guardduty_update_filter: Updates the filter specified by the filter name

In paws.security.identity: 'Amazon Web Services' Security, Identity, & Compliance Services

Updates the filter specified by the filter name

Description

Updates the filter specified by the filter name.

See https://www.paws-r-sdk.com/docs/guardduty_update_filter/ for full documentation.

Usage

guardduty_update_filter(
  DetectorId,
  FilterName,
  Description = NULL,
  Action = NULL,
  Rank = NULL,
  FindingCriteria = NULL
)

Arguments

DetectorId	[required] The unique ID of the detector that specifies the GuardDuty service where you want to update a filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the list_detectors API.
FilterName	[required] The name of the filter.
Description	The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ({ }, ⁠[ ]⁠, and ⁠( )⁠), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace. [ ]: R:%20
Action	Specifies the action that is to be applied to the findings that match the filter. Default: NOOP
Rank	Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
FindingCriteria	Represents the criteria to be used in the filter for querying findings. The following fields are available for filtering: accountId arn associatedAttackSequenceArn confidence createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 description id partition region resource.accessKeyDetails.accessKeyId resource.accessKeyDetails.principalId resource.accessKeyDetails.userIdentity.accessKeyId resource.accessKeyDetails.userIdentity.accountId resource.accessKeyDetails.userIdentity.arn resource.accessKeyDetails.userIdentity.principalId resource.accessKeyDetails.userIdentity.sessionContext.attributes.mfaAuthenticated resource.accessKeyDetails.userIdentity.sessionContext.ec2RoleDelivery resource.accessKeyDetails.userIdentity.sessionContext.invokedBy resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.accountId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.arn resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.principalId resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.type resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.userName resource.accessKeyDetails.userIdentity.sessionContext.sourceIdentity resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.attributes resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.federatedProvider resource.accessKeyDetails.userIdentity.type resource.accessKeyDetails.userIdentity.userName resource.accessKeyDetails.userName resource.accessKeyDetails.userType resource.bedrockGuardrailDetails.guardrailArn resource.bedrockGuardrailDetails.guardrailVersion resource.containerDetails.containerRuntime resource.containerDetails.id resource.containerDetails.image resource.containerDetails.imagePrefix resource.containerDetails.name resource.containerDetails.securityContext.allowPrivilegeEscalation resource.containerDetails.securityContext.privileged resource.containerDetails.volumeMounts.mountPath resource.containerDetails.volumeMounts.name resource.ebsSnapshotDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.deviceName resource.ebsVolumeDetails.scannedVolumeDetails.encryptionType resource.ebsVolumeDetails.scannedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.scannedVolumeDetails.snapshotArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeArn resource.ebsVolumeDetails.scannedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.scannedVolumeDetails.volumeType resource.ebsVolumeDetails.skippedVolumeDetails.deviceName resource.ebsVolumeDetails.skippedVolumeDetails.encryptionType resource.ebsVolumeDetails.skippedVolumeDetails.kmsKeyArn resource.ebsVolumeDetails.skippedVolumeDetails.snapshotArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeArn resource.ebsVolumeDetails.skippedVolumeDetails.volumeSizeInGB resource.ebsVolumeDetails.skippedVolumeDetails.volumeType resource.ec2ImageDetails.imageArn resource.ecsClusterDetails.activeServicesCount resource.ecsClusterDetails.arn resource.ecsClusterDetails.name resource.ecsClusterDetails.registeredContainerInstancesCount resource.ecsClusterDetails.runningTasksCount resource.ecsClusterDetails.status resource.ecsClusterDetails.tags.key resource.ecsClusterDetails.tags.value resource.ecsClusterDetails.taskDetails.arn resource.ecsClusterDetails.taskDetails.containers.containerRuntime