The `AWS::GuardDuty::Detector` resource specifies a new GuardDuty detector.

A detector is an object that represents the GuardDuty service. A detector is required for GuardDuty to become operational.

Make sure you use either `DataSources` or `Features` in a one request, and not both.

CfnDetector

Specifies whether the detector is to be enabled on creation.

enable

Describes which data sources will be enabled for the detector.

dataSources

A list of features that will be configured for the detector.

features

Specifies how frequently updated findings are exported.

findingPublishingFrequency

Specifies tags added to a new detector resource.

Each tag consists of a key and an optional value, both of which you define.

Currently, support is available only for creating and deleting a tag. No support exists for updating the tags.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

CfnFilter

The detector ID associated with the GuardDuty account for which you want to create a filter.

To find the `detectorId` in the current Region, see the
Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

detectorId

Represents the criteria to be used in the filter for querying findings.

findingCriteria

The name of the filter.

Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.

name

Specifies the action that is to be applied to the findings that match the filter.

action

The description of the filter.

Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ( `{ }` , `[ ]` , and `( )` ), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.

description

Specifies the position of the filter in the list of current filters.

Also specifies the order in which this filter is applied to the findings. The minimum value for this property is 1 and the maximum is 100.

By default, filters may not be created in the same order as they are ranked. To ensure that the filters are created in the expected order, you can use an optional attribute, [DependsOn](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html) , with the following syntax: `"DependsOn":[ "ObjectName" ]` .

rank

The tags to be added to a new filter resource.

Each tag consists of a key and an optional value, both of which you define.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

The `AWS::GuardDuty::IPSet` resource helps you create a list of trusted IP addresses that you can use for secure communication with AWS infrastructure and applications.

Once you activate this list, GuardDuty will not generate findings when there is an activity associated with these safe IP addresses.

Only the users of the GuardDuty administrator account can manage this list. These settings are also applied to the member accounts.

CfnIPSet

The format of the file that contains the IPSet.

For information about supported formats, see [List formats](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html#prepare_list) in the *Amazon GuardDuty User Guide* .

format

The URI of the file that contains the IPSet.

location

A boolean value that determines if GuardDuty can start using this list for custom threat detection.

For GuardDuty to prevent generating findings based on an activity associated with these entries, this list must be active.

activate

The unique ID of the detector of the GuardDuty account for which you want to create an IPSet.

To find the `detectorId` in the current Region, see the
Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.

When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.

expectedBucketOwner

The user-friendly name to identify the IPSet.

The name of your list must be unique within an AWS account and Region. Valid characters are alphanumeric, whitespace, dash (-), and underscores (_).

The tags to be added to a new threat entity set resource.

Each tag consists of a key and an optional value, both of which you define.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

Creates a new Malware Protection plan for the protected resource.

When you create a Malware Protection plan, the [AWS service terms for GuardDuty Malware Protection](https://docs.aws.amazon.com/service-terms/#87._Amazon_GuardDuty) will apply.

CfnMalwareProtectionPlan

Information about the protected resource.

Presently, `S3Bucket` is the only supported protected resource.

protectedResource

Amazon Resource Name (ARN) of the IAM role that includes the permissions required to scan and (optionally) add tags to the associated protected resource.

To find the ARN of your IAM role, go to the IAM console, and select the role name for details.

role

Specifies the action that is to be applied to the Malware Protection plan resource.

actions

The tags to be added to the created Malware Protection plan resource.

Each tag consists of a key and an optional value, both of which you need to specify.

You can use the `AWS::GuardDuty::Master` resource in a GuardDuty member account to accept an invitation from a GuardDuty administrator account.

The invitation to the member account must be sent prior to using the `AWS::GuardDuty::Master` resource to accept the administrator account's invitation. You can invite a member account by using the `InviteMembers` operation of the GuardDuty API, or by creating an `AWS::GuardDuty::Member` resource.

CfnMaster

The unique ID of the detector of the GuardDuty member account.

To find the `detectorId` in the current Region, see the
Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

The AWS account ID of the account designated as the GuardDuty administrator account.

masterId

The ID of the invitation that is sent to the account designated as a member account.

You can find the invitation ID by running the [ListInvitations](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListInvitations.html) in the *GuardDuty API Reference* .

invitationId

You can use the `AWS::GuardDuty::Member` resource to add an AWS account as a GuardDuty member account to the current GuardDuty administrator account.

If the value of the `Status` property is not provided or is set to `Created` , a member account is created but not invited. If the value of the `Status` property is set to `Invited` , a member account is created and invited. An `AWS::GuardDuty::Member` resource must be created with the `Status` property set to `Invited` before the `AWS::GuardDuty::Master` resource can be created in a GuardDuty member account.

