AcceptAdministratorInvitation

$result = $client->acceptAdministratorInvitation([/* ... */]);
$promise = $client->acceptAdministratorInvitationAsync([/* ... */]);

Accepts the invitation to be a member account and get monitored by a GuardDuty administrator account that sent the invitation.

Parameter Syntax

$result = $client->acceptAdministratorInvitation([
    'AdministratorId' => '<string>', // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
    'InvitationId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

AcceptInvitation

$result = $client->acceptInvitation([/* ... */]);
$promise = $client->acceptInvitationAsync([/* ... */]);

Accepts the invitation to be monitored by a GuardDuty administrator account.

Parameter Syntax

$result = $client->acceptInvitation([
    'DetectorId' => '<string>', // REQUIRED
    'InvitationId' => '<string>', // REQUIRED
    'MasterId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ArchiveFindings

$result = $client->archiveFindings([/* ... */]);
$promise = $client->archiveFindingsAsync([/* ... */]);

Archives GuardDuty findings that are specified by the list of finding IDs.

Parameter Syntax

$result = $client->archiveFindings([
    'DetectorId' => '<string>', // REQUIRED
    'FindingIds' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateDetector

$result = $client->createDetector([/* ... */]);
$promise = $client->createDetectorAsync([/* ... */]);

Creates a single GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default.

• When you don't specify any features, with an exception to RUNTIME_MONITORING, all the optional features are enabled by default.

• When you specify some of the features, any feature that is not specified in the API call gets enabled by default, with an exception to RUNTIME_MONITORING.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->createDetector([
    'ClientToken' => '<string>',
    'DataSources' => [
        'Kubernetes' => [
            'AuditLogs' => [ // REQUIRED
                'Enable' => true || false, // REQUIRED
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => true || false,
            ],
        ],
        'S3Logs' => [
            'Enable' => true || false, // REQUIRED
        ],
    ],
    'Enable' => true || false, // REQUIRED
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                    'Status' => 'ENABLED|DISABLED',
                ],
                // ...
            ],
            'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
            'Status' => 'ENABLED|DISABLED',
        ],
        // ...
    ],
    'FindingPublishingFrequency' => 'FIFTEEN_MINUTES|ONE_HOUR|SIX_HOURS',
    'Tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'DetectorId' => '<string>',
    'UnprocessedDataSources' => [
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => [
                    'Reason' => '<string>',
                    'Status' => 'ENABLED|DISABLED',
                ],
            ],
            'ServiceRole' => '<string>',
        ],
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateFilter

$result = $client->createFilter([/* ... */]);
$promise = $client->createFilterAsync([/* ... */]);

Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.

Parameter Syntax

$result = $client->createFilter([
    'Action' => 'NOOP|ARCHIVE',
    'ClientToken' => '<string>',
    'Description' => '<string>',
    'DetectorId' => '<string>', // REQUIRED
    'FindingCriteria' => [ // REQUIRED
        'Criterion' => [
            '<String>' => [
                'Eq' => ['<string>', ...],
                'Equals' => ['<string>', ...],
                'GreaterThan' => <integer>,
                'GreaterThanOrEqual' => <integer>,
                'Gt' => <integer>,
                'Gte' => <integer>,
                'LessThan' => <integer>,
                'LessThanOrEqual' => <integer>,
                'Lt' => <integer>,
                'Lte' => <integer>,
                'Neq' => ['<string>', ...],
                'NotEquals' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'Name' => '<string>', // REQUIRED
    'Rank' => <integer>,
    'Tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'Name' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateIPSet

$result = $client->createIPSet([/* ... */]);
$promise = $client->createIPSetAsync([/* ... */]);

Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.

Parameter Syntax

$result = $client->createIPSet([
    'Activate' => true || false, // REQUIRED
    'ClientToken' => '<string>',
    'DetectorId' => '<string>', // REQUIRED
    'Format' => 'TXT|STIX|OTX_CSV|ALIEN_VAULT|PROOF_POINT|FIRE_EYE', // REQUIRED
    'Location' => '<string>', // REQUIRED
    'Name' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'IpSetId' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateMalwareProtectionPlan

$result = $client->createMalwareProtectionPlan([/* ... */]);
$promise = $client->createMalwareProtectionPlanAsync([/* ... */]);

Creates a new Malware Protection plan for the protected resource.

When you create a Malware Protection plan, the Amazon Web Services service terms for GuardDuty Malware Protection apply. For more information, see Amazon Web Services service terms for GuardDuty Malware Protection.

Parameter Syntax

$result = $client->createMalwareProtectionPlan([
    'Actions' => [
        'Tagging' => [
            'Status' => 'ENABLED|DISABLED',
        ],
    ],
    'ClientToken' => '<string>',
    'ProtectedResource' => [ // REQUIRED
        'S3Bucket' => [
            'BucketName' => '<string>',
            'ObjectPrefixes' => ['<string>', ...],
        ],
    ],
    'Role' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'MalwareProtectionPlanId' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

ConflictException:

A request conflict exception object.

InternalServerErrorException:

An internal server error exception object.

CreateMembers

$result = $client->createMembers([/* ... */]);
$promise = $client->createMembersAsync([/* ... */]);

Creates member accounts of the current Amazon Web Services account by specifying a list of Amazon Web Services account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization.

As a delegated administrator, using CreateMembers will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account. A delegated administrator must enable GuardDuty prior to being added as a member.

When you use CreateMembers as an Organizations delegated administrator, GuardDuty applies your organization's auto-enable settings to the member accounts in this request, irrespective of the accounts being new or existing members. For more information about the existing auto-enable settings for your organization, see DescribeOrganizationConfiguration.

If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Parameter Syntax

$result = $client->createMembers([
    'AccountDetails' => [ // REQUIRED
        [
            'AccountId' => '<string>', // REQUIRED
            'Email' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreatePublishingDestination

$result = $client->createPublishingDestination([/* ... */]);
$promise = $client->createPublishingDestinationAsync([/* ... */]);

Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.

Parameter Syntax

$result = $client->createPublishingDestination([
    'ClientToken' => '<string>',
    'DestinationProperties' => [ // REQUIRED
        'DestinationArn' => '<string>',
        'KmsKeyArn' => '<string>',
    ],
    'DestinationType' => 'S3', // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'DestinationId' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateSampleFindings

$result = $client->createSampleFindings([/* ... */]);
$promise = $client->createSampleFindingsAsync([/* ... */]);

Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.

Parameter Syntax

$result = $client->createSampleFindings([
    'DetectorId' => '<string>', // REQUIRED
    'FindingTypes' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

CreateThreatIntelSet

$result = $client->createThreatIntelSet([/* ... */]);
$promise = $client->createThreatIntelSetAsync([/* ... */]);

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Parameter Syntax

$result = $client->createThreatIntelSet([
    'Activate' => true || false, // REQUIRED
    'ClientToken' => '<string>',
    'DetectorId' => '<string>', // REQUIRED
    'Format' => 'TXT|STIX|OTX_CSV|ALIEN_VAULT|PROOF_POINT|FIRE_EYE', // REQUIRED
    'Location' => '<string>', // REQUIRED
    'Name' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'ThreatIntelSetId' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeclineInvitations

$result = $client->declineInvitations([/* ... */]);
$promise = $client->declineInvitationsAsync([/* ... */]);

Declines invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Parameter Syntax

$result = $client->declineInvitations([
    'AccountIds' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteDetector

$result = $client->deleteDetector([/* ... */]);
$promise = $client->deleteDetectorAsync([/* ... */]);

Deletes an Amazon GuardDuty detector that is specified by the detector ID.

Parameter Syntax

$result = $client->deleteDetector([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteFilter

$result = $client->deleteFilter([/* ... */]);
$promise = $client->deleteFilterAsync([/* ... */]);

Deletes the filter specified by the filter name.

Parameter Syntax

$result = $client->deleteFilter([
    'DetectorId' => '<string>', // REQUIRED
    'FilterName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteIPSet

$result = $client->deleteIPSet([/* ... */]);
$promise = $client->deleteIPSetAsync([/* ... */]);

Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

Parameter Syntax

$result = $client->deleteIPSet([
    'DetectorId' => '<string>', // REQUIRED
    'IpSetId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteInvitations

$result = $client->deleteInvitations([/* ... */]);
$promise = $client->deleteInvitationsAsync([/* ... */]);

Deletes invitations sent to the current member account by Amazon Web Services accounts specified by their account IDs.

Parameter Syntax

$result = $client->deleteInvitations([
    'AccountIds' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteMalwareProtectionPlan

$result = $client->deleteMalwareProtectionPlan([/* ... */]);
$promise = $client->deleteMalwareProtectionPlanAsync([/* ... */]);

Deletes the Malware Protection plan ID associated with the Malware Protection plan resource. Use this API only when you no longer want to protect the resource associated with this Malware Protection plan ID.

Parameter Syntax

$result = $client->deleteMalwareProtectionPlan([
    'MalwareProtectionPlanId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

ResourceNotFoundException:

The requested resource can't be found.

DeleteMembers

$result = $client->deleteMembers([/* ... */]);
$promise = $client->deleteMembersAsync([/* ... */]);

Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization.

Parameter Syntax

$result = $client->deleteMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeletePublishingDestination

$result = $client->deletePublishingDestination([/* ... */]);
$promise = $client->deletePublishingDestinationAsync([/* ... */]);

Deletes the publishing definition with the specified destinationId.

Parameter Syntax

$result = $client->deletePublishingDestination([
    'DestinationId' => '<string>', // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DeleteThreatIntelSet

$result = $client->deleteThreatIntelSet([/* ... */]);
$promise = $client->deleteThreatIntelSetAsync([/* ... */]);

Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.