resource.ecsClusterDetails.taskDetails.containers.id resource.ecsClusterDetails.taskDetails.containers.image resource.ecsClusterDetails.taskDetails.containers.imagePrefix resource.ecsClusterDetails.taskDetails.containers.name resource.ecsClusterDetails.taskDetails.containers.securityContext.allowPrivilegeEscalation resource.ecsClusterDetails.taskDetails.containers.securityContext.privileged resource.ecsClusterDetails.taskDetails.containers.volumeMounts.mountPath resource.ecsClusterDetails.taskDetails.containers.volumeMounts.name resource.ecsClusterDetails.taskDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.definitionArn resource.ecsClusterDetails.taskDetails.group resource.ecsClusterDetails.taskDetails.launchType resource.ecsClusterDetails.taskDetails.startedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.ecsClusterDetails.taskDetails.startedBy resource.ecsClusterDetails.taskDetails.tags.key resource.ecsClusterDetails.taskDetails.tags.value resource.ecsClusterDetails.taskDetails.version resource.ecsClusterDetails.taskDetails.volumes.hostPath.path resource.ecsClusterDetails.taskDetails.volumes.name resource.eksClusterDetails.arn resource.eksClusterDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.eksClusterDetails.name resource.eksClusterDetails.status resource.eksClusterDetails.tags.key resource.eksClusterDetails.tags.value resource.eksClusterDetails.vpcId resource.instanceDetails.availabilityZone resource.instanceDetails.iamInstanceProfile.arn resource.instanceDetails.iamInstanceProfile.id resource.instanceDetails.imageDescription resource.instanceDetails.imageId resource.instanceDetails.instanceId resource.instanceDetails.instanceState resource.instanceDetails.instanceType resource.instanceDetails.launchTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.instanceDetails.networkInterfaces.ipv6Addresses resource.instanceDetails.networkInterfaces.networkInterfaceId resource.instanceDetails.networkInterfaces.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddress resource.instanceDetails.networkInterfaces.privateIpAddresses.privateDnsName resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress resource.instanceDetails.networkInterfaces.publicDnsName resource.instanceDetails.networkInterfaces.publicIp resource.instanceDetails.networkInterfaces.securityGroups.groupId resource.instanceDetails.networkInterfaces.securityGroups.groupName resource.instanceDetails.networkInterfaces.subnetId resource.instanceDetails.networkInterfaces.vpcId resource.instanceDetails.outpostArn resource.instanceDetails.platform resource.instanceDetails.productCodes.productCodeId resource.instanceDetails.productCodes.productCodeType resource.instanceDetails.tags.key resource.instanceDetails.tags.value resource.kubernetesDetails.kubernetesUserDetails.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.groups resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.username resource.kubernetesDetails.kubernetesUserDetails.sessionName resource.kubernetesDetails.kubernetesUserDetails.uid resource.kubernetesDetails.kubernetesUserDetails.username resource.kubernetesDetails.kubernetesWorkloadDetails.containers.containerRuntime resource.kubernetesDetails.kubernetesWorkloadDetails.containers.id resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix resource.kubernetesDetails.kubernetesWorkloadDetails.containers.name resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.allowPrivilegeEscalation resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.privileged resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.mountPath resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.name resource.kubernetesDetails.kubernetesWorkloadDetails.hostIpc resource.kubernetesDetails.kubernetesWorkloadDetails.hostNetwork resource.kubernetesDetails.kubernetesWorkloadDetails.hostPid resource.kubernetesDetails.kubernetesWorkloadDetails.name resource.kubernetesDetails.kubernetesWorkloadDetails.namespace resource.kubernetesDetails.kubernetesWorkloadDetails.serviceAccountName resource.kubernetesDetails.kubernetesWorkloadDetails.type resource.kubernetesDetails.kubernetesWorkloadDetails.uid resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.hostPath.path resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.name resource.lambdaDetails.description