CfnMember

The email address associated with the member account.

email

The ID of the detector associated with the GuardDuty service to add the member to.

Specifies whether or not to disable email notification for the member account that you invite.

disableEmailNotification

The AWS account ID of the account to designate as a member.

memberId

The invitation message that you want to send to the accounts that you're inviting to GuardDuty as members.

message

You can use the `Status` property to update the status of the relationship between the member account and its administrator account.

Valid values are `Created` and `Invited` when using an `AWS::GuardDuty::Member` resource. If the value for this property is not provided or set to `Created` , a member account is created but not invited. If the value of this property is set to `Invited` , a member account is created and invited.

status

Creates a publishing destination where you can export your GuardDuty findings.

Before you start exporting the findings, the destination resource must exist.

For more information about considerations and permissions, see [Exporting GuardDuty findings to Amazon S3 buckets](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html) in the *Amazon GuardDuty User Guide* .

CfnPublishingDestination

Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.

destinationProperties

The type of publishing destination.

GuardDuty supports Amazon S3 buckets as a publishing destination.

destinationType

The ID of the GuardDuty detector where the publishing destination exists.

The `AWS::GuardDuty::ThreatEntitySet` resource helps you create a list of known malicious IP addresses and domain names in your AWS environment.

Once you activate this list, GuardDuty will use the entries in this list as an additional source of threat detection and generate findings when there is an activity associated with these known malicious IP addresses and domain names. GuardDuty continues to monitor independently of this custom threat entity set.

Only the users of the GuardDuty administrator account can manage this list. These settings automatically apply to the member accounts.

CfnThreatEntitySet

The format of the file that contains the threat entity set.

For information about supported formats, see [List formats](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html#prepare_list) in the *Amazon GuardDuty User Guide* .

The URI of the file that contains the threat entity set.

A boolean value that determines if GuardDuty can start using this list for custom threat detection.

For GuardDuty to consider the entries in this list and generate findings based on associated activity, this list must be active.

The unique regional detector ID of the GuardDuty account for which you want to create a threat entity set.

To find the `detectorId` in the current Region, see the Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.

Whether or not you provide the account ID for this optional field, GuardDuty validates that the account ID associated with the `DetectorId` owns the S3 bucket in the `Location` field. If GuardDuty finds that this S3 bucket doesn't belong to the specified account ID, you will get an error at the time of activating this list.

The user-friendly name to identify the threat entity set.

Valid characters are alphanumeric, whitespace, dash (-), and underscores (_).

The `AWS::GuardDuty::ThreatIntelSet` resource helps you create a list of known malicious IP addresses in your AWS environment.

Once you activate this list, GuardDuty will use list the entries in this list as an additional source for threat detection and generate findings when there is an activity associated with these known malicious IP addresses. GuardDuty continues to monitor independently of this custom threat intelligence set.

Only the users of the GuardDuty administrator account can manage this list. These settings automatically apply to the member accounts.

CfnThreatIntelSet

The format of the file that contains the `ThreatIntelSet` .

For information about supported formats, see [List formats](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html#prepare_list) in the *Amazon GuardDuty User Guide* .

The URI of the file that contains the ThreatIntelSet.

A boolean value that determines if GuardDuty can start using this list for custom threat detection.

For GuardDuty to be able to generate findings based on an activity associated with these entries, this list must be active.

The unique ID of the detector of the GuardDuty account for which you want to create a `threatIntelSet` .

To find the `detectorId` in the current Region, see the
Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

The user-friendly name to identify the ThreatIntelSet.

The name of your list must be unique within an AWS account and Region. Valid characters are alphanumeric, whitespace, dash (-), and underscores (_).

Creates a new trusted entity set.

In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your AWS environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set.

Only users of the administrator account can manage the entity sets, which automatically apply to member accounts.

CfnTrustedEntitySet

The format of the file that contains the trusted entity set.

For information about supported formats, see [List formats](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html#prepare_list) in the *Amazon GuardDuty User Guide* .

The URI of the file that contains the trusted entity set.

The unique regional detector ID of the GuardDuty account for which you want to create a trusted entity set.

To find the `detectorId` in the current Region, see the Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.

The AWS account ID that owns the Amazon S3 bucket specified in the *Location* field.

Whether or not you provide the account ID for this optional field, GuardDuty validates that the account ID associated with the `DetectorId` value owns the S3 bucket in the `Location` field. If GuardDuty finds that this S3 bucket doesn't belong to the specified account ID, you will get an error at the time of activating this list.

A user-friendly name to identify the trusted entity set.

Valid characters include lowercase letters, uppercase letters, numbers, dash(-), and underscore (_).

The tags to be added to a new trusted entity set resource.

Each tag consists of a key and an optional value, both of which you define.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

Amazon GuardDuty

L1 Constructs10