AWS::GuardDuty::ThreatIntelSetCfnThreatIntelSet
The `AWS::GuardDuty::ThreatIntelSet` resource helps you create a list of known malicious IP addresses in your AWS environment. Once you activate this list, GuardDuty will use list the entries in this list as an additional source for threat detection and generate findings when there is an activity associated with these known malicious IP addresses. GuardDuty continues to monitor independently of this custom threat intelligence set. Only the users of the GuardDuty administrator account can manage this list. These settings automatically apply to the member accounts.
Import
import { CfnThreatIntelSet } from 'aws-cdk-lib/aws-guardduty';Or use the module namespace:
import * as guardduty from 'aws-cdk-lib/aws-guardduty';
// guardduty.CfnThreatIntelSetProperties
Configuration passed to the constructor as CfnThreatIntelSetProps.
formatRequiredstringThe format of the file that contains the `ThreatIntelSet` . For information about supported formats, see [List formats](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html#prepare_list) in the *Amazon GuardDuty User Guide* .
locationRequiredstringThe URI of the file that contains the ThreatIntelSet.
activateOptionalboolean | IResolvableA boolean value that determines if GuardDuty can start using this list for custom threat detection. For GuardDuty to be able to generate findings based on an activity associated with these entries, this list must be active.
detectorIdOptionalstringThe unique ID of the detector of the GuardDuty account for which you want to create a `threatIntelSet` . To find the `detectorId` in the current Region, see the Settings page in the GuardDuty console, or run the [ListDetectors](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
expectedBucketOwnerOptionalstringThe AWS account ID that owns the Amazon S3 bucket specified in the *Location* field. When you provide this account ID, GuardDuty will validate that the S3 bucket belongs to this account. If you don't specify an account ID owner, GuardDuty doesn't perform any validation.
nameOptionalstringThe user-friendly name to identify the ThreatIntelSet. The name of your list must be unique within an AWS account and Region. Valid characters are alphanumeric, whitespace, dash (-), and underscores (_).
tagsOptionalCfnTag[]The tags to be added to a new threat entity set resource. Each tag consists of a key and an optional value, both of which you define. For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .
CloudFormation Resource
This L1 construct maps directly to the following CloudFormation resource type.
Learn AWS the Practical Way
Our bi-weekly newsletter teaches hands-on AWS fundamentals. No certification fluff - just practical knowledge.
Subscribe to NewsletterQuick Facts
aws-guarddutyAWS::GuardDuty::ThreatIntelSet