Parameter Syntax

$result = $client->deleteThreatIntelSet([
    'DetectorId' => '<string>', // REQUIRED
    'ThreatIntelSetId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DescribeMalwareScans

$result = $client->describeMalwareScans([/* ... */]);
$promise = $client->describeMalwareScansAsync([/* ... */]);

Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->describeMalwareScans([
    'DetectorId' => '<string>', // REQUIRED
    'FilterCriteria' => [
        'FilterCriterion' => [
            [
                'CriterionKey' => 'EC2_INSTANCE_ARN|SCAN_ID|ACCOUNT_ID|GUARDDUTY_FINDING_ID|SCAN_START_TIME|SCAN_STATUS|SCAN_TYPE',
                'FilterCondition' => [
                    'EqualsValue' => '<string>',
                    'GreaterThan' => <integer>,
                    'LessThan' => <integer>,
                ],
            ],
            // ...
        ],
    ],
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'SortCriteria' => [
        'AttributeName' => '<string>',
        'OrderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'NextToken' => '<string>',
    'Scans' => [
        [
            'AccountId' => '<string>',
            'AdminDetectorId' => '<string>',
            'AttachedVolumes' => [
                [
                    'DeviceName' => '<string>',
                    'EncryptionType' => '<string>',
                    'KmsKeyArn' => '<string>',
                    'SnapshotArn' => '<string>',
                    'VolumeArn' => '<string>',
                    'VolumeSizeInGB' => <integer>,
                    'VolumeType' => '<string>',
                ],
                // ...
            ],
            'DetectorId' => '<string>',
            'FailureReason' => '<string>',
            'FileCount' => <integer>,
            'ResourceDetails' => [
                'InstanceArn' => '<string>',
            ],
            'ScanEndTime' => <DateTime>,
            'ScanId' => '<string>',
            'ScanResultDetails' => [
                'ScanResult' => 'CLEAN|INFECTED',
            ],
            'ScanStartTime' => <DateTime>,
            'ScanStatus' => 'RUNNING|COMPLETED|FAILED|SKIPPED',
            'ScanType' => 'GUARDDUTY_INITIATED|ON_DEMAND',
            'TotalBytes' => <integer>,
            'TriggerDetails' => [
                'Description' => '<string>',
                'GuardDutyFindingId' => '<string>',
            ],
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DescribeOrganizationConfiguration

$result = $client->describeOrganizationConfiguration([/* ... */]);
$promise = $client->describeOrganizationConfigurationAsync([/* ... */]);

Returns information about the account selected as the delegated administrator for GuardDuty.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->describeOrganizationConfiguration([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'AutoEnable' => true || false,
    'AutoEnableOrganizationMembers' => 'NEW|ALL|NONE',
    'DataSources' => [
        'Kubernetes' => [
            'AuditLogs' => [
                'AutoEnable' => true || false,
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => [
                    'AutoEnable' => true || false,
                ],
            ],
        ],
        'S3Logs' => [
            'AutoEnable' => true || false,
        ],
    ],
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'AutoEnable' => 'NEW|NONE|ALL',
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                ],
                // ...
            ],
            'AutoEnable' => 'NEW|NONE|ALL',
            'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
        ],
        // ...
    ],
    'MemberAccountLimitReached' => true || false,
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DescribePublishingDestination

$result = $client->describePublishingDestination([/* ... */]);
$promise = $client->describePublishingDestinationAsync([/* ... */]);

Returns information about the publishing destination specified by the provided destinationId.

Parameter Syntax

$result = $client->describePublishingDestination([
    'DestinationId' => '<string>', // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'DestinationId' => '<string>',
    'DestinationProperties' => [
        'DestinationArn' => '<string>',
        'KmsKeyArn' => '<string>',
    ],
    'DestinationType' => 'S3',
    'PublishingFailureStartTimestamp' => <integer>,
    'Status' => 'PENDING_VERIFICATION|PUBLISHING|UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY|STOPPED',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DisableOrganizationAdminAccount

$result = $client->disableOrganizationAdminAccount([/* ... */]);
$promise = $client->disableOrganizationAdminAccountAsync([/* ... */]);

Removes the existing GuardDuty delegated administrator of the organization. Only the organization's management account can run this API operation.

Parameter Syntax

$result = $client->disableOrganizationAdminAccount([
    'AdminAccountId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DisassociateFromAdministratorAccount

$result = $client->disassociateFromAdministratorAccount([/* ... */]);
$promise = $client->disassociateFromAdministratorAccountAsync([/* ... */]);

Disassociates the current GuardDuty member account from its administrator account.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.

Parameter Syntax

$result = $client->disassociateFromAdministratorAccount([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DisassociateFromMasterAccount

$result = $client->disassociateFromMasterAccount([/* ... */]);
$promise = $client->disassociateFromMasterAccountAsync([/* ... */]);

Disassociates the current GuardDuty member account from its administrator account.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

Parameter Syntax

$result = $client->disassociateFromMasterAccount([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

DisassociateMembers

$result = $client->disassociateMembers([/* ... */]);
$promise = $client->disassociateMembersAsync([/* ... */]);

Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs.

When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization.

If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Parameter Syntax

$result = $client->disassociateMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

EnableOrganizationAdminAccount

$result = $client->enableOrganizationAdminAccount([/* ... */]);
$promise = $client->enableOrganizationAdminAccountAsync([/* ... */]);

Designates an Amazon Web Services account within the organization as your GuardDuty delegated administrator. Only the organization's management account can run this API operation.

Parameter Syntax

$result = $client->enableOrganizationAdminAccount([
    'AdminAccountId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetAdministratorAccount

$result = $client->getAdministratorAccount([/* ... */]);
$promise = $client->getAdministratorAccountAsync([/* ... */]);

Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account.

Parameter Syntax

$result = $client->getAdministratorAccount([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Administrator' => [
        'AccountId' => '<string>',
        'InvitationId' => '<string>',
        'InvitedAt' => '<string>',
        'RelationshipStatus' => '<string>',
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetCoverageStatistics

$result = $client->getCoverageStatistics([/* ... */]);
$promise = $client->getCoverageStatisticsAsync([/* ... */]);

Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources.

Parameter Syntax

$result = $client->getCoverageStatistics([
    'DetectorId' => '<string>', // REQUIRED
    'FilterCriteria' => [
        'FilterCriterion' => [
            [
                'CriterionKey' => 'ACCOUNT_ID|CLUSTER_NAME|RESOURCE_TYPE|COVERAGE_STATUS|ADDON_VERSION|MANAGEMENT_TYPE|EKS_CLUSTER_NAME|ECS_CLUSTER_NAME|AGENT_VERSION|INSTANCE_ID|CLUSTER_ARN',
                'FilterCondition' => [
                    'Equals' => ['<string>', ...],
                    'NotEquals' => ['<string>', ...],
                ],
            ],
            // ...
        ],
    ],
    'StatisticsType' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[
    'CoverageStatistics' => [
        'CountByCoverageStatus' => [<integer>, ...],
        'CountByResourceType' => [<integer>, ...],
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetDetector

$result = $client->getDetector([/* ... */]);
$promise = $client->getDetectorAsync([/* ... */]);

Retrieves a GuardDuty detector specified by the detectorId.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->getDetector([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'CreatedAt' => '<string>',
    'DataSources' => [
        'CloudTrail' => [
            'Status' => 'ENABLED|DISABLED',
        ],
        'DNSLogs' => [
            'Status' => 'ENABLED|DISABLED',
        ],
        'FlowLogs' => [
            'Status' => 'ENABLED|DISABLED',
        ],
        'Kubernetes' => [
            'AuditLogs' => [
                'Status' => 'ENABLED|DISABLED',
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => [
                    'Reason' => '<string>',
                    'Status' => 'ENABLED|DISABLED',
                ],
            ],
            'ServiceRole' => '<string>',
        ],
        'S3Logs' => [
            'Status' => 'ENABLED|DISABLED',
        ],
    ],
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                    'Status' => 'ENABLED|DISABLED',
                    'UpdatedAt' => <DateTime>,
                ],
                // ...
            ],
            'Name' => 'FLOW_LOGS|CLOUD_TRAIL|DNS_LOGS|S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
            'Status' => 'ENABLED|DISABLED',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
    'FindingPublishingFrequency' => 'FIFTEEN_MINUTES|ONE_HOUR|SIX_HOURS',
    'ServiceRole' => '<string>',
    'Status' => 'ENABLED|DISABLED',
    'Tags' => ['<string>', ...],
    'UpdatedAt' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetFilter

$result = $client->getFilter([/* ... */]);
$promise = $client->getFilterAsync([/* ... */]);

Returns the details of the filter specified by the filter name.

Parameter Syntax

$result = $client->getFilter([
    'DetectorId' => '<string>', // REQUIRED
    'FilterName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Action' => 'NOOP|ARCHIVE',
    'Description' => '<string>',
    'FindingCriteria' => [
        'Criterion' => [
            '<String>' => [
                'Eq' => ['<string>', ...],
                'Equals' => ['<string>', ...],
                'GreaterThan' => <integer>,
                'GreaterThanOrEqual' => <integer>,
                'Gt' => <integer>,
                'Gte' => <integer>,
                'LessThan' => <integer>,
                'LessThanOrEqual' => <integer>,
                'Lt' => <integer>,
                'Lte' => <integer>,
                'Neq' => ['<string>', ...],
                'NotEquals' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'Name' => '<string>',
    'Rank' => <integer>,
    'Tags' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetFindings

$result = $client->getFindings([/* ... */]);
$promise = $client->getFindingsAsync([/* ... */]);

Describes Amazon GuardDuty findings specified by finding IDs.

