Definitions for @turbot/aws-guardduty

accountId

{
"type": "string",
"pattern": "^[0-9]{12}$",
"tests": [
{
"description": "valid string - 123456789012",
"input": "123456789012"
},
{
"description": "valid - leading zeros",
"input": "001234567890"
},
{
"description": "invalid - contains char",
"input": "a123456789012",
"expected": false
},
{
"description": "invalid - too short",
"input": 12345678901,
"expected": false
},
{
"description": "invalid - too long",
"input": 1234567890123,
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/accountId",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

detector

{
"type": "object",
"properties": {
"DetectorId": {
"$ref": "#/definitions/sharedId"
},
"ServiceRole": {
"$ref": "#/definitions/serviceRole"
},
"CreatedAt": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"UpdatedAt": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"FindingPublishingFrequency": {
"type": "string"
},
"Tags": {
"type": "object"
},
"Status": {
"ref$": "#/definitions/detectorStatus"
},
"turbot": {
"type": "object",
"properties": {
"akas": {
"type": "array",
"items": {
"$ref": "#/definitions/detectorAka"
}
},
"title": {
"$ref": "#/definitions/sharedId"
},
"tags": {
"$ref": "aws#/definitions/tagsMap"
},
"custom": {
"type": "object",
"properties": {
"aws": {
"$ref": "aws#/definitions/awsMetadata"
},
"createTimestamp": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"lastUsedTimestamp": {
"ref$": "turbot#/definitions/isoTimestamp"
}
}
}
}
}
},
"tests": [
{
"description": "Valid - All properties",
"input": {
"DetectorId": "12abc34d567e8fa901bc2d34e56789f0",
"ServiceRole": "arn:aws:iam::541046466378:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
"Status": "ENABLED",
"CreatedAt": "2018-01-23T21:53:32.815Z",
"UpdatedAt": "2018-01-23T21:53:32.815Z",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-1:123456789012:detector/12abc34d567e8fa901bc2d34e56789f0"
],
"title": "12abc34d567e8fa901bc2d34e56789f0",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
}
},
{
"description": "invalid - required DetectorId not provided",
"input": {
"ServiceRole": "arn:aws:iam::541046466378:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
"Status": "ENABLED",
"CreatedAt": "2018-01-23T21:53:32.815Z",
"UpdatedAt": "2018-01-23T21:53:32.815Z",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-1:123456789012:detector/12abc34d567e8fa901bc2d34e56789f0"
],
"title": "12abc34d567e8fa901bc2d34e56789f0",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
}
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/detector",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

detectorAka

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:guardduty:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-[0-9]:[0-9]{12}:detector/[a-z0-9]+$",
"tests": [
{
"input": "arn:aws:guardduty:us-east-1:123456789012:detector/9eb56c925b97d19758bc0941ff28a87c"
},
{
"description": "Invalid - pattern not matching",
"input": "ar:aws:guardduty:us-east-1:123456789012:detector/9eb56c925b97d19758bc0941ff28a87c",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/detectorAka",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

detectorStatus

{
"type": "string",
"enum": [
"ENABLED",
"DISABLED"
],
"tests": [
{
"input": "ENABLED"
},
{
"description": "invalid - not listed in options",
"input": "RUNNABLE",
"expected": false
},
{
"description": "invalid - null value",
"input": null,
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/detectorStatus",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

