({
  AccountIds: ["111122223333"],
  Message: "Please enable GuardDuty",
});

IPSet

Source: src/AWS/GuardDuty/IPSet.ts

A GuardDuty trusted IP set — an S3-hosted list of IP addresses GuardDuty treats as trusted, suppressing findings for traffic from them. The list file must exist in S3 before activation; name, location, and activation are updatable in place, while format changes replace the set.

IPSet: Trusting Known IPs

Trust the office IP range

const detector = yield* AWS.GuardDuty.Detector("Detector", {});
const ipSet = yield* AWS.GuardDuty.IPSet("OfficeIPs", {
  detectorId: detector.detectorId,
  format: "TXT",
  location: "https://s3.amazonaws.com/my-security-bucket/office-ips.txt",
});

Stage a list without activating it

const ipSet = yield* AWS.GuardDuty.IPSet("StagedIPs", {
  detectorId: detector.detectorId,
  format: "TXT",
  location: "https://s3.amazonaws.com/my-security-bucket/staged.txt",
  activate: false,
});

ListCoverage

Source: src/AWS/GuardDuty/ListCoverage.ts

Runtime binding for guardduty:ListCoverage.

Enumerates per-resource coverage details — which EKS clusters, EC2 instances, and ECS clusters report runtime telemetry and why any are unhealthy. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.ListCoverageHttp).

ListCoverage: Usage & Coverage

// init
const listCoverage = yield* AWS.GuardDuty.ListCoverage(detector);

// runtime
const { Resources } = yield* listCoverage();

ListFindings

Source: src/AWS/GuardDuty/ListFindings.ts

Runtime binding for guardduty:ListFindings.

Lists finding ids for the detector, with optional finding criteria and sort order — the entry point for a findings-triage automation. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.ListFindingsHttp).

ListFindings: Working with Findings

// init
const listFindings = yield* AWS.GuardDuty.ListFindings(detector);

// runtime
const { FindingIds } = yield* listFindings();

ListInvestigations

Source: src/AWS/GuardDuty/ListInvestigations.ts

Runtime binding for guardduty:ListInvestigations.

Lists the detector’s investigations with optional sort criteria. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.ListInvestigationsHttp).

ListInvestigations: Extended Threat Detection

// init
const listInvestigations = yield* AWS.GuardDuty.ListInvestigations(detector);

// runtime
const { Investigations } = yield* listInvestigations();

ListInvitations

Source: src/AWS/GuardDuty/ListInvitations.ts

Runtime binding for guardduty:ListInvitations.

Lists GuardDuty membership invitations received by this account — ready for an automation that auto-accepts invitations from the security account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.ListInvitationsHttp).

ListInvitations: Administrator & Invitations

// init
// init — account-level binding, no resource argument
const listInvitations = yield* AWS.GuardDuty.ListInvitations();

// runtime
const { Invitations } = yield* listInvitations();

ListMalwareScans

Source: src/AWS/GuardDuty/ListMalwareScans.ts

Runtime binding for guardduty:ListMalwareScans.

Lists the account’s on-demand malware scans with optional filter and sort criteria. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.ListMalwareScansHttp).

ListMalwareScans: Malware Protection

// init
// init — account-level binding, no resource argument
const listMalwareScans = yield* AWS.GuardDuty.ListMalwareScans();

// runtime
const { Scans } = yield* listMalwareScans();

ListMembers

Source: src/AWS/GuardDuty/ListMembers.ts

Runtime binding for guardduty:ListMembers.

Enumerates the member accounts associated with this administrator detector. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.ListMembersHttp).

ListMembers: Member Administration

// init
const listMembers = yield* AWS.GuardDuty.ListMembers(detector);

// runtime
const { Members } = yield* listMembers();

ListOrganizationAdminAccounts

Source: src/AWS/GuardDuty/ListOrganizationAdminAccounts.ts

Runtime binding for guardduty:ListOrganizationAdminAccounts.

Lists the accounts delegated as GuardDuty administrator for the organization. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.ListOrganizationAdminAccountsHttp).

ListOrganizationAdminAccounts: Organization Administration

// init
// init — account-level binding, no resource argument
const listOrganizationAdminAccounts = yield* AWS.GuardDuty.ListOrganizationAdminAccounts();

// runtime
const { AdminAccounts } = yield* listOrganizationAdminAccounts();

SendObjectMalwareScan

Source: src/AWS/GuardDuty/SendObjectMalwareScan.ts

Runtime binding for guardduty:SendObjectMalwareScan.

Submits an S3 object for malware scanning under a Malware Protection plan covering its bucket. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.SendObjectMalwareScanHttp).

SendObjectMalwareScan: Malware Protection

// init
// init — account-level binding, no resource argument
const sendObjectMalwareScan = yield* AWS.GuardDuty.SendObjectMalwareScan();

// runtime
yield* sendObjectMalwareScan({
  S3Object: { Bucket: "my-bucket", Key: "upload.bin" },
});

StartMalwareScan

Source: src/AWS/GuardDuty/StartMalwareScan.ts

Runtime binding for guardduty:StartMalwareScan.