resource.lambdaDetails.functionArn resource.lambdaDetails.functionName resource.lambdaDetails.functionVersion resource.lambdaDetails.lastModifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.lambdaDetails.revisionId resource.lambdaDetails.role resource.lambdaDetails.tags.key resource.lambdaDetails.tags.value resource.lambdaDetails.vpcConfig.securityGroups.groupId resource.lambdaDetails.vpcConfig.securityGroups.groupName resource.lambdaDetails.vpcConfig.subnetIds resource.lambdaDetails.vpcConfig.vpcId resource.rdsDbInstanceDetails.dbClusterIdentifier resource.rdsDbInstanceDetails.dbInstanceArn resource.rdsDbInstanceDetails.dbInstanceIdentifier resource.rdsDbInstanceDetails.dbSecurityGroups.name resource.rdsDbInstanceDetails.dbSecurityGroups.status resource.rdsDbInstanceDetails.dbiResourceId resource.rdsDbInstanceDetails.engine resource.rdsDbInstanceDetails.engineVersion resource.rdsDbInstanceDetails.iamDatabaseAuthenticationEnabled resource.rdsDbInstanceDetails.publiclyAccessible resource.rdsDbInstanceDetails.tags.key resource.rdsDbInstanceDetails.tags.value resource.rdsDbInstanceDetails.vpcId resource.rdsDbInstanceDetails.vpcSecurityGroups.status resource.rdsDbInstanceDetails.vpcSecurityGroups.vpcSecurityGroupId resource.rdsDbUserDetails.application resource.rdsDbUserDetails.authMethod resource.rdsDbUserDetails.database resource.rdsDbUserDetails.ssl resource.rdsDbUserDetails.user resource.rdsLimitlessDbDetails.dbClusterIdentifier resource.rdsLimitlessDbDetails.dbShardGroupArn resource.rdsLimitlessDbDetails.dbShardGroupIdentifier resource.rdsLimitlessDbDetails.dbShardGroupResourceId resource.rdsLimitlessDbDetails.engine resource.rdsLimitlessDbDetails.engineVersion resource.rdsLimitlessDbDetails.tags.key resource.rdsLimitlessDbDetails.tags.value resource.recoveryPointDetails.backupVaultName resource.recoveryPointDetails.recoveryPointArn resource.resourceType resource.s3BucketDetails.arn resource.s3BucketDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 resource.s3BucketDetails.defaultServerSideEncryption.encryptionType resource.s3BucketDetails.defaultServerSideEncryption.kmsMasterKeyArn resource.s3BucketDetails.name resource.s3BucketDetails.owner.id resource.s3BucketDetails.publicAccess.effectivePermission resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.accountLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.accessControlList.allowsPublicWriteAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.blockPublicPolicy resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.ignorePublicAcls resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.blockPublicAccess.restrictPublicBuckets resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicReadAccess resource.s3BucketDetails.publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicWriteAccess resource.s3BucketDetails.s3ObjectDetails.eTag resource.s3BucketDetails.s3ObjectDetails.hash resource.s3BucketDetails.s3ObjectDetails.key resource.s3BucketDetails.s3ObjectDetails.objectArn resource.s3BucketDetails.s3ObjectDetails.versionId resource.s3BucketDetails.tags.key resource.s3BucketDetails.tags.value resource.s3BucketDetails.type schemaVersion service.action.actionType service.action.awsApiCallAction.affectedResources service.action.awsApiCallAction.api service.action.awsApiCallAction.callerType service.action.awsApiCallAction.domainDetails.domain service.action.awsApiCallAction.errorCode service.action.awsApiCallAction.remoteAccountDetails.accountId service.action.awsApiCallAction.remoteAccountDetails.affiliated service.action.awsApiCallAction.remoteAccountDetails.awsServiceName service.action.awsApiCallAction.remoteIpDetails.city.cityName service.action.awsApiCallAction.remoteIpDetails.country.countryCode service.action.awsApiCallAction.remoteIpDetails.country.countryName service.action.awsApiCallAction.remoteIpDetails.geoLocation.lat service.action.awsApiCallAction.remoteIpDetails.geoLocation.lon service.action.awsApiCallAction.remoteIpDetails.ipAddressV4 service.action.awsApiCallAction.remoteIpDetails.ipAddressV6 service.action.awsApiCallAction.remoteIpDetails.organization.asn service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg service.action.awsApiCallAction.remoteIpDetails.organization.isp service.action.awsApiCallAction.remoteIpDetails.organization.org