Guardduty  >  Operations  >  create_threat_intel_set

create_threat_intel_set

Operation

create_threat_intel_set async

create_threat_intel_set(input: CreateThreatIntelSetInput, plugins: list[Plugin] | None = None) -> CreateThreatIntelSetOutput

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Parameters:

Name	Type	Description	Default
input	CreateThreatIntelSetInput	An instance of CreateThreatIntelSetInput.	required
plugins	list[Plugin] | None	A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations.	None

Returns:

Type	Description
CreateThreatIntelSetOutput	An instance of CreateThreatIntelSetOutput.

Input

CreateThreatIntelSetInput dataclass

Dataclass for CreateThreatIntelSetInput structure.

Attributes

activate class-attribute instance-attribute

activate: bool | None = None

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

client_token class-attribute instance-attribute

client_token: str | None = None

The idempotency token for the create request.

detector_id class-attribute instance-attribute

detector_id: str | None = None

The unique ID of the detector of the GuardDuty account for which you want to create a threatIntelSet.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

expected_bucket_owner class-attribute instance-attribute

expected_bucket_owner: str | None = None

The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.

format class-attribute instance-attribute

format: ThreatIntelSetFormat | None = None

The format of the file that contains the ThreatIntelSet.

location class-attribute instance-attribute

location: str | None = None

The URI of the file that contains the ThreatIntelSet.

name class-attribute instance-attribute

name: str | None = None

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

tags class-attribute instance-attribute

tags: dict[str, str] | None = None

The tags to be added to a new threat list resource.

Output

CreateThreatIntelSetOutput dataclass

Dataclass for CreateThreatIntelSetOutput structure.

Attributes

threat_intel_set_id class-attribute instance-attribute

threat_intel_set_id: str | None = None

The ID of the ThreatIntelSet resource.