Parameter Syntax

$result = $client->getFindings([
    'DetectorId' => '<string>', // REQUIRED
    'FindingIds' => ['<string>', ...], // REQUIRED
    'SortCriteria' => [
        'AttributeName' => '<string>',
        'OrderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'Findings' => [
        [
            'AccountId' => '<string>',
            'Arn' => '<string>',
            'AssociatedAttackSequenceArn' => '<string>',
            'Confidence' => <float>,
            'CreatedAt' => '<string>',
            'Description' => '<string>',
            'Id' => '<string>',
            'Partition' => '<string>',
            'Region' => '<string>',
            'Resource' => [
                'AccessKeyDetails' => [
                    'AccessKeyId' => '<string>',
                    'PrincipalId' => '<string>',
                    'UserName' => '<string>',
                    'UserType' => '<string>',
                ],
                'ContainerDetails' => [
                    'ContainerRuntime' => '<string>',
                    'Id' => '<string>',
                    'Image' => '<string>',
                    'ImagePrefix' => '<string>',
                    'Name' => '<string>',
                    'SecurityContext' => [
                        'AllowPrivilegeEscalation' => true || false,
                        'Privileged' => true || false,
                    ],
                    'VolumeMounts' => [
                        [
                            'MountPath' => '<string>',
                            'Name' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'EbsVolumeDetails' => [
                    'ScannedVolumeDetails' => [
                        [
                            'DeviceName' => '<string>',
                            'EncryptionType' => '<string>',
                            'KmsKeyArn' => '<string>',
                            'SnapshotArn' => '<string>',
                            'VolumeArn' => '<string>',
                            'VolumeSizeInGB' => <integer>,
                            'VolumeType' => '<string>',
                        ],
                        // ...
                    ],
                    'SkippedVolumeDetails' => [
                        [
                            'DeviceName' => '<string>',
                            'EncryptionType' => '<string>',
                            'KmsKeyArn' => '<string>',
                            'SnapshotArn' => '<string>',
                            'VolumeArn' => '<string>',
                            'VolumeSizeInGB' => <integer>,
                            'VolumeType' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'EcsClusterDetails' => [
                    'ActiveServicesCount' => <integer>,
                    'Arn' => '<string>',
                    'Name' => '<string>',
                    'RegisteredContainerInstancesCount' => <integer>,
                    'RunningTasksCount' => <integer>,
                    'Status' => '<string>',
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                    'TaskDetails' => [
                        'Arn' => '<string>',
                        'Containers' => [
                            [
                                'ContainerRuntime' => '<string>',
                                'Id' => '<string>',
                                'Image' => '<string>',
                                'ImagePrefix' => '<string>',
                                'Name' => '<string>',
                                'SecurityContext' => [
                                    'AllowPrivilegeEscalation' => true || false,
                                    'Privileged' => true || false,
                                ],
                                'VolumeMounts' => [
                                    [
                                        'MountPath' => '<string>',
                                        'Name' => '<string>',
                                    ],
                                    // ...
                                ],
                            ],
                            // ...
                        ],
                        'DefinitionArn' => '<string>',
                        'Group' => '<string>',
                        'LaunchType' => '<string>',
                        'StartedAt' => <DateTime>,
                        'StartedBy' => '<string>',
                        'Tags' => [
                            [
                                'Key' => '<string>',
                                'Value' => '<string>',
                            ],
                            // ...
                        ],
                        'TaskCreatedAt' => <DateTime>,
                        'Version' => '<string>',
                        'Volumes' => [
                            [
                                'HostPath' => [
                                    'Path' => '<string>',
                                ],
                                'Name' => '<string>',
                            ],
                            // ...
                        ],
                    ],
                ],
                'EksClusterDetails' => [
                    'Arn' => '<string>',
                    'CreatedAt' => <DateTime>,
                    'Name' => '<string>',
                    'Status' => '<string>',
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                    'VpcId' => '<string>',
                ],
                'InstanceDetails' => [
                    'AvailabilityZone' => '<string>',
                    'IamInstanceProfile' => [
                        'Arn' => '<string>',
                        'Id' => '<string>',
                    ],
                    'ImageDescription' => '<string>',
                    'ImageId' => '<string>',
                    'InstanceId' => '<string>',
                    'InstanceState' => '<string>',
                    'InstanceType' => '<string>',
                    'LaunchTime' => '<string>',
                    'NetworkInterfaces' => [
                        [
                            'Ipv6Addresses' => ['<string>', ...],
                            'NetworkInterfaceId' => '<string>',
                            'PrivateDnsName' => '<string>',
                            'PrivateIpAddress' => '<string>',
                            'PrivateIpAddresses' => [
                                [
                                    'PrivateDnsName' => '<string>',
                                    'PrivateIpAddress' => '<string>',
                                ],
                                // ...
                            ],
                            'PublicDnsName' => '<string>',
                            'PublicIp' => '<string>',
                            'SecurityGroups' => [
                                [
                                    'GroupId' => '<string>',
                                    'GroupName' => '<string>',
                                ],
                                // ...
                            ],
                            'SubnetId' => '<string>',
                            'VpcId' => '<string>',
                        ],
                        // ...
                    ],
                    'OutpostArn' => '<string>',
                    'Platform' => '<string>',
                    'ProductCodes' => [
                        [
                            'Code' => '<string>',
                            'ProductType' => '<string>',
                        ],
                        // ...
                    ],
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'KubernetesDetails' => [
                    'KubernetesUserDetails' => [
                        'Groups' => ['<string>', ...],
                        'ImpersonatedUser' => [
                            'Groups' => ['<string>', ...],
                            'Username' => '<string>',
                        ],
                        'SessionName' => ['<string>', ...],
                        'Uid' => '<string>',
                        'Username' => '<string>',
                    ],
                    'KubernetesWorkloadDetails' => [
                        'Containers' => [
                            [
                                'ContainerRuntime' => '<string>',
                                'Id' => '<string>',
                                'Image' => '<string>',
                                'ImagePrefix' => '<string>',
                                'Name' => '<string>',
                                'SecurityContext' => [
                                    'AllowPrivilegeEscalation' => true || false,
                                    'Privileged' => true || false,
                                ],
                                'VolumeMounts' => [
                                    [
                                        'MountPath' => '<string>',
                                        'Name' => '<string>',
                                    ],
                                    // ...
                                ],
                            ],
                            // ...
                        ],
                        'HostIPC' => true || false,
                        'HostNetwork' => true || false,
                        'HostPID' => true || false,
                        'Name' => '<string>',
                        'Namespace' => '<string>',
                        'ServiceAccountName' => '<string>',
                        'Type' => '<string>',
                        'Uid' => '<string>',
                        'Volumes' => [
                            [
                                'HostPath' => [
                                    'Path' => '<string>',
                                ],
                                'Name' => '<string>',
                            ],
                            // ...
                        ],
                    ],
                ],
                'LambdaDetails' => [
                    'Description' => '<string>',
                    'FunctionArn' => '<string>',
                    'FunctionName' => '<string>',
                    'FunctionVersion' => '<string>',
                    'LastModifiedAt' => <DateTime>,
                    'RevisionId' => '<string>',
                    'Role' => '<string>',
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                    'VpcConfig' => [
                        'SecurityGroups' => [
                            [
                                'GroupId' => '<string>',
                                'GroupName' => '<string>',
                            ],
                            // ...
                        ],
                        'SubnetIds' => ['<string>', ...],
                        'VpcId' => '<string>',
                    ],
                ],
                'RdsDbInstanceDetails' => [
                    'DbClusterIdentifier' => '<string>',
                    'DbInstanceArn' => '<string>',
                    'DbInstanceIdentifier' => '<string>',
                    'Engine' => '<string>',
                    'EngineVersion' => '<string>',
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'RdsDbUserDetails' => [
                    'Application' => '<string>',
                    'AuthMethod' => '<string>',
                    'Database' => '<string>',
                    'Ssl' => '<string>',
                    'User' => '<string>',
                ],
                'RdsLimitlessDbDetails' => [
                    'DbClusterIdentifier' => '<string>',
                    'DbShardGroupArn' => '<string>',
                    'DbShardGroupIdentifier' => '<string>',
                    'DbShardGroupResourceId' => '<string>',
                    'Engine' => '<string>',
                    'EngineVersion' => '<string>',
                    'Tags' => [
                        [
                            'Key' => '<string>',
                            'Value' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'ResourceType' => '<string>',
                'S3BucketDetails' => [
                    [
                        'Arn' => '<string>',
                        'CreatedAt' => <DateTime>,
                        'DefaultServerSideEncryption' => [
                            'EncryptionType' => '<string>',
                            'KmsMasterKeyArn' => '<string>',
                        ],
                        'Name' => '<string>',
                        'Owner' => [
                            'Id' => '<string>',
                        ],
                        'PublicAccess' => [
                            'EffectivePermission' => '<string>',
                            'PermissionConfiguration' => [
                                'AccountLevelPermissions' => [
                                    'BlockPublicAccess' => [
                                        'BlockPublicAcls' => true || false,
                                        'BlockPublicPolicy' => true || false,
                                        'IgnorePublicAcls' => true || false,
                                        'RestrictPublicBuckets' => true || false,
                                    ],
                                ],
                                'BucketLevelPermissions' => [
                                    'AccessControlList' => [
                                        'AllowsPublicReadAccess' => true || false,
                                        'AllowsPublicWriteAccess' => true || false,
                                    ],
                                    'BlockPublicAccess' => [
                                        'BlockPublicAcls' => true || false,
                                        'BlockPublicPolicy' => true || false,
                                        'IgnorePublicAcls' => true || false,
                                        'RestrictPublicBuckets' => true || false,
                                    ],
                                    'BucketPolicy' => [
                                        'AllowsPublicReadAccess' => true || false,
                                        'AllowsPublicWriteAccess' => true || false,
                                    ],
                                ],
                            ],
                        ],
                        'S3ObjectDetails' => [
                            [
                                'ETag' => '<string>',
                                'Hash' => '<string>',
                                'Key' => '<string>',
                                'ObjectArn' => '<string>',
                                'VersionId' => '<string>',
                            ],
                            // ...
                        ],
                        'Tags' => [
                            [
                                'Key' => '<string>',
                                'Value' => '<string>',
                            ],
                            // ...
                        ],
                        'Type' => '<string>',
                    ],
                    // ...
                ],
            ],