service.action.awsApiCallAction.serviceName service.action.awsApiCallAction.userAgent service.action.dnsRequestAction.blocked service.action.dnsRequestAction.domain service.action.dnsRequestAction.domainWithSuffix service.action.dnsRequestAction.protocol service.action.dnsRequestAction.vpcOwnerAccountId service.action.kubernetesApiCallAction.namespace service.action.kubernetesApiCallAction.parameters service.action.kubernetesApiCallAction.remoteIpDetails.city.cityName service.action.kubernetesApiCallAction.remoteIpDetails.country.countryCode service.action.kubernetesApiCallAction.remoteIpDetails.country.countryName service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lat service.action.kubernetesApiCallAction.remoteIpDetails.geoLocation.lon service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV4 service.action.kubernetesApiCallAction.remoteIpDetails.ipAddressV6 service.action.kubernetesApiCallAction.remoteIpDetails.organization.asn service.action.kubernetesApiCallAction.remoteIpDetails.organization.asnOrg service.action.kubernetesApiCallAction.remoteIpDetails.organization.isp service.action.kubernetesApiCallAction.remoteIpDetails.organization.org service.action.kubernetesApiCallAction.requestUri service.action.kubernetesApiCallAction.resource service.action.kubernetesApiCallAction.resourceName service.action.kubernetesApiCallAction.sourceIPs service.action.kubernetesApiCallAction.statusCode service.action.kubernetesApiCallAction.subresource service.action.kubernetesApiCallAction.userAgent service.action.kubernetesApiCallAction.verb service.action.kubernetesPermissionCheckedDetails.allowed service.action.kubernetesPermissionCheckedDetails.namespace service.action.kubernetesPermissionCheckedDetails.resource service.action.kubernetesPermissionCheckedDetails.verb service.action.kubernetesRoleBindingDetails.kind service.action.kubernetesRoleBindingDetails.name service.action.kubernetesRoleBindingDetails.roleRefKind service.action.kubernetesRoleBindingDetails.roleRefName service.action.kubernetesRoleBindingDetails.uid service.action.kubernetesRoleDetails.kind service.action.kubernetesRoleDetails.name service.action.kubernetesRoleDetails.uid service.action.networkConnectionAction.blocked service.action.networkConnectionAction.connectionDirection service.action.networkConnectionAction.localIpDetails.ipAddressV4 service.action.networkConnectionAction.localIpDetails.ipAddressV6 service.action.networkConnectionAction.localNetworkInterface service.action.networkConnectionAction.localPortDetails.port service.action.networkConnectionAction.localPortDetails.portName service.action.networkConnectionAction.protocol service.action.networkConnectionAction.remoteIpDetails.city.cityName service.action.networkConnectionAction.remoteIpDetails.country.countryCode service.action.networkConnectionAction.remoteIpDetails.country.countryName service.action.networkConnectionAction.remoteIpDetails.geoLocation.lat service.action.networkConnectionAction.remoteIpDetails.geoLocation.lon service.action.networkConnectionAction.remoteIpDetails.ipAddressV4 service.action.networkConnectionAction.remoteIpDetails.ipAddressV6 service.action.networkConnectionAction.remoteIpDetails.organization.asn service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg service.action.networkConnectionAction.remoteIpDetails.organization.isp service.action.networkConnectionAction.remoteIpDetails.organization.org service.action.networkConnectionAction.remotePortDetails.port service.action.networkConnectionAction.remotePortDetails.portName service.action.portProbeAction.blocked service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.localIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.localPortDetails.port service.action.portProbeAction.portProbeDetails.localPortDetails.portName service.action.portProbeAction.portProbeDetails.remoteIpDetails.city.cityName service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryCode service.action.portProbeAction.portProbeDetails.remoteIpDetails.country.countryName service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lat service.action.portProbeAction.portProbeDetails.remoteIpDetails.geoLocation.lon service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV4 service.action.portProbeAction.portProbeDetails.remoteIpDetails.ipAddressV6 