finding

{
"type": "object",
"properties": {
"AccountId": {
"$ref": "#/definitions/accountId"
},
"Arn": {
"$ref": "#/definitions/findingArn"
},
"Confidence": {
"type": "number"
},
"CreatedAt": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"Description": {
"type": "string"
},
"Id": {
"type": "string"
},
"Partition": {
"type": "string"
},
"Region": {
"type": "string"
},
"Resource": {
"$ref": "#/definitions/resource"
},
"SchemaVersion": {
"type": "string"
},
"Service": {
"$ref": "#/definitions/service"
},
"Severity": {
"type": "number"
},
"Title": {
"type": "string"
},
"Type": {
"type": "string"
},
"UpdatedAt": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"turbot": {
"type": "object",
"properties": {
"akas": {
"type": "array",
"items": {
"$ref": "#/definitions/findingArn"
}
},
"title": {
"type": "string",
"pattern": "^[a-z0-9]+$"
},
"custom": {
"type": "object",
"properties": {
"aws": {
"$ref": "aws#/definitions/awsMetadata"
},
"createTimestamp": {
"$ref": "turbot#/definitions/isoTimestamp"
}
}
}
}
}
},
"tests": [
{
"description": "Valid - All properties",
"input": {
"Resource": {
"ResourceType": "AccessKey",
"AccessKeyDetails": {
"UserName": "testuser",
"UserType": "IAMUser",
"PrincipalId": "AIDACKCEVSQ6C2EXAMPLE",
"AccessKeyId": "ASIASZ4SI7REEEXAMPLE"
}
},
"Description": "APIs commonly used to discover the users, groups, policies and permissions in an account, was invoked by IAM principal testuser under unusual circumstances. Such activity is not typically seen from this principal.",
"Service": {
"Count": 5,
"Archived": false,
"ServiceName": "guardduty",
"EventFirstSeen": "2020-05-26T22:21:48.385Z",
"ResourceRole": "TARGET",
"EventLastSeen": "2020-05-27T22:21:48.385Z",
"DetectorId": "d4b040365221be2b54a6264dcexample",
"Action": {
"ActionType": "AWS_API_CALL",
"AwsApiCallAction": {
"RemoteIpDetails": {
"GeoLocation": {
"Lat": 51.5164,
"Lon": -0.093
},
"City": {
"CityName": "London"
},
"IpAddressV4": "52.94.36.7",
"Organization": {
"Org": "Amazon.com",
"Isp": "Amazon.com",
"Asn": "16509",
"AsnOrg": "AMAZON-02"
},
"Country": {
"CountryName": "United Kingdom"
}
},
"Api": "ListPolicyVersions",
"ServiceName": "iam.amazonaws.com",
"CallerType": "Remote IP"
}
}
},
"Title": "Unusual user permission reconnaissance activity by testuser.",
"Type": "Recon:IAMUser/UserPermissions",
"Region": "us-east-1",
"Partition": "aws",
"Arn": "arn:aws:guardduty:us-east-1:111122223333:detector/d4b040365221be2b54a6264dcexample/finding/1ab92989eaf0e742df4a014d5example",
"UpdatedAt": "2020-05-26T22:55:21.703Z",
"SchemaVersion": "2.0",
"Severity": 5,
"Id": "1ab92989eaf0e742df4a014d5example",
"CreatedAt": "2020-05-26T22:21:48.385Z",
"AccountId": "111122223333",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-1:111122223333:detector/d4b040365221be2b54a6264dcexample/finding/1ab92989eaf0e742df4a014d5example"
],
"title": "12abc34d567e8fa901bc2d34e56789f0",
"custom": {
"aws": {
"accountId": 111122223333,
"regionName": "us-east-1"
}
}
}
}
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/finding",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

findingArn

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:guardduty:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-[0-9]:[0-9]{12}:detector/[a-z0-9]+/finding/[a-z0-9]+$",
"tests": [
{
"input": "arn:aws:guardduty:us-east-1:111122223333:detector/d4b040365221be2b54a6264dcexample/finding/1ab92989eaf0e742df4a014d5example"
},
{
"description": "Invalid - pattern not matching",
"input": "ar:aws:guardduty:us-east-1:111122223333:detector/d4b040365221be2b54a6264dcexample/finding/1ab92989eaf0e742df4a014d5example",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/findingArn",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

format

{
"type": "string",
"enum": [
"TXT",
"STIX",
"OTX_CSV",
"ALIEN_VAULT",
"PROOF_POINT",
"FIRE_EYE"
],
"tests": [
{
"input": "TXT"
},
{
"input": "PROOF_POINT"
},
{
"description": "invalid - not listed in the options",
"input": "ON",
"expected": false
},
{
"description": "invalid - case sensitive",
"input": "txt",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/format",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

guardDuty

{
"allOf": [
{
"$ref": "turbot#/definitions/service",
"type": "object",
"properties": {
"name": {
"const": "GuardDuty"
},
"turbot": {
"type": "object",
"properties": {
"akas": {
"type": "array",
"items": {
"$ref": "#/definitions/guardDutyAka"
}
},
"title": {
"const": "GuardDuty"
},
"custom": {
"type": "object",
"properties": {
"aws": {
"$ref": "aws#/definitions/awsMetadata"
}
}
}
}
}
},
"additionalProperties": true,
"tests": [
{
"description": "All valid properties",
"input": {
"name": "GuardDuty",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-1:123456789012"
],
"title": "GuardDuty",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
}
},
{
"description": "invalid - name is missing",
"input": {
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-1:123456789012"
],
"title": "GuardDuty",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
},
"expected": false
}
]
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/guardDuty",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