            'SchemaVersion' => '<string>',
            'Service' => [
                'Action' => [
                    'ActionType' => '<string>',
                    'AwsApiCallAction' => [
                        'AffectedResources' => ['<string>', ...],
                        'Api' => '<string>',
                        'CallerType' => '<string>',
                        'DomainDetails' => [
                            'Domain' => '<string>',
                        ],
                        'ErrorCode' => '<string>',
                        'RemoteAccountDetails' => [
                            'AccountId' => '<string>',
                            'Affiliated' => true || false,
                        ],
                        'RemoteIpDetails' => [
                            'City' => [
                                'CityName' => '<string>',
                            ],
                            'Country' => [
                                'CountryCode' => '<string>',
                                'CountryName' => '<string>',
                            ],
                            'GeoLocation' => [
                                'Lat' => <float>,
                                'Lon' => <float>,
                            ],
                            'IpAddressV4' => '<string>',
                            'IpAddressV6' => '<string>',
                            'Organization' => [
                                'Asn' => '<string>',
                                'AsnOrg' => '<string>',
                                'Isp' => '<string>',
                                'Org' => '<string>',
                            ],
                        ],
                        'ServiceName' => '<string>',
                        'UserAgent' => '<string>',
                    ],
                    'DnsRequestAction' => [
                        'Blocked' => true || false,
                        'Domain' => '<string>',
                        'DomainWithSuffix' => '<string>',
                        'Protocol' => '<string>',
                    ],
                    'KubernetesApiCallAction' => [
                        'Namespace' => '<string>',
                        'Parameters' => '<string>',
                        'RemoteIpDetails' => [
                            'City' => [
                                'CityName' => '<string>',
                            ],
                            'Country' => [
                                'CountryCode' => '<string>',
                                'CountryName' => '<string>',
                            ],
                            'GeoLocation' => [
                                'Lat' => <float>,
                                'Lon' => <float>,
                            ],
                            'IpAddressV4' => '<string>',
                            'IpAddressV6' => '<string>',
                            'Organization' => [
                                'Asn' => '<string>',
                                'AsnOrg' => '<string>',
                                'Isp' => '<string>',
                                'Org' => '<string>',
                            ],
                        ],
                        'RequestUri' => '<string>',
                        'Resource' => '<string>',
                        'ResourceName' => '<string>',
                        'SourceIps' => ['<string>', ...],
                        'StatusCode' => <integer>,
                        'Subresource' => '<string>',
                        'UserAgent' => '<string>',
                        'Verb' => '<string>',
                    ],
                    'KubernetesPermissionCheckedDetails' => [
                        'Allowed' => true || false,
                        'Namespace' => '<string>',
                        'Resource' => '<string>',
                        'Verb' => '<string>',
                    ],
                    'KubernetesRoleBindingDetails' => [
                        'Kind' => '<string>',
                        'Name' => '<string>',
                        'RoleRefKind' => '<string>',
                        'RoleRefName' => '<string>',
                        'Uid' => '<string>',
                    ],
                    'KubernetesRoleDetails' => [
                        'Kind' => '<string>',
                        'Name' => '<string>',
                        'Uid' => '<string>',
                    ],
                    'NetworkConnectionAction' => [
                        'Blocked' => true || false,
                        'ConnectionDirection' => '<string>',
                        'LocalIpDetails' => [
                            'IpAddressV4' => '<string>',
                            'IpAddressV6' => '<string>',
                        ],
                        'LocalNetworkInterface' => '<string>',
                        'LocalPortDetails' => [
                            'Port' => <integer>,
                            'PortName' => '<string>',
                        ],
                        'Protocol' => '<string>',
                        'RemoteIpDetails' => [
                            'City' => [
                                'CityName' => '<string>',
                            ],
                            'Country' => [
                                'CountryCode' => '<string>',
                                'CountryName' => '<string>',
                            ],
                            'GeoLocation' => [
                                'Lat' => <float>,
                                'Lon' => <float>,
                            ],
                            'IpAddressV4' => '<string>',
                            'IpAddressV6' => '<string>',
                            'Organization' => [
                                'Asn' => '<string>',
                                'AsnOrg' => '<string>',
                                'Isp' => '<string>',
                                'Org' => '<string>',
                            ],
                        ],
                        'RemotePortDetails' => [
                            'Port' => <integer>,
                            'PortName' => '<string>',
                        ],
                    ],
                    'PortProbeAction' => [
                        'Blocked' => true || false,
                        'PortProbeDetails' => [
                            [
                                'LocalIpDetails' => [
                                    'IpAddressV4' => '<string>',
                                    'IpAddressV6' => '<string>',
                                ],
                                'LocalPortDetails' => [
                                    'Port' => <integer>,
                                    'PortName' => '<string>',
                                ],
                                'RemoteIpDetails' => [
                                    'City' => [
                                        'CityName' => '<string>',
                                    ],
                                    'Country' => [
                                        'CountryCode' => '<string>',
                                        'CountryName' => '<string>',
                                    ],
                                    'GeoLocation' => [
                                        'Lat' => <float>,
                                        'Lon' => <float>,
                                    ],
                                    'IpAddressV4' => '<string>',
                                    'IpAddressV6' => '<string>',
                                    'Organization' => [
                                        'Asn' => '<string>',
                                        'AsnOrg' => '<string>',
                                        'Isp' => '<string>',
                                        'Org' => '<string>',
                                    ],
                                ],
                            ],
                            // ...
                        ],
                    ],
                    'RdsLoginAttemptAction' => [
                        'LoginAttributes' => [
                            [
                                'Application' => '<string>',
                                'FailedLoginAttempts' => <integer>,
                                'SuccessfulLoginAttempts' => <integer>,
                                'User' => '<string>',
                            ],
                            // ...
                        ],
                        'RemoteIpDetails' => [
                            'City' => [
                                'CityName' => '<string>',
                            ],
                            'Country' => [
                                'CountryCode' => '<string>',
                                'CountryName' => '<string>',
                            ],
                            'GeoLocation' => [
                                'Lat' => <float>,
                                'Lon' => <float>,
                            ],
                            'IpAddressV4' => '<string>',
                            'IpAddressV6' => '<string>',
                            'Organization' => [
                                'Asn' => '<string>',
                                'AsnOrg' => '<string>',
                                'Isp' => '<string>',
                                'Org' => '<string>',
                            ],
                        ],
                    ],
                ],
                'AdditionalInfo' => [
                    'Type' => '<string>',
                    'Value' => '<string>',
                ],
                'Archived' => true || false,
                'Count' => <integer>,
                'Detection' => [
                    'Anomaly' => [
                        'Profiles' => [
                            '<String>' => [
                                '<String>' => [
                                    [
                                        'Observations' => [
                                            'Text' => ['<string>', ...],
                                        ],
                                        'ProfileSubtype' => 'FREQUENT|INFREQUENT|UNSEEN|RARE',
                                        'ProfileType' => 'FREQUENCY',
                                    ],
                                    // ...
                                ],
                                // ...
                            ],
                            // ...
                        ],
                        'Unusual' => [
                            'Behavior' => [
                                '<String>' => [
                                    '<String>' => [
                                        'Observations' => [
                                            'Text' => ['<string>', ...],
                                        ],
                                        'ProfileSubtype' => 'FREQUENT|INFREQUENT|UNSEEN|RARE',
                                        'ProfileType' => 'FREQUENCY',
                                    ],
                                    // ...
                                ],
                                // ...
                            ],
                        ],
                    ],
                    'Sequence' => [
                        'Actors' => [
                            [
                                'Id' => '<string>',
                                'Session' => [
                                    'CreatedTime' => <DateTime>,
                                    'Issuer' => '<string>',
                                    'MfaStatus' => 'ENABLED|DISABLED',
                                    'Uid' => '<string>',
                                ],
                                'User' => [
                                    'Account' => [
                                        'Name' => '<string>',
                                        'Uid' => '<string>',
                                    ],
                                    'CredentialUid' => '<string>',
                                    'Name' => '<string>',
                                    'Type' => '<string>',
                                    'Uid' => '<string>',
                                ],
                            ],
                            // ...
                        ],
                        'Description' => '<string>',
                        'Endpoints' => [
                            [
                                'AutonomousSystem' => [
                                    'Name' => '<string>',
                                    'Number' => <integer>,
                                ],
                                'Connection' => [
                                    'Direction' => 'INBOUND|OUTBOUND',
                                ],
                                'Domain' => '<string>',
                                'Id' => '<string>',
                                'Ip' => '<string>',
                                'Location' => [
                                    'City' => '<string>',
                                    'Country' => '<string>',
                                    'Latitude' => <float>,
                                    'Longitude' => <float>,
                                ],
                                'Port' => <integer>,
                            ],
                            // ...
                        ],
                        'Resources' => [
                            [
                                'AccountId' => '<string>',
                                'CloudPartition' => '<string>',
                                'Data' => [
                                    'AccessKey' => [
                                        'PrincipalId' => '<string>',
                                        'UserName' => '<string>',
                                        'UserType' => '<string>',
                                    ],
                                    'Ec2Instance' => [
                                        'AvailabilityZone' => '<string>',
                                        'Ec2NetworkInterfaceUids' => ['<string>', ...],
                                        'IamInstanceProfile' => [
                                            'Arn' => '<string>',
                                            'Id' => '<string>',
                                        ],
                                        'ImageDescription' => '<string>',
                                        'InstanceState' => '<string>',
                                        'InstanceType' => '<string>',
                                        'OutpostArn' => '<string>',
                                        'Platform' => '<string>',
                                        'ProductCodes' => [
                                            [
                                                'Code' => '<string>',
                                                'ProductType' => '<string>',
                                            ],