service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asn service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.asnOrg service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.isp service.action.portProbeAction.portProbeDetails.remoteIpDetails.organization.org service.action.rdsLoginAttemptAction.loginAttributes.application service.action.rdsLoginAttemptAction.loginAttributes.failedLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.successfulLoginAttempts service.action.rdsLoginAttemptAction.loginAttributes.user service.action.rdsLoginAttemptAction.remoteIpDetails.city.cityName service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryCode service.action.rdsLoginAttemptAction.remoteIpDetails.country.countryName service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lat service.action.rdsLoginAttemptAction.remoteIpDetails.geoLocation.lon service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV4 service.action.rdsLoginAttemptAction.remoteIpDetails.ipAddressV6 service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asn service.action.rdsLoginAttemptAction.remoteIpDetails.organization.asnOrg service.action.rdsLoginAttemptAction.remoteIpDetails.organization.isp service.action.rdsLoginAttemptAction.remoteIpDetails.organization.org service.additionalInfo.agentDetails.agentId service.additionalInfo.agentDetails.agentVersion service.additionalInfo.anomalies.anomalousAPIs service.additionalInfo.authenticationMethod service.additionalInfo.averagePacketSizeIn service.additionalInfo.averagePacketSizeOut service.additionalInfo.context service.additionalInfo.domain service.additionalInfo.inBytes service.additionalInfo.localNetworkInterfaceOwner service.additionalInfo.localPort service.additionalInfo.outBytes service.additionalInfo.packetsIn service.additionalInfo.packetsOut service.additionalInfo.policyArn service.additionalInfo.policyName service.additionalInfo.remotePort service.additionalInfo.sample service.additionalInfo.scannedPort service.additionalInfo.threatFileSha256 service.additionalInfo.threatListName service.additionalInfo.threatName service.additionalInfo.totalBytesIn service.additionalInfo.totalBytesOut service.additionalInfo.type service.additionalInfo.unusual.asnOrg service.additionalInfo.unusual.port service.additionalInfo.unusualProtocol service.additionalInfo.userAgent.fullUserAgent service.additionalInfo.userAgent.userAgentCategory service.additionalInfo.value service.additionalInfo.vpcOwnerAccountId service.archived service.count service.detection.anomaly.profiles service.detection.anomaly.unusual.behavior service.detection.sequence.actors.id service.detection.sequence.actors.process.name service.detection.sequence.actors.process.path service.detection.sequence.actors.process.sha256 service.detection.sequence.actors.session.createdTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.actors.session.issuer service.detection.sequence.actors.session.mfaStatus service.detection.sequence.actors.session.uid service.detection.sequence.actors.user.account.account service.detection.sequence.actors.user.account.uid service.detection.sequence.actors.user.credentialUid service.detection.sequence.actors.user.name service.detection.sequence.actors.user.type service.detection.sequence.actors.user.uid service.detection.sequence.additionalSequenceTypes service.detection.sequence.description service.detection.sequence.endpoints.autonomousSystem.name service.detection.sequence.endpoints.autonomousSystem.number service.detection.sequence.endpoints.connection.direction service.detection.sequence.endpoints.domain service.detection.sequence.endpoints.id service.detection.sequence.endpoints.ip service.detection.sequence.endpoints.location.city service.detection.sequence.endpoints.location.country service.detection.sequence.endpoints.location.lat service.detection.sequence.endpoints.location.lon service.detection.sequence.endpoints.port service.detection.sequence.resources.accountId service.detection.sequence.resources.cloudPartition service.detection.sequence.resources.data.accessKey.principalId service.detection.sequence.resources.data.accessKey.userName service.detection.sequence.resources.data.accessKey.userType service.detection.sequence.resources.data.autoscalingAutoScalingGroup.ec2InstanceUids