Skip to content

Guardduty  >  Operations  >  list_findings

list_findings

Operation

list_findings async 

list_findings(input: ListFindingsInput, plugins: list[Plugin] | None = None) -> ListFindingsOutput

Lists GuardDuty findings for the specified detector ID.

There might be regional differences because some flags might not be available in all the Regions where GuardDuty is currently supported. For more information, see Regions and endpoints.

Parameters:

Name Type Description Default
input ListFindingsInput

An instance of ListFindingsInput.

 required
plugins list[Plugin] | None

A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations.

 None

Returns:

Type Description
ListFindingsOutput

An instance of ListFindingsOutput.

Input

ListFindingsInput dataclass

Dataclass for ListFindingsInput structure.

Attributes

detector_id class-attribute instance-attribute 
detector_id: str | None = None

The ID of the detector that specifies the GuardDuty service whose findings you want to list.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

finding_criteria class-attribute instance-attribute 
finding_criteria: FindingCriteria | None = None

Represents the criteria used for querying findings. Valid values include:

  • JSON field name

  • accountId

  • region

  • confidence

  • id

  • resource.accessKeyDetails.accessKeyId

  • resource.accessKeyDetails.principalId

  • resource.accessKeyDetails.userName

  • resource.accessKeyDetails.userType

  • resource.instanceDetails.iamInstanceProfile.id

  • resource.instanceDetails.imageId

  • resource.instanceDetails.instanceId

  • resource.instanceDetails.networkInterfaces.ipv6Addresses

  • resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress

  • resource.instanceDetails.networkInterfaces.publicDnsName

  • resource.instanceDetails.networkInterfaces.publicIp

  • resource.instanceDetails.networkInterfaces.securityGroups.groupId

  • resource.instanceDetails.networkInterfaces.securityGroups.groupName

  • resource.instanceDetails.networkInterfaces.subnetId

  • resource.instanceDetails.networkInterfaces.vpcId

  • resource.instanceDetails.tags.key

  • resource.instanceDetails.tags.value

  • resource.resourceType

  • service.action.actionType

  • service.action.awsApiCallAction.api

  • service.action.awsApiCallAction.callerType

  • service.action.awsApiCallAction.remoteIpDetails.city.cityName

  • service.action.awsApiCallAction.remoteIpDetails.country.countryName

  • service.action.awsApiCallAction.remoteIpDetails.ipAddressV4

  • service.action.awsApiCallAction.remoteIpDetails.organization.asn

  • service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg

  • service.action.awsApiCallAction.serviceName

  • service.action.dnsRequestAction.domain

  • service.action.dnsRequestAction.domainWithSuffix

  • service.action.networkConnectionAction.blocked

  • service.action.networkConnectionAction.connectionDirection

  • service.action.networkConnectionAction.localPortDetails.port

  • service.action.networkConnectionAction.protocol

  • service.action.networkConnectionAction.remoteIpDetails.country.countryName

  • service.action.networkConnectionAction.remoteIpDetails.ipAddressV4

  • service.action.networkConnectionAction.remoteIpDetails.organization.asn

  • service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg

  • service.action.networkConnectionAction.remotePortDetails.port

  • service.additionalInfo.threatListName

  • service.archived

When this attribute is set to 'true', only archived findings are listed. When it's set to 'false', only unarchived findings are listed. When this attribute is not set, all existing findings are listed.

  • service.ebsVolumeScanDetails.scanId

  • service.resourceRole

  • severity

  • type

  • updatedAt

Type: Timestamp in Unix Epoch millisecond format: 1486685375000

max_results class-attribute instance-attribute 
max_results: int | None = None

You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.

next_token class-attribute instance-attribute 
next_token: str | None = None

You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

sort_criteria class-attribute instance-attribute 
sort_criteria: SortCriteria | None = None

Represents the criteria used for sorting findings.

Output

ListFindingsOutput dataclass

Dataclass for ListFindingsOutput structure.

Attributes

finding_ids class-attribute instance-attribute 
finding_ids: list[str] | None = None

The IDs of the findings that you're listing.

next_token class-attribute instance-attribute 
next_token: str | None = None

The pagination parameter to be used on the next list operation to retrieve more items.