                                            // ...
                                        ],
                                    ],
                                    'Ec2NetworkInterface' => [
                                        'Ipv6Addresses' => ['<string>', ...],
                                        'PrivateIpAddresses' => [
                                            [
                                                'PrivateDnsName' => '<string>',
                                                'PrivateIpAddress' => '<string>',
                                            ],
                                            // ...
                                        ],
                                        'PublicIp' => '<string>',
                                        'SecurityGroups' => [
                                            [
                                                'GroupId' => '<string>',
                                                'GroupName' => '<string>',
                                            ],
                                            // ...
                                        ],
                                        'SubNetId' => '<string>',
                                        'VpcId' => '<string>',
                                    ],
                                    'S3Bucket' => [
                                        'AccountPublicAccess' => [
                                            'PublicAclAccess' => 'BLOCKED|ALLOWED',
                                            'PublicAclIgnoreBehavior' => 'IGNORED|NOT_IGNORED',
                                            'PublicBucketRestrictBehavior' => 'RESTRICTED|NOT_RESTRICTED',
                                            'PublicPolicyAccess' => 'BLOCKED|ALLOWED',
                                        ],
                                        'BucketPublicAccess' => [
                                            'PublicAclAccess' => 'BLOCKED|ALLOWED',
                                            'PublicAclIgnoreBehavior' => 'IGNORED|NOT_IGNORED',
                                            'PublicBucketRestrictBehavior' => 'RESTRICTED|NOT_RESTRICTED',
                                            'PublicPolicyAccess' => 'BLOCKED|ALLOWED',
                                        ],
                                        'CreatedAt' => <DateTime>,
                                        'EffectivePermission' => '<string>',
                                        'EncryptionKeyArn' => '<string>',
                                        'EncryptionType' => '<string>',
                                        'OwnerId' => '<string>',
                                        'PublicReadAccess' => 'BLOCKED|ALLOWED',
                                        'PublicWriteAccess' => 'BLOCKED|ALLOWED',
                                        'S3ObjectUids' => ['<string>', ...],
                                    ],
                                    'S3Object' => [
                                        'ETag' => '<string>',
                                        'Key' => '<string>',
                                        'VersionId' => '<string>',
                                    ],
                                ],
                                'Name' => '<string>',
                                'Region' => '<string>',
                                'ResourceType' => 'EC2_INSTANCE|EC2_NETWORK_INTERFACE|S3_BUCKET|S3_OBJECT|ACCESS_KEY',
                                'Service' => '<string>',
                                'Tags' => [
                                    [
                                        'Key' => '<string>',
                                        'Value' => '<string>',
                                    ],
                                    // ...
                                ],
                                'Uid' => '<string>',
                            ],
                            // ...
                        ],
                        'SequenceIndicators' => [
                            [
                                'Key' => 'SUSPICIOUS_USER_AGENT|SUSPICIOUS_NETWORK|MALICIOUS_IP|TOR_IP|ATTACK_TACTIC|HIGH_RISK_API|ATTACK_TECHNIQUE|UNUSUAL_API_FOR_ACCOUNT|UNUSUAL_ASN_FOR_ACCOUNT|UNUSUAL_ASN_FOR_USER',
                                'Title' => '<string>',
                                'Values' => ['<string>', ...],
                            ],
                            // ...
                        ],
                        'Signals' => [
                            [
                                'ActorIds' => ['<string>', ...],
                                'Count' => <integer>,
                                'CreatedAt' => <DateTime>,
                                'Description' => '<string>',
                                'EndpointIds' => ['<string>', ...],
                                'FirstSeenAt' => <DateTime>,
                                'LastSeenAt' => <DateTime>,
                                'Name' => '<string>',
                                'ResourceUids' => ['<string>', ...],
                                'Severity' => <float>,
                                'SignalIndicators' => [
                                    [
                                        'Key' => 'SUSPICIOUS_USER_AGENT|SUSPICIOUS_NETWORK|MALICIOUS_IP|TOR_IP|ATTACK_TACTIC|HIGH_RISK_API|ATTACK_TECHNIQUE|UNUSUAL_API_FOR_ACCOUNT|UNUSUAL_ASN_FOR_ACCOUNT|UNUSUAL_ASN_FOR_USER',
                                        'Title' => '<string>',
                                        'Values' => ['<string>', ...],
                                    ],
                                    // ...
                                ],
                                'Type' => 'FINDING|CLOUD_TRAIL|S3_DATA_EVENTS',
                                'Uid' => '<string>',
                                'UpdatedAt' => <DateTime>,
                            ],
                            // ...
                        ],
                        'Uid' => '<string>',
                    ],
                ],
                'DetectorId' => '<string>',
                'EbsVolumeScanDetails' => [
                    'ScanCompletedAt' => <DateTime>,
                    'ScanDetections' => [
                        'HighestSeverityThreatDetails' => [
                            'Count' => <integer>,
                            'Severity' => '<string>',
                            'ThreatName' => '<string>',
                        ],
                        'ScannedItemCount' => [
                            'Files' => <integer>,
                            'TotalGb' => <integer>,
                            'Volumes' => <integer>,
                        ],
                        'ThreatDetectedByName' => [
                            'ItemCount' => <integer>,
                            'Shortened' => true || false,
                            'ThreatNames' => [
                                [
                                    'FilePaths' => [
                                        [
                                            'FileName' => '<string>',
                                            'FilePath' => '<string>',
                                            'Hash' => '<string>',
                                            'VolumeArn' => '<string>',
                                        ],
                                        // ...
                                    ],
                                    'ItemCount' => <integer>,
                                    'Name' => '<string>',
                                    'Severity' => '<string>',
                                ],
                                // ...
                            ],
                            'UniqueThreatNameCount' => <integer>,
                        ],
                        'ThreatsDetectedItemCount' => [
                            'Files' => <integer>,
                        ],
                    ],
                    'ScanId' => '<string>',
                    'ScanStartedAt' => <DateTime>,
                    'ScanType' => 'GUARDDUTY_INITIATED|ON_DEMAND',
                    'Sources' => ['<string>', ...],
                    'TriggerFindingId' => '<string>',
                ],
                'EventFirstSeen' => '<string>',
                'EventLastSeen' => '<string>',
                'Evidence' => [
                    'ThreatIntelligenceDetails' => [
                        [
                            'ThreatFileSha256' => '<string>',
                            'ThreatListName' => '<string>',
                            'ThreatNames' => ['<string>', ...],
                        ],
                        // ...
                    ],
                ],
                'FeatureName' => '<string>',
                'MalwareScanDetails' => [
                    'Threats' => [
                        [
                            'ItemPaths' => [
                                [
                                    'Hash' => '<string>',
                                    'NestedItemPath' => '<string>',
                                ],
                                // ...
                            ],
                            'Name' => '<string>',
                            'Source' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'ResourceRole' => '<string>',
                'RuntimeDetails' => [
                    'Context' => [
                        'AddressFamily' => '<string>',
                        'CommandLineExample' => '<string>',
                        'FileSystemType' => '<string>',
                        'Flags' => ['<string>', ...],
                        'IanaProtocolNumber' => <integer>,
                        'LdPreloadValue' => '<string>',
                        'LibraryPath' => '<string>',
                        'MemoryRegions' => ['<string>', ...],
                        'ModifiedAt' => <DateTime>,
                        'ModifyingProcess' => [
                            'Euid' => <integer>,
                            'ExecutablePath' => '<string>',
                            'ExecutableSha256' => '<string>',
                            'Lineage' => [
                                [
                                    'Euid' => <integer>,
                                    'ExecutablePath' => '<string>',
                                    'Name' => '<string>',
                                    'NamespacePid' => <integer>,
                                    'ParentUuid' => '<string>',
                                    'Pid' => <integer>,
                                    'StartTime' => <DateTime>,
                                    'UserId' => <integer>,
                                    'Uuid' => '<string>',
                                ],
                                // ...
                            ],
                            'Name' => '<string>',
                            'NamespacePid' => <integer>,
                            'ParentUuid' => '<string>',
                            'Pid' => <integer>,
                            'Pwd' => '<string>',
                            'StartTime' => <DateTime>,
                            'User' => '<string>',
                            'UserId' => <integer>,
                            'Uuid' => '<string>',
                        ],
                        'ModuleFilePath' => '<string>',
                        'ModuleName' => '<string>',
                        'ModuleSha256' => '<string>',
                        'MountSource' => '<string>',
                        'MountTarget' => '<string>',
                        'ReleaseAgentPath' => '<string>',
                        'RuncBinaryPath' => '<string>',
                        'ScriptPath' => '<string>',
                        'ServiceName' => '<string>',
                        'ShellHistoryFilePath' => '<string>',
                        'SocketPath' => '<string>',
                        'TargetProcess' => [
                            'Euid' => <integer>,
                            'ExecutablePath' => '<string>',
                            'ExecutableSha256' => '<string>',
                            'Lineage' => [
                                [
                                    'Euid' => <integer>,
                                    'ExecutablePath' => '<string>',
                                    'Name' => '<string>',
                                    'NamespacePid' => <integer>,
                                    'ParentUuid' => '<string>',
                                    'Pid' => <integer>,
                                    'StartTime' => <DateTime>,
                                    'UserId' => <integer>,
                                    'Uuid' => '<string>',
                                ],
                                // ...
                            ],
                            'Name' => '<string>',
                            'NamespacePid' => <integer>,
                            'ParentUuid' => '<string>',
                            'Pid' => <integer>,
                            'Pwd' => '<string>',
                            'StartTime' => <DateTime>,
                            'User' => '<string>',
                            'UserId' => <integer>,
                            'Uuid' => '<string>',
                        ],
                        'ThreatFilePath' => '<string>',
                        'ToolCategory' => '<string>',
                        'ToolName' => '<string>',
                    ],
                    'Process' => [
                        'Euid' => <integer>,
                        'ExecutablePath' => '<string>',
                        'ExecutableSha256' => '<string>',
                        'Lineage' => [
                            [
                                'Euid' => <integer>,
                                'ExecutablePath' => '<string>',
                                'Name' => '<string>',
                                'NamespacePid' => <integer>,
                                'ParentUuid' => '<string>',
                                'Pid' => <integer>,
                                'StartTime' => <DateTime>,
                                'UserId' => <integer>,
                                'Uuid' => '<string>',
                            ],
                            // ...
                        ],
                        'Name' => '<string>',
                        'NamespacePid' => <integer>,
                        'ParentUuid' => '<string>',
                        'Pid' => <integer>,
                        'Pwd' => '<string>',
                        'StartTime' => <DateTime>,
                        'User' => '<string>',
                        'UserId' => <integer>,
                        'Uuid' => '<string>',
                    ],
                ],
                'ServiceName' => '<string>',
                'UserFeedback' => '<string>',
            ],
            'Severity' => <float>,
            'Title' => '<string>',
            'Type' => '<string>',
            'UpdatedAt' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetFindingsStatistics

$result = $client->getFindingsStatistics([/* ... */]);
$promise = $client->getFindingsStatisticsAsync([/* ... */]);

Lists GuardDuty findings statistics for the specified detector ID.

You must provide either findingStatisticTypes or groupBy parameter, and not both. You can use the maxResults and orderBy parameters only when using groupBy.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->getFindingsStatistics([
    'DetectorId' => '<string>', // REQUIRED
    'FindingCriteria' => [
        'Criterion' => [
            '<String>' => [
                'Eq' => ['<string>', ...],
                'Equals' => ['<string>', ...],
                'GreaterThan' => <integer>,
                'GreaterThanOrEqual' => <integer>,
                'Gt' => <integer>,
                'Gte' => <integer>,
                'LessThan' => <integer>,
                'LessThanOrEqual' => <integer>,
                'Lt' => <integer>,
                'Lte' => <integer>,
                'Neq' => ['<string>', ...],
                'NotEquals' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'FindingStatisticTypes' => ['<string>', ...],
    'GroupBy' => 'ACCOUNT|DATE|FINDING_TYPE|RESOURCE|SEVERITY',
    'MaxResults' => <integer>,
    'OrderBy' => 'ASC|DESC',
]);

Parameter Details

Result Syntax

[
    'FindingStatistics' => [
        'CountBySeverity' => [<integer>, ...],
        'GroupedByAccount' => [
            [
                'AccountId' => '<string>',
                'LastGeneratedAt' => <DateTime>,
                'TotalFindings' => <integer>,
            ],
            // ...
        ],
        'GroupedByDate' => [
            [
                'Date' => <DateTime>,
                'LastGeneratedAt' => <DateTime>,
                'Severity' => <float>,
                'TotalFindings' => <integer>,
            ],
            // ...
        ],
        'GroupedByFindingType' => [
            [
                'FindingType' => '<string>',
                'LastGeneratedAt' => <DateTime>,
                'TotalFindings' => <integer>,
            ],
            // ...
        ],
        'GroupedByResource' => [
            [
                'AccountId' => '<string>',
                'LastGeneratedAt' => <DateTime>,
                'ResourceId' => '<string>',
                'ResourceType' => '<string>',
                'TotalFindings' => <integer>,
            ],
            // ...
        ],
        'GroupedBySeverity' => [
            [
                'LastGeneratedAt' => <DateTime>,
                'Severity' => <float>,
                'TotalFindings' => <integer>,
            ],
            // ...
        ],
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetIPSet

$result = $client->getIPSet([/* ... */]);
$promise = $client->getIPSetAsync([/* ... */]);

Retrieves the IPSet specified by the ipSetId.

Parameter Syntax

$result = $client->getIPSet([
    'DetectorId' => '<string>', // REQUIRED
    'IpSetId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Format' => 'TXT|STIX|OTX_CSV|ALIEN_VAULT|PROOF_POINT|FIRE_EYE',
    'Location' => '<string>',
    'Name' => '<string>',
    'Status' => 'INACTIVE|ACTIVATING|ACTIVE|DEACTIVATING|ERROR|DELETE_PENDING|DELETED',
    'Tags' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetInvitationsCount

$result = $client->getInvitationsCount([/* ... */]);
$promise = $client->getInvitationsCountAsync([/* ... */]);

Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.

Parameter Syntax

$result = $client->getInvitationsCount([
]);

Parameter Details

Result Syntax

[
    'InvitationsCount' => <integer>,
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetMalwareProtectionPlan

$result = $client->getMalwareProtectionPlan([/* ... */]);
$promise = $client->getMalwareProtectionPlanAsync([/* ... */]);

Retrieves the Malware Protection plan details associated with a Malware Protection plan ID.

Parameter Syntax

$result = $client->getMalwareProtectionPlan([
    'MalwareProtectionPlanId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Actions' => [
        'Tagging' => [
            'Status' => 'ENABLED|DISABLED',
        ],
    ],
    'Arn' => '<string>',
    'CreatedAt' => <DateTime>,
    'ProtectedResource' => [
        'S3Bucket' => [
            'BucketName' => '<string>',
            'ObjectPrefixes' => ['<string>', ...],
        ],
    ],
    'Role' => '<string>',
    'Status' => 'ACTIVE|WARNING|ERROR',
    'StatusReasons' => [
        [
            'Code' => '<string>',
            'Message' => '<string>',
        ],
        // ...
    ],
    'Tags' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

ResourceNotFoundException:

The requested resource can't be found.

GetMalwareScanSettings

$result = $client->getMalwareScanSettings([/* ... */]);
$promise = $client->getMalwareScanSettingsAsync([/* ... */]);

Returns the details of the malware scan settings.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->getMalwareScanSettings([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'EbsSnapshotPreservation' => 'NO_RETENTION|RETENTION_WITH_FINDING',
    'ScanResourceCriteria' => [
        'Exclude' => [
            '<ScanCriterionKey>' => [
                'MapEquals' => [
                    [
                        'Key' => '<string>',
                        'Value' => '<string>',
                    ],
                    // ...
                ],
            ],
            // ...
        ],
        'Include' => [
            '<ScanCriterionKey>' => [
                'MapEquals' => [
                    [
                        'Key' => '<string>',
                        'Value' => '<string>',
                    ],
                    // ...
                ],
            ],
            // ...
        ],
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetMasterAccount

$result = $client->getMasterAccount([/* ... */]);
$promise = $client->getMasterAccountAsync([/* ... */]);

Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.

Parameter Syntax

$result = $client->getMasterAccount([
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Master' => [
        'AccountId' => '<string>',
        'InvitationId' => '<string>',
        'InvitedAt' => '<string>',
        'RelationshipStatus' => '<string>',
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetMemberDetectors

$result = $client->getMemberDetectors([/* ... */]);
$promise = $client->getMemberDetectorsAsync([/* ... */]);

Describes which data sources are enabled for the member account's detector.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->getMemberDetectors([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'MemberDataSourceConfigurations' => [
        [
            'AccountId' => '<string>',
            'DataSources' => [
                'CloudTrail' => [
                    'Status' => 'ENABLED|DISABLED',
                ],
                'DNSLogs' => [
                    'Status' => 'ENABLED|DISABLED',
                ],
                'FlowLogs' => [
                    'Status' => 'ENABLED|DISABLED',
                ],
                'Kubernetes' => [
                    'AuditLogs' => [
                        'Status' => 'ENABLED|DISABLED',
                    ],
                ],
                'MalwareProtection' => [
                    'ScanEc2InstanceWithFindings' => [
                        'EbsVolumes' => [
                            'Reason' => '<string>',
                            'Status' => 'ENABLED|DISABLED',
                        ],
                    ],
                    'ServiceRole' => '<string>',
                ],
                'S3Logs' => [
                    'Status' => 'ENABLED|DISABLED',
                ],
            ],
            'Features' => [
                [
                    'AdditionalConfiguration' => [
                        [
                            'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                            'Status' => 'ENABLED|DISABLED',
                            'UpdatedAt' => <DateTime>,
                        ],
                        // ...
                    ],
                    'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
                    'Status' => 'ENABLED|DISABLED',
                    'UpdatedAt' => <DateTime>,
                ],
                // ...
            ],
        ],
        // ...
    ],
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetMembers

$result = $client->getMembers([/* ... */]);
$promise = $client->getMembersAsync([/* ... */]);

Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.

Parameter Syntax

$result = $client->getMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Members' => [
        [
            'AccountId' => '<string>',
            'AdministratorId' => '<string>',
            'DetectorId' => '<string>',
            'Email' => '<string>',
            'InvitedAt' => '<string>',
            'MasterId' => '<string>',
            'RelationshipStatus' => '<string>',
            'UpdatedAt' => '<string>',
        ],
        // ...
    ],
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetOrganizationStatistics

$result = $client->getOrganizationStatistics([/* ... */]);
$promise = $client->getOrganizationStatisticsAsync([/* ... */]);

Retrieves how many active member accounts have each feature enabled within GuardDuty. Only a delegated GuardDuty administrator of an organization can run this API.

When you create a new organization, it might take up to 24 hours to generate the statistics for the entire organization.

Parameter Syntax

$result = $client->getOrganizationStatistics([
]);

Parameter Details

Result Syntax

[
    'OrganizationDetails' => [
        'OrganizationStatistics' => [
            'ActiveAccountsCount' => <integer>,
            'CountByFeature' => [
                [
                    'AdditionalConfiguration' => [
                        [
                            'EnabledAccountsCount' => <integer>,
                            'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                        ],
                        // ...
                    ],
                    'EnabledAccountsCount' => <integer>,
                    'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
                ],
                // ...
            ],
            'EnabledAccountsCount' => <integer>,
            'MemberAccountsCount' => <integer>,
            'TotalAccountsCount' => <integer>,
        ],
        'UpdatedAt' => <DateTime>,
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetRemainingFreeTrialDays

$result = $client->getRemainingFreeTrialDays([/* ... */]);
$promise = $client->getRemainingFreeTrialDaysAsync([/* ... */]);

Provides the number of days left for each data source used in the free trial period.

Parameter Syntax

$result = $client->getRemainingFreeTrialDays([
    'AccountIds' => ['<string>', ...],
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Accounts' => [
        [
            'AccountId' => '<string>',
            'DataSources' => [
                'CloudTrail' => [
                    'FreeTrialDaysRemaining' => <integer>,
                ],
                'DnsLogs' => [
                    'FreeTrialDaysRemaining' => <integer>,
                ],
                'FlowLogs' => [
                    'FreeTrialDaysRemaining' => <integer>,
                ],
                'Kubernetes' => [
                    'AuditLogs' => [
                        'FreeTrialDaysRemaining' => <integer>,
                    ],
                ],
                'MalwareProtection' => [
                    'ScanEc2InstanceWithFindings' => [
                        'FreeTrialDaysRemaining' => <integer>,
                    ],
                ],
                'S3Logs' => [
                    'FreeTrialDaysRemaining' => <integer>,
                ],
            ],
            'Features' => [
                [
                    'FreeTrialDaysRemaining' => <integer>,
                    'Name' => 'FLOW_LOGS|CLOUD_TRAIL|DNS_LOGS|S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|FARGATE_RUNTIME_MONITORING|EC2_RUNTIME_MONITORING',
                ],
                // ...
            ],
        ],
        // ...
    ],
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetThreatIntelSet

$result = $client->getThreatIntelSet([/* ... */]);
$promise = $client->getThreatIntelSetAsync([/* ... */]);

Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.

Parameter Syntax

$result = $client->getThreatIntelSet([
    'DetectorId' => '<string>', // REQUIRED
    'ThreatIntelSetId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Format' => 'TXT|STIX|OTX_CSV|ALIEN_VAULT|PROOF_POINT|FIRE_EYE',
    'Location' => '<string>',
    'Name' => '<string>',
    'Status' => 'INACTIVE|ACTIVATING|ACTIVE|DEACTIVATING|ERROR|DELETE_PENDING|DELETED',
    'Tags' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

GetUsageStatistics

$result = $client->getUsageStatistics([/* ... */]);
$promise = $client->getUsageStatisticsAsync([/* ... */]);

Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.