service.detection.sequence.resources.data.cloudformationStack.ec2InstanceUids service.detection.sequence.resources.data.container.image service.detection.sequence.resources.data.container.imageUid service.detection.sequence.resources.data.ec2Image.ec2InstanceUids service.detection.sequence.resources.data.ec2Instance.availabilityZone service.detection.sequence.resources.data.ec2Instance.ec2NetworkInterfaceUids service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.arn service.detection.sequence.resources.data.ec2Instance.iamInstanceProfile.id service.detection.sequence.resources.data.ec2Instance.imageDescription service.detection.sequence.resources.data.ec2Instance.instanceState service.detection.sequence.resources.data.ec2Instance.instanceType service.detection.sequence.resources.data.ec2Instance.outpostArn service.detection.sequence.resources.data.ec2Instance.platform service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeId service.detection.sequence.resources.data.ec2Instance.productCodes.productCodeType service.detection.sequence.resources.data.ec2LaunchTemplate.ec2InstanceUids service.detection.sequence.resources.data.ec2LaunchTemplate.version service.detection.sequence.resources.data.ec2NetworkInterface.ipv6Addresses service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateDnsName service.detection.sequence.resources.data.ec2NetworkInterface.privateIpAddresses.privateIpAddress service.detection.sequence.resources.data.ec2NetworkInterface.publicIp service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupId service.detection.sequence.resources.data.ec2NetworkInterface.securityGroups.groupName service.detection.sequence.resources.data.ec2NetworkInterface.subNetId service.detection.sequence.resources.data.ec2NetworkInterface.vpcId service.detection.sequence.resources.data.ec2Vpc.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.ec2InstanceUids service.detection.sequence.resources.data.ecsCluster.status service.detection.sequence.resources.data.ecsTask.containerUids service.detection.sequence.resources.data.ecsTask.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.ecsTask.launchType service.detection.sequence.resources.data.ecsTask.taskDefinitionArn service.detection.sequence.resources.data.eksCluster.arn service.detection.sequence.resources.data.eksCluster.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.eksCluster.ec2InstanceUids service.detection.sequence.resources.data.eksCluster.status service.detection.sequence.resources.data.eksCluster.vpcId service.detection.sequence.resources.data.iamInstanceProfile.ec2InstanceUids service.detection.sequence.resources.data.iamInstanceProfile.id service.detection.sequence.resources.data.kubernetesWorkload.containerUids service.detection.sequence.resources.data.kubernetesWorkload.namespace service.detection.sequence.resources.data.kubernetesWorkload.type service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.accountPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclAccess service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicAclIgnoreBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicBucketRestrictBehavior service.detection.sequence.resources.data.s3Bucket.bucketPublicAccess.publicPolicyAccess service.detection.sequence.resources.data.s3Bucket.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.resources.data.s3Bucket.effectivePermission service.detection.sequence.resources.data.s3Bucket.encryptionKeyArn service.detection.sequence.resources.data.s3Bucket.encryptionType service.detection.sequence.resources.data.s3Bucket.ownerId service.detection.sequence.resources.data.s3Bucket.publicReadAccess service.detection.sequence.resources.data.s3Bucket.publicWriteAccess service.detection.sequence.resources.data.s3Bucket.s3ObjectUids service.detection.sequence.resources.data.s3Object.eTag service.detection.sequence.resources.data.s3Object.key service.detection.sequence.resources.data.s3Object.versionId service.detection.sequence.resources.name service.detection.sequence.resources.region service.detection.sequence.resources.resourceType service.detection.sequence.resources.service service.detection.sequence.resources.tags.key service.detection.sequence.resources.tags.value service.detection.sequence.resources.uid service.detection.sequence.sequenceIndicators.key service.detection.sequence.sequenceIndicators.title service.detection.sequence.sequenceIndicators.values service.detection.sequence.signals.actorIds service.detection.sequence.signals.count service.detection.sequence.signals.