guardDutyAka

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:guardduty:[a-z]{2}(-gov)?-[a-z]+-[0-9]{1}:[0-9]{12}$",
"tests": [
{
"description": "Valid - base case",
"input": "arn:aws:guardduty:us-east-1:123456789012"
},
{
"description": "Invalid - pattern not matching",
"input": "arn:aws:guardddddduty:us-east-1234:1234567897628437012",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/guardDutyAka",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

guardDutyRegionNames

{
"type": "string",
"enum": [
"ap-northeast-1",
"ap-northeast-2",
"ap-south-1",
"ap-southeast-1",
"ap-southeast-2",
"ca-central-1",
"eu-central-1",
"eu-west-1",
"eu-west-2",
"eu-west-3",
"sa-east-1",
"us-east-1",
"us-east-2",
"us-west-1",
"us-west-2"
],
"tests": [
{
"input": "us-east-1"
},
{
"description": "invalid - non-existent region",
"input": "does-not-exist",
"expected": false
},
{
"description": "invalid - incorrect data type",
"input": true,
"expected": false
},
{
"description": "invalid - unsupported region",
"input": "us-west-3",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/guardDutyRegionNames",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

guardDutyRegionsList

{
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/definitions/guardDutyRegionNames"
},
"example": [
[
"ca-central-1",
"eu-west-1"
]
],
"default": [
"ap-northeast-1",
"ap-northeast-2",
"ap-south-1",
"ap-southeast-1",
"ap-southeast-2",
"ca-central-1",
"eu-central-1",
"eu-west-1",
"eu-west-2",
"eu-west-3",
"sa-east-1",
"us-east-1",
"us-east-2",
"us-west-1",
"us-west-2"
],
"tests": [
{
"description": "one region",
"input": [
"us-east-1"
]
},
{
"description": "all supported regions",
"input": [
"ap-northeast-1",
"ap-northeast-2",
"ap-south-1",
"ap-southeast-2",
"eu-central-1",
"eu-west-1",
"us-east-1",
"us-east-2",
"us-west-1",
"us-west-2"
]
},
{
"description": "invalid - no regions",
"input": [],
"expected": false
},
{
"description": "invalid - unsupported region",
"input": [
"ap-south-2"
],
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/guardDutyRegionsList",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

ipSet

{
"type": "object",
"properties": {
"IpSetId": {
"$ref": "#/definitions/sharedId"
},
"DetectorId": {
"$ref": "#/definitions/sharedId"
},
"Status": {
"$ref": "#/definitions/ipSetStatus"
},
"Format": {
"$ref": "#/definitions/format"
},
"Location": {
"$ref": "#/definitions/name"
},
"Name": {
"$ref": "#/definitions/name"
},
"Tags": {
"type": "object"
},
"turbot": {
"type": "object",
"properties": {
"akas": {
"type": "array",
"items": {
"$ref": "#/definitions/ipSetAka"
}
},
"title": {
"$ref": "#/definitions/name"
},
"custom": {
"type": "object",
"properties": {
"aws": {
"$ref": "aws#/definitions/awsMetadata"
},
"createTimestamp": {
"$ref": "turbot#/definitions/isoTimestamp"
}
}
}
}
}
},
"tests": [
{
"description": "all properties given",
"input": {
"IpSetId": "0cb0141ab9fbde177613ab9436212e90",
"DetectorId": "0cb0141ab9fbde177613ab9436212e90",
"Status": "INACTIVE",
"Format": "TXT",
"Location": "https://s3.amazonaws.com/guarddutylists/exampleipset.txt",
"Name": "ExampleIPSet",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-2:123456789012:detector/0cb0141ab9fbde177613ab9436212e90/ipset/0cb0141ab9fbde177613ab9436212e90"
],
"title": "test01",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
}
},
{
"description": "invalid - incorrect IpSetID",
"input": {
"Aws": {
"AccountId": 123456789012,
"RegionName": "us-east-1"
},
"title": "test01",
"IpSetId": "0ab9fbde177613ab9436212e90",
"DetectorId": "0cb0141ab9fbde177613ab9436212e90",
"Name": "ExampleIPSet"
},
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/ipSet",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