Starts an on-demand malware scan of an EC2 instance by ARN (GuardDuty Malware Protection for EC2). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.GuardDuty.StartMalwareScanHttp).

StartMalwareScan: Malware Protection

// init
// init — account-level binding, no resource argument
const startMalwareScan = yield* AWS.GuardDuty.StartMalwareScan();

// runtime
const { ScanId } = yield* startMalwareScan({
  ResourceArn: instanceArn,
});

StartMonitoringMembers

Source: src/AWS/GuardDuty/StartMonitoringMembers.ts

Runtime binding for guardduty:StartMonitoringMembers.

Resumes GuardDuty monitoring for member accounts previously stopped with StopMonitoringMembers. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.StartMonitoringMembersHttp).

StartMonitoringMembers: Member Administration

// init
const startMonitoringMembers = yield* AWS.GuardDuty.StartMonitoringMembers(detector);

// runtime
yield* startMonitoringMembers({ AccountIds: ["111122223333"] });

StopMonitoringMembers

Source: src/AWS/GuardDuty/StopMonitoringMembers.ts

Runtime binding for guardduty:StopMonitoringMembers.

Pauses GuardDuty monitoring for the given member accounts. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.StopMonitoringMembersHttp).

StopMonitoringMembers: Member Administration

// init
const stopMonitoringMembers = yield* AWS.GuardDuty.StopMonitoringMembers(detector);

// runtime
yield* stopMonitoringMembers({ AccountIds: ["111122223333"] });

ThreatIntelSet

Source: src/AWS/GuardDuty/ThreatIntelSet.ts

A GuardDuty threat intelligence set — an S3-hosted list of known malicious IP addresses that GuardDuty generates findings for. The list file must exist in S3 before activation; name, location, and activation are updatable in place, while format changes replace the set.

ThreatIntelSet: Custom Threat Intelligence

const detector = yield* AWS.GuardDuty.Detector("Detector", {});
const threats = yield* AWS.GuardDuty.ThreatIntelSet("BadIPs", {
  detectorId: detector.detectorId,
  format: "TXT",
  location: "https://s3.amazonaws.com/my-security-bucket/threats.txt",
});

UnarchiveFindings

Source: src/AWS/GuardDuty/UnarchiveFindings.ts

Runtime binding for guardduty:UnarchiveFindings.

Restores archived findings back into the detector’s active queue. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.UnarchiveFindingsHttp).

UnarchiveFindings: Working with Findings

// init
const unarchiveFindings = yield* AWS.GuardDuty.UnarchiveFindings(detector);

// runtime
yield* unarchiveFindings({ FindingIds: findingIds });

UpdateFindingsFeedback

Source: src/AWS/GuardDuty/UpdateFindingsFeedback.ts

Runtime binding for guardduty:UpdateFindingsFeedback.

Marks findings as USEFUL or NOT_USEFUL to tune GuardDuty’s signal quality. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.UpdateFindingsFeedbackHttp).

UpdateFindingsFeedback: Working with Findings

// init
const updateFindingsFeedback = yield* AWS.GuardDuty.UpdateFindingsFeedback(detector);

// runtime
yield* updateFindingsFeedback({
  FindingIds: findingIds,
  Feedback: "USEFUL",
});

UpdateMalwareScanSettings

Source: src/AWS/GuardDuty/UpdateMalwareScanSettings.ts

Runtime binding for guardduty:UpdateMalwareScanSettings.

Updates the detector’s EC2 malware scan settings (scan inclusion/exclusion tags, snapshot retention). The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.UpdateMalwareScanSettingsHttp).

UpdateMalwareScanSettings: Malware Protection

// init
const updateMalwareScanSettings = yield* AWS.GuardDuty.UpdateMalwareScanSettings(detector);

// runtime
yield* updateMalwareScanSettings({
  EbsSnapshotPreservation: "RETENTION_WITH_FINDING",
});

UpdateMemberDetectors

Source: src/AWS/GuardDuty/UpdateMemberDetectors.ts

Runtime binding for guardduty:UpdateMemberDetectors.

Updates the feature configuration of member detectors from the administrator account. The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.UpdateMemberDetectorsHttp).

UpdateMemberDetectors: Member Administration

// init
const updateMemberDetectors = yield* AWS.GuardDuty.UpdateMemberDetectors(detector);

// runtime
yield* updateMemberDetectors({
  AccountIds: ["111122223333"],
  Features: [{ Name: "S3_DATA_EVENTS", Status: "ENABLED" }],
});

UpdateOrganizationConfiguration

Source: src/AWS/GuardDuty/UpdateOrganizationConfiguration.ts

Runtime binding for guardduty:UpdateOrganizationConfiguration.

Updates the organization’s GuardDuty auto-enable configuration (delegated administrator only). The detector id is injected from the bound Detector. Provide the implementation with Effect.provide(AWS.GuardDuty.UpdateOrganizationConfigurationHttp).

UpdateOrganizationConfiguration: Organization Administration

// init
const updateOrganizationConfiguration = yield* AWS.GuardDuty.UpdateOrganizationConfiguration(detector);

// runtime
yield* updateOrganizationConfiguration({
  AutoEnableOrganizationMembers: "NEW",
});