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.description service.detection.sequence.signals.endpointIds service.detection.sequence.signals.firstSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.lastSeenAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.signals.name service.detection.sequence.signals.resourceUids service.detection.sequence.signals.severity service.detection.sequence.signals.signalIndicators.key service.detection.sequence.signals.signalIndicators.title service.detection.sequence.signals.signalIndicators.values service.detection.sequence.signals.type service.detection.sequence.signals.uid service.detection.sequence.signals.updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.detection.sequence.uid service.detectorId service.ebsVolumeScanDetails.scanCompletedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.count service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.severity service.ebsVolumeScanDetails.scanDetections.highestSeverityThreatDetails.threatName service.ebsVolumeScanDetails.scanDetections.scannedItemCount.files service.ebsVolumeScanDetails.scanDetections.scannedItemCount.totalGb service.ebsVolumeScanDetails.scanDetections.scannedItemCount.volumes service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.shortened service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.fileName service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.filePath service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.hash service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.filePaths.volumeArn service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.itemCount service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.name service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.threatNames.severity service.ebsVolumeScanDetails.scanDetections.threatDetectedByName.uniqueThreatNameCount service.ebsVolumeScanDetails.scanDetections.threatsDetectedItemCount.files service.ebsVolumeScanDetails.scanId service.ebsVolumeScanDetails.scanStartedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.ebsVolumeScanDetails.scanType service.ebsVolumeScanDetails.sources service.ebsVolumeScanDetails.triggerFindingId service.eventFirstSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.eventLastSeen Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.evidence.threatIntelligenceDetails.threatFileSha256 service.evidence.threatIntelligenceDetails.threatListName service.evidence.threatIntelligenceDetails.threatNames service.featureName service.malwareScanDetails.scanCategory service.malwareScanDetails.scanConfiguration.incrementalScanDetails.baselineResourceArn service.malwareScanDetails.scanConfiguration.triggerType service.malwareScanDetails.scanId service.malwareScanDetails.scanType service.malwareScanDetails.threats.count service.malwareScanDetails.threats.hash service.malwareScanDetails.threats.itemDetails.additionalInfo.deviceName service.malwareScanDetails.threats.itemDetails.additionalInfo.versionId service.malwareScanDetails.threats.itemDetails.hash service.malwareScanDetails.threats.itemDetails.itemPath service.malwareScanDetails.threats.itemDetails.resourceArn service.malwareScanDetails.threats.itemPaths.hash service.malwareScanDetails.threats.itemPaths.nestedItemPath service.malwareScanDetails.threats.name service.malwareScanDetails.threats.source service.malwareScanDetails.uniqueThreatCount service.resourceRole service.runtimeDetails.context.addressFamily service.runtimeDetails.context.commandLineExample service.runtimeDetails.context.fileOperation service.runtimeDetails.context.filePath service.runtimeDetails.context.fileSystemType service.runtimeDetails.context.flags service.runtimeDetails.context.ianaProtocolNumber service.runtimeDetails.context.ldPreloadValue service.runtimeDetails.context.libraryPath service.runtimeDetails.context.memoryRegions service.runtimeDetails.context.modifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.euid service.runtimeDetails.context.modifyingProcess.executablePath service.runtimeDetails.context.modifyingProcess.executableSha256 service.runtimeDetails.context.modifyingProcess.lineage.euid