ipSetAka

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:guardduty:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-[0-9]:[0-9]{12}:detector/[a-z0-9]+/ipset/[a-z0-9]+$",
"tests": [
{
"description": "Valid - Base case",
"input": "arn:aws:guardduty:us-east-2:541046466378:detector/62b49732b72b3dc7abd57b52169d12cc/ipset/bab56fc2047645a7b927f58b2adfbe4e"
},
{
"description": "Invalid - Malformed resource collection",
"input": "arn:aws:ec2:us-east-1:123456789012:instances/i-a2345678",
"expected": false
},
{
"description": "Invalid - Malformed region name",
"input": "arn:aws:ec2:use-east-1:123456789012:detector/62b49732b72b3dc7abd57b52169d12cc/instances/i-a2345678",
"expected": false
},
{
"description": "Invalid - Malformed account ID",
"input": "arn:aws:ec2:us-east-1:1234567890123:instances/i-a2345678",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/ipSetAka",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

ipSetStatus

{
"type": "string",
"enum": [
"INACTIVE",
"ACTIVATING",
"ACTIVE",
"DEACTIVATING",
"ERROR",
"DELETE_PENDING",
"DELETED"
],
"test": [
{
"input": "ACTIVE"
},
{
"description": "invalid - not listed in options",
"input": "RUNNABLE",
"expected": false
},
{
"description": "invalid - null value",
"input": null,
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/ipSetStatus",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

ipStatus

{
"type": "string",
"enum": [
"INACTIVE",
"ACTIVATING",
"ACTIVE",
"DEACTIVATING",
"ERROR",
"DELETE_PENDING",
"DELETED"
],
"tests": [
{
"input": "INACTIVE"
},
{
"input": "DEACTIVATING"
},
{
"description": "invalid - not listed in the options",
"input": "ON",
"expected": false
},
{
"description": "invalid - case sensitive",
"input": "deleted",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/ipStatus",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

name

{
"type": "string",
"tests": [
{
"input": "foo"
},
{
"input": "00123"
},
{
"input": "abcde"
},
{
"input": "TestThe-Kitchen_Sink"
},
{
"input": "https://s3.amazonaws.com/guarddutylists/exampleipset.txt"
},
{
"description": "invalid - array passed instead of string",
"input": [
123124
],
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/name",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

resource

{
"type": "object",
"properties": {
"AccessKeyDetails": {
"type": "object"
},
"S3BucketDetails": {
"type": "array"
},
"InstanceDetail": {
"type": "object"
},
"EksClusterDetails": {
"type": "object"
},
"KubernetesDetails": {
"type": "object"
},
"ResourceType": {
"type": "string"
}
},
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/resource",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

service

{
"type": "object",
"properties": {
"Action": {
"type": "object"
},
"Evidence": {
"type": "object"
},
"Archived": {
"type": "boolean"
},
"Count": {
"type": "number"
},
"DetectorId": {
"type": "string"
},
"EventFirstSeen": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"EventLastSeen": {
"$ref": "turbot#/definitions/isoTimestamp"
},
"ResourceRole": {
"type": "string"
},
"ServiceName": {
"type": "string"
},
"UserFeedback": {
"type": "string"
}
},
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/service",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

serviceRole

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:iam::\\d{12}:role/aws-service-role/guardduty.amazonaws.com/[a-zA-Z0-9]+$",
"tests": [
{
"input": "arn:aws:iam::541046466378:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"
},
{
"description": "invalid - unknown arn given",
"input": "arn:aws:lambda::541046466378:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/serviceRole",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

sharedId

{
"type": "string",
"pattern": "^[a-f0-9]{32}$",
"tests": [
{
"input": "12abc34d567e8fa901bc2d34e56789f0"
},
{
"description": "max length",
"input": "12abc34d567e8fa901bc2d34e56789f0"
},
{
"description": "invalid - too long",
"input": "12abc34d567e8fa901bc2d34e56789f01",
"expected": false
},
{
"description": "invaid - array type",
"input": [
"hello"
],
"expected": false
},
{
"description": "invalid - empty string",
"input": "",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/sharedId",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