Parameter Syntax

$result = $client->getUsageStatistics([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'Unit' => '<string>',
    'UsageCriteria' => [ // REQUIRED
        'AccountIds' => ['<string>', ...],
        'DataSources' => ['<string>', ...],
        'Features' => ['<string>', ...],
        'Resources' => ['<string>', ...],
    ],
    'UsageStatisticType' => 'SUM_BY_ACCOUNT|SUM_BY_DATA_SOURCE|SUM_BY_RESOURCE|TOP_RESOURCES|SUM_BY_FEATURES|TOP_ACCOUNTS_BY_FEATURE', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'NextToken' => '<string>',
    'UsageStatistics' => [
        'SumByAccount' => [
            [
                'AccountId' => '<string>',
                'Total' => [
                    'Amount' => '<string>',
                    'Unit' => '<string>',
                ],
            ],
            // ...
        ],
        'SumByDataSource' => [
            [
                'DataSource' => 'FLOW_LOGS|CLOUD_TRAIL|DNS_LOGS|S3_LOGS|KUBERNETES_AUDIT_LOGS|EC2_MALWARE_SCAN',
                'Total' => [
                    'Amount' => '<string>',
                    'Unit' => '<string>',
                ],
            ],
            // ...
        ],
        'SumByFeature' => [
            [
                'Feature' => 'FLOW_LOGS|CLOUD_TRAIL|DNS_LOGS|S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|LAMBDA_NETWORK_LOGS|EKS_RUNTIME_MONITORING|FARGATE_RUNTIME_MONITORING|EC2_RUNTIME_MONITORING|RDS_DBI_PROTECTION_PROVISIONED|RDS_DBI_PROTECTION_SERVERLESS',
                'Total' => [
                    'Amount' => '<string>',
                    'Unit' => '<string>',
                ],
            ],
            // ...
        ],
        'SumByResource' => [
            [
                'Resource' => '<string>',
                'Total' => [
                    'Amount' => '<string>',
                    'Unit' => '<string>',
                ],
            ],
            // ...
        ],
        'TopAccountsByFeature' => [
            [
                'Accounts' => [
                    [
                        'AccountId' => '<string>',
                        'Total' => [
                            'Amount' => '<string>',
                            'Unit' => '<string>',
                        ],
                    ],
                    // ...
                ],
                'Feature' => 'FLOW_LOGS|CLOUD_TRAIL|DNS_LOGS|S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|LAMBDA_NETWORK_LOGS|EKS_RUNTIME_MONITORING|FARGATE_RUNTIME_MONITORING|EC2_RUNTIME_MONITORING|RDS_DBI_PROTECTION_PROVISIONED|RDS_DBI_PROTECTION_SERVERLESS',
            ],
            // ...
        ],
        'TopResources' => [
            [
                'Resource' => '<string>',
                'Total' => [
                    'Amount' => '<string>',
                    'Unit' => '<string>',
                ],
            ],
            // ...
        ],
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

InviteMembers

$result = $client->inviteMembers([/* ... */]);
$promise = $client->inviteMembersAsync([/* ... */]);

Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations.

To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation.

After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers.

If you disassociate a member account that was added by invitation, the member account details obtained from this API, including the associated email addresses, will be retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.

When the member accounts added through Organizations are later disassociated, you (administrator) can't invite them by calling the InviteMembers API. You can create an association with these member accounts again only by calling the CreateMembers API.

Parameter Syntax

$result = $client->inviteMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
    'DisableEmailNotification' => true || false,
    'Message' => '<string>',
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListCoverage

$result = $client->listCoverage([/* ... */]);
$promise = $client->listCoverageAsync([/* ... */]);

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization.

Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.

Parameter Syntax

$result = $client->listCoverage([
    'DetectorId' => '<string>', // REQUIRED
    'FilterCriteria' => [
        'FilterCriterion' => [
            [
                'CriterionKey' => 'ACCOUNT_ID|CLUSTER_NAME|RESOURCE_TYPE|COVERAGE_STATUS|ADDON_VERSION|MANAGEMENT_TYPE|EKS_CLUSTER_NAME|ECS_CLUSTER_NAME|AGENT_VERSION|INSTANCE_ID|CLUSTER_ARN',
                'FilterCondition' => [
                    'Equals' => ['<string>', ...],
                    'NotEquals' => ['<string>', ...],
                ],
            ],
            // ...
        ],
    ],
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'SortCriteria' => [
        'AttributeName' => 'ACCOUNT_ID|CLUSTER_NAME|COVERAGE_STATUS|ISSUE|ADDON_VERSION|UPDATED_AT|EKS_CLUSTER_NAME|ECS_CLUSTER_NAME|INSTANCE_ID',
        'OrderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'NextToken' => '<string>',
    'Resources' => [
        [
            'AccountId' => '<string>',
            'CoverageStatus' => 'HEALTHY|UNHEALTHY',
            'DetectorId' => '<string>',
            'Issue' => '<string>',
            'ResourceDetails' => [
                'Ec2InstanceDetails' => [
                    'AgentDetails' => [
                        'Version' => '<string>',
                    ],
                    'ClusterArn' => '<string>',
                    'InstanceId' => '<string>',
                    'InstanceType' => '<string>',
                    'ManagementType' => 'AUTO_MANAGED|MANUAL|DISABLED',
                ],
                'EcsClusterDetails' => [
                    'ClusterName' => '<string>',
                    'ContainerInstanceDetails' => [
                        'CompatibleContainerInstances' => <integer>,
                        'CoveredContainerInstances' => <integer>,
                    ],
                    'FargateDetails' => [
                        'Issues' => ['<string>', ...],
                        'ManagementType' => 'AUTO_MANAGED|MANUAL|DISABLED',
                    ],
                ],
                'EksClusterDetails' => [
                    'AddonDetails' => [
                        'AddonStatus' => '<string>',
                        'AddonVersion' => '<string>',
                    ],
                    'ClusterName' => '<string>',
                    'CompatibleNodes' => <integer>,
                    'CoveredNodes' => <integer>,
                    'ManagementType' => 'AUTO_MANAGED|MANUAL|DISABLED',
                ],
                'ResourceType' => 'EKS|ECS|EC2',
            ],
            'ResourceId' => '<string>',
            'UpdatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListDetectors

$result = $client->listDetectors([/* ... */]);
$promise = $client->listDetectorsAsync([/* ... */]);

Lists detectorIds of all the existing Amazon GuardDuty detector resources.

Parameter Syntax

$result = $client->listDetectors([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'DetectorIds' => ['<string>', ...],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListFilters

$result = $client->listFilters([/* ... */]);
$promise = $client->listFiltersAsync([/* ... */]);

Returns a paginated list of the current filters.

Parameter Syntax

$result = $client->listFilters([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'FilterNames' => ['<string>', ...],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListFindings

$result = $client->listFindings([/* ... */]);
$promise = $client->listFindingsAsync([/* ... */]);

Lists GuardDuty findings for the specified detector ID.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->listFindings([
    'DetectorId' => '<string>', // REQUIRED
    'FindingCriteria' => [
        'Criterion' => [
            '<String>' => [
                'Eq' => ['<string>', ...],
                'Equals' => ['<string>', ...],
                'GreaterThan' => <integer>,
                'GreaterThanOrEqual' => <integer>,
                'Gt' => <integer>,
                'Gte' => <integer>,
                'LessThan' => <integer>,
                'LessThanOrEqual' => <integer>,
                'Lt' => <integer>,
                'Lte' => <integer>,
                'Neq' => ['<string>', ...],
                'NotEquals' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'SortCriteria' => [
        'AttributeName' => '<string>',
        'OrderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'FindingIds' => ['<string>', ...],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListIPSets

$result = $client->listIPSets([/* ... */]);
$promise = $client->listIPSetsAsync([/* ... */]);

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

Parameter Syntax

$result = $client->listIPSets([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'IpSetIds' => ['<string>', ...],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListInvitations

$result = $client->listInvitations([/* ... */]);
$promise = $client->listInvitationsAsync([/* ... */]);

Lists all GuardDuty membership invitations that were sent to the current Amazon Web Services account.

Parameter Syntax

$result = $client->listInvitations([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'Invitations' => [
        [
            'AccountId' => '<string>',
            'InvitationId' => '<string>',
            'InvitedAt' => '<string>',
            'RelationshipStatus' => '<string>',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListMalwareProtectionPlans

$result = $client->listMalwareProtectionPlans([/* ... */]);
$promise = $client->listMalwareProtectionPlansAsync([/* ... */]);

Lists the Malware Protection plan IDs associated with the protected resources in your Amazon Web Services account.

Parameter Syntax

$result = $client->listMalwareProtectionPlans([
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'MalwareProtectionPlans' => [
        [
            'MalwareProtectionPlanId' => '<string>',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

ListMembers

$result = $client->listMembers([/* ... */]);
$promise = $client->listMembersAsync([/* ... */]);

Lists details about all member accounts for the current GuardDuty administrator account.

Parameter Syntax

$result = $client->listMembers([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'OnlyAssociated' => '<string>',
]);

Parameter Details

Result Syntax

[
    'Members' => [
        [
            'AccountId' => '<string>',
            'AdministratorId' => '<string>',
            'DetectorId' => '<string>',
            'Email' => '<string>',
            'InvitedAt' => '<string>',
            'MasterId' => '<string>',
            'RelationshipStatus' => '<string>',
            'UpdatedAt' => '<string>',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListOrganizationAdminAccounts

$result = $client->listOrganizationAdminAccounts([/* ... */]);
$promise = $client->listOrganizationAdminAccountsAsync([/* ... */]);

Lists the accounts designated as GuardDuty delegated administrators. Only the organization's management account can run this API operation.

Parameter Syntax

$result = $client->listOrganizationAdminAccounts([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'AdminAccounts' => [
        [
            'AdminAccountId' => '<string>',
            'AdminStatus' => 'ENABLED|DISABLE_IN_PROGRESS',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListPublishingDestinations

$result = $client->listPublishingDestinations([/* ... */]);
$promise = $client->listPublishingDestinationsAsync([/* ... */]);

Returns a list of publishing destinations associated with the specified detectorId.