service.runtimeDetails.context.modifyingProcess.lineage.executablePath service.runtimeDetails.context.modifyingProcess.lineage.name service.runtimeDetails.context.modifyingProcess.lineage.namespacePid service.runtimeDetails.context.modifyingProcess.lineage.parentUuid service.runtimeDetails.context.modifyingProcess.lineage.pid service.runtimeDetails.context.modifyingProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.lineage.userId service.runtimeDetails.context.modifyingProcess.lineage.uuid service.runtimeDetails.context.modifyingProcess.name service.runtimeDetails.context.modifyingProcess.namespacePid service.runtimeDetails.context.modifyingProcess.parentUuid service.runtimeDetails.context.modifyingProcess.pid service.runtimeDetails.context.modifyingProcess.pwd service.runtimeDetails.context.modifyingProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.modifyingProcess.user service.runtimeDetails.context.modifyingProcess.userId service.runtimeDetails.context.modifyingProcess.uuid service.runtimeDetails.context.moduleFilePath service.runtimeDetails.context.moduleName service.runtimeDetails.context.moduleSha256 service.runtimeDetails.context.mountSource service.runtimeDetails.context.mountTarget service.runtimeDetails.context.relatedFilePaths service.runtimeDetails.context.releaseAgentPath service.runtimeDetails.context.runcBinaryPath service.runtimeDetails.context.scriptPath service.runtimeDetails.context.serviceName service.runtimeDetails.context.shellHistoryFilePath service.runtimeDetails.context.socketPath service.runtimeDetails.context.targetProcess.euid service.runtimeDetails.context.targetProcess.executablePath service.runtimeDetails.context.targetProcess.executableSha256 service.runtimeDetails.context.targetProcess.lineage.euid service.runtimeDetails.context.targetProcess.lineage.executablePath service.runtimeDetails.context.targetProcess.lineage.name service.runtimeDetails.context.targetProcess.lineage.namespacePid service.runtimeDetails.context.targetProcess.lineage.parentUuid service.runtimeDetails.context.targetProcess.lineage.pid service.runtimeDetails.context.targetProcess.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.lineage.userId service.runtimeDetails.context.targetProcess.lineage.uuid service.runtimeDetails.context.targetProcess.name service.runtimeDetails.context.targetProcess.namespacePid service.runtimeDetails.context.targetProcess.parentUuid service.runtimeDetails.context.targetProcess.pid service.runtimeDetails.context.targetProcess.pwd service.runtimeDetails.context.targetProcess.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.context.targetProcess.user service.runtimeDetails.context.targetProcess.userId service.runtimeDetails.context.targetProcess.uuid service.runtimeDetails.context.threatFilePath service.runtimeDetails.context.toolCategory service.runtimeDetails.context.toolName service.runtimeDetails.process.euid service.runtimeDetails.process.executablePath service.runtimeDetails.process.executableSha256 service.runtimeDetails.process.lineage.euid service.runtimeDetails.process.lineage.executablePath service.runtimeDetails.process.lineage.name service.runtimeDetails.process.lineage.namespacePid service.runtimeDetails.process.lineage.parentUuid service.runtimeDetails.process.lineage.pid service.runtimeDetails.process.lineage.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.lineage.userId service.runtimeDetails.process.lineage.uuid service.runtimeDetails.process.name service.runtimeDetails.process.namespacePid service.runtimeDetails.process.parentUuid service.runtimeDetails.process.pid service.runtimeDetails.process.pwd service.runtimeDetails.process.startTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 service.runtimeDetails.process.user service.runtimeDetails.process.userId service.runtimeDetails.process.uuid service.serviceName service.userFeedback severity To configure severity based filters, use the following for the FindingCriteria condition: Low: ⁠["1", "2", "3"]⁠ Medium: ⁠["4", "5", "6"]⁠ High: ⁠["7", "8"]⁠ Critical: ⁠["9", "10"]⁠ For more information, see Findings severity levels in the Amazon GuardDuty User Guide. title type updatedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000

paws.security.identity documentation built on May 31, 2026, 9:07 a.m.