status

{
"type": "string",
"enum": [
"ENABLED",
"DISABLED"
],
"tests": [
{
"input": "ENABLED"
},
{
"input": "DISABLED"
},
{
"description": "invalid - not listed in the options",
"input": "ON",
"expected": false
},
{
"description": "invalid - case sensitive",
"input": "enabled",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/status",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

threatIntelSet

{
"type": "object",
"properties": {
"ThreatIntelSetId": {
"$ref": "#/definitions/sharedId"
},
"DetectorId": {
"$ref": "#/definitions/sharedId"
},
"Status": {
"$ref": "#/definitions/threatIntelSetStatus"
},
"Format": {
"$ref": "#/definitions/format"
},
"Location": {
"$ref": "#/definitions/name"
},
"Name": {
"$ref": "#/definitions/name"
},
"Tags": {
"type": "object"
},
"turbot": {
"type": "object",
"properties": {
"akas": {
"type": "array",
"items": {
"$ref": "#/definitions/threatIntelSetAka"
}
},
"title": {
"$ref": "#/definitions/name"
},
"custom": {
"type": "object",
"properties": {
"aws": {
"$ref": "aws#/definitions/awsMetadata"
},
"createTimestamp": {
"$ref": "turbot#/definitions/isoTimestamp"
}
}
}
}
}
},
"tests": [
{
"description": "all properties given",
"input": {
"DetectorId": "0cb0141ab9fbde177613ab9436212e90",
"ThreatIntelSetId": "0cb0141ab9fbde177613ab9436212e90",
"Status": "INACTIVE",
"Format": "TXT",
"Location": "https://s3.amazonaws.com/guarddutylists/exampleipset.txt",
"Name": "ExampleIPSet",
"turbot": {
"akas": [
"arn:aws:guardduty:us-east-2:123456789012:detector/0cb0141ab9fbde177613ab9436212e90/threatintelset/8eb5745dc175f871aa178451e507d16e"
],
"title": "test01",
"custom": {
"aws": {
"accountId": 123456789012,
"regionName": "us-east-1"
}
}
}
}
},
{
"description": "invalid - incorrect threatintelset ID",
"input": {
"Aws": {
"AccountId": 123456789012,
"RegionName": "us-east-1"
},
"title": "12abc34d567e8fa901bc2d34e56789f0",
"DetectorId": "0cb0141ab9fbde177613ab9436212e90",
"ThreatIntelSetId": "0cab9fbde177613ab9436212e90"
},
"expected": false
},
{
"description": "invalid - required DetectorID not provided",
"input": {
"Aws": {
"AccountId": 123456789012,
"RegionName": "us-east-1"
},
"title": "12abc34d567e8fa901bc2d34e56789f0",
"ThreatIntelSetId": "0cab9fbde177613ab9436212e90"
},
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/threatIntelSet",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

threatIntelSetAka

{
"type": "string",
"pattern": "^arn:aws(-us-gov|-cn)?:guardduty:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-[0-9]:[0-9]{12}:detector/[a-z0-9]+/threatintelset/[a-z0-9]+$",
"tests": [
{
"description": "Valid - Base case",
"input": "arn:aws:guardduty:us-east-2:541046466378:detector/62b49732b72b3dc7abd57b52169d12cc/threatintelset/8eb5745dc175f871aa178451e507d16e"
},
{
"description": "Invalid - Malformed resource collection",
"input": "arn:aws:ec2:us-east-1:123456789012:instances/i-a2345678",
"expected": false
},
{
"description": "Invalid - Malformed region name",
"input": "arn:aws:ec2:use-east-1:123456789012:instances/i-a2345678",
"expected": false
},
{
"description": "Invalid - Malformed account ID",
"input": "arn:aws:ec2:us-east-1:1234567890123:instances/i-a2345678",
"expected": false
}
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/threatIntelSetAka",
"modUri": "tmod:@turbot/aws-guardduty"
}
}

threatIntelSetStatus

{
"type": "string",
"enum": [
"INACTIVE",
"ACTIVATING",
"ACTIVE",
"DEACTIVATING",
"ERROR",
"DELETE_PENDING",
"DELETED"
],
".turbot": {
"uri": "tmod:@turbot/aws-guardduty#/definitions/threatIntelSetStatus",
"modUri": "tmod:@turbot/aws-guardduty"
}
}