Parameter Syntax

$result = $client->listPublishingDestinations([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'Destinations' => [
        [
            'DestinationId' => '<string>',
            'DestinationType' => 'S3',
            'Status' => 'PENDING_VERIFICATION|PUBLISHING|UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY|STOPPED',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, threat intel sets, and publishing destination, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'ResourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Tags' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

ListThreatIntelSets

$result = $client->listThreatIntelSets([/* ... */]);
$promise = $client->listThreatIntelSetsAsync([/* ... */]);

Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Parameter Syntax

$result = $client->listThreatIntelSets([
    'DetectorId' => '<string>', // REQUIRED
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'NextToken' => '<string>',
    'ThreatIntelSetIds' => ['<string>', ...],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

StartMalwareScan

$result = $client->startMalwareScan([/* ... */]);
$promise = $client->startMalwareScanAsync([/* ... */]);

Initiates the malware scan. Invoking this API will automatically create the Service-linked role in the corresponding account.

When the malware scan starts, you can use the associated scan ID to track the status of the scan. For more information, see DescribeMalwareScans.

Parameter Syntax

$result = $client->startMalwareScan([
    'ResourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'ScanId' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

ConflictException:

A request conflict exception object.

InternalServerErrorException:

An internal server error exception object.

StartMonitoringMembers

$result = $client->startMonitoringMembers([/* ... */]);
$promise = $client->startMonitoringMembersAsync([/* ... */]);

Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.

Parameter Syntax

$result = $client->startMonitoringMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

StopMonitoringMembers

$result = $client->stopMonitoringMembers([/* ... */]);
$promise = $client->stopMonitoringMembersAsync([/* ... */]);

Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts.

With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.

Parameter Syntax

$result = $client->stopMonitoringMembers([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds tags to a resource.

Parameter Syntax

$result = $client->tagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'Tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

UnarchiveFindings

$result = $client->unarchiveFindings([/* ... */]);
$promise = $client->unarchiveFindingsAsync([/* ... */]);

Unarchives GuardDuty findings specified by the findingIds.

Parameter Syntax

$result = $client->unarchiveFindings([
    'DetectorId' => '<string>', // REQUIRED
    'FindingIds' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes tags from a resource.

Parameter Syntax

$result = $client->untagResource([
    'ResourceArn' => '<string>', // REQUIRED
    'TagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateDetector

$result = $client->updateDetector([/* ... */]);
$promise = $client->updateDetectorAsync([/* ... */]);

Updates the GuardDuty detector specified by the detector ID.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->updateDetector([
    'DataSources' => [
        'Kubernetes' => [
            'AuditLogs' => [ // REQUIRED
                'Enable' => true || false, // REQUIRED
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => true || false,
            ],
        ],
        'S3Logs' => [
            'Enable' => true || false, // REQUIRED
        ],
    ],
    'DetectorId' => '<string>', // REQUIRED
    'Enable' => true || false,
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                    'Status' => 'ENABLED|DISABLED',
                ],
                // ...
            ],
            'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
            'Status' => 'ENABLED|DISABLED',
        ],
        // ...
    ],
    'FindingPublishingFrequency' => 'FIFTEEN_MINUTES|ONE_HOUR|SIX_HOURS',
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateFilter

$result = $client->updateFilter([/* ... */]);
$promise = $client->updateFilterAsync([/* ... */]);

Updates the filter specified by the filter name.

Parameter Syntax

$result = $client->updateFilter([
    'Action' => 'NOOP|ARCHIVE',
    'Description' => '<string>',
    'DetectorId' => '<string>', // REQUIRED
    'FilterName' => '<string>', // REQUIRED
    'FindingCriteria' => [
        'Criterion' => [
            '<String>' => [
                'Eq' => ['<string>', ...],
                'Equals' => ['<string>', ...],
                'GreaterThan' => <integer>,
                'GreaterThanOrEqual' => <integer>,
                'Gt' => <integer>,
                'Gte' => <integer>,
                'LessThan' => <integer>,
                'LessThanOrEqual' => <integer>,
                'Lt' => <integer>,
                'Lte' => <integer>,
                'Neq' => ['<string>', ...],
                'NotEquals' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'Rank' => <integer>,
]);

Parameter Details

Result Syntax

[
    'Name' => '<string>',
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateFindingsFeedback

$result = $client->updateFindingsFeedback([/* ... */]);
$promise = $client->updateFindingsFeedbackAsync([/* ... */]);

Marks the specified GuardDuty findings as useful or not useful.

Parameter Syntax

$result = $client->updateFindingsFeedback([
    'Comments' => '<string>',
    'DetectorId' => '<string>', // REQUIRED
    'Feedback' => 'USEFUL|NOT_USEFUL', // REQUIRED
    'FindingIds' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateIPSet

$result = $client->updateIPSet([/* ... */]);
$promise = $client->updateIPSetAsync([/* ... */]);

Updates the IPSet specified by the IPSet ID.

Parameter Syntax

$result = $client->updateIPSet([
    'Activate' => true || false,
    'DetectorId' => '<string>', // REQUIRED
    'IpSetId' => '<string>', // REQUIRED
    'Location' => '<string>',
    'Name' => '<string>',
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateMalwareProtectionPlan

$result = $client->updateMalwareProtectionPlan([/* ... */]);
$promise = $client->updateMalwareProtectionPlanAsync([/* ... */]);

Updates an existing Malware Protection plan resource.

Parameter Syntax

$result = $client->updateMalwareProtectionPlan([
    'Actions' => [
        'Tagging' => [
            'Status' => 'ENABLED|DISABLED',
        ],
    ],
    'MalwareProtectionPlanId' => '<string>', // REQUIRED
    'ProtectedResource' => [
        'S3Bucket' => [
            'ObjectPrefixes' => ['<string>', ...],
        ],
    ],
    'Role' => '<string>',
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

AccessDeniedException:

An access denied exception object.

ResourceNotFoundException:

The requested resource can't be found.

InternalServerErrorException:

An internal server error exception object.

UpdateMalwareScanSettings

$result = $client->updateMalwareScanSettings([/* ... */]);
$promise = $client->updateMalwareScanSettingsAsync([/* ... */]);

Updates the malware scan settings.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->updateMalwareScanSettings([
    'DetectorId' => '<string>', // REQUIRED
    'EbsSnapshotPreservation' => 'NO_RETENTION|RETENTION_WITH_FINDING',
    'ScanResourceCriteria' => [
        'Exclude' => [
            '<ScanCriterionKey>' => [
                'MapEquals' => [ // REQUIRED
                    [
                        'Key' => '<string>', // REQUIRED
                        'Value' => '<string>',
                    ],
                    // ...
                ],
            ],
            // ...
        ],
        'Include' => [
            '<ScanCriterionKey>' => [
                'MapEquals' => [ // REQUIRED
                    [
                        'Key' => '<string>', // REQUIRED
                        'Value' => '<string>',
                    ],
                    // ...
                ],
            ],
            // ...
        ],
    ],
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateMemberDetectors

$result = $client->updateMemberDetectors([/* ... */]);
$promise = $client->updateMemberDetectorsAsync([/* ... */]);

Contains information on member accounts to be updated.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->updateMemberDetectors([
    'AccountIds' => ['<string>', ...], // REQUIRED
    'DataSources' => [
        'Kubernetes' => [
            'AuditLogs' => [ // REQUIRED
                'Enable' => true || false, // REQUIRED
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => true || false,
            ],
        ],
        'S3Logs' => [
            'Enable' => true || false, // REQUIRED
        ],
    ],
    'DetectorId' => '<string>', // REQUIRED
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                    'Status' => 'ENABLED|DISABLED',
                ],
                // ...
            ],
            'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
            'Status' => 'ENABLED|DISABLED',
        ],
        // ...
    ],
]);

Parameter Details

Result Syntax

[
    'UnprocessedAccounts' => [
        [
            'AccountId' => '<string>',
            'Result' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateOrganizationConfiguration

$result = $client->updateOrganizationConfiguration([/* ... */]);
$promise = $client->updateOrganizationConfigurationAsync([/* ... */]);

Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Parameter Syntax

$result = $client->updateOrganizationConfiguration([
    'AutoEnable' => true || false,
    'AutoEnableOrganizationMembers' => 'NEW|ALL|NONE',
    'DataSources' => [
        'Kubernetes' => [
            'AuditLogs' => [ // REQUIRED
                'AutoEnable' => true || false, // REQUIRED
            ],
        ],
        'MalwareProtection' => [
            'ScanEc2InstanceWithFindings' => [
                'EbsVolumes' => [
                    'AutoEnable' => true || false,
                ],
            ],
        ],
        'S3Logs' => [
            'AutoEnable' => true || false, // REQUIRED
        ],
    ],
    'DetectorId' => '<string>', // REQUIRED
    'Features' => [
        [
            'AdditionalConfiguration' => [
                [
                    'AutoEnable' => 'NEW|NONE|ALL',
                    'Name' => 'EKS_ADDON_MANAGEMENT|ECS_FARGATE_AGENT_MANAGEMENT|EC2_AGENT_MANAGEMENT',
                ],
                // ...
            ],
            'AutoEnable' => 'NEW|NONE|ALL',
            'Name' => 'S3_DATA_EVENTS|EKS_AUDIT_LOGS|EBS_MALWARE_PROTECTION|RDS_LOGIN_EVENTS|EKS_RUNTIME_MONITORING|LAMBDA_NETWORK_LOGS|RUNTIME_MONITORING',
        ],
        // ...
    ],
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdatePublishingDestination

$result = $client->updatePublishingDestination([/* ... */]);
$promise = $client->updatePublishingDestinationAsync([/* ... */]);

Updates information about the publishing destination specified by the destinationId.

Parameter Syntax

$result = $client->updatePublishingDestination([
    'DestinationId' => '<string>', // REQUIRED
    'DestinationProperties' => [
        'DestinationArn' => '<string>',
        'KmsKeyArn' => '<string>',
    ],
    'DetectorId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.

UpdateThreatIntelSet

$result = $client->updateThreatIntelSet([/* ... */]);
$promise = $client->updateThreatIntelSetAsync([/* ... */]);

Updates the ThreatIntelSet specified by the ThreatIntelSet ID.

Parameter Syntax

$result = $client->updateThreatIntelSet([
    'Activate' => true || false,
    'DetectorId' => '<string>', // REQUIRED
    'Location' => '<string>',
    'Name' => '<string>',
    'ThreatIntelSetId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

BadRequestException:

A bad request exception object.

InternalServerErrorException:

An internal server error exception object.