Skip to content

Commit a1c7096

Browse files
author
AWS
committed
Amazon GuardDuty Update: Adding support for extended threat detection for Amazon EC2 and Amazon ECS. Adding support for wild card suppression rules.
1 parent 9ed5b8e commit a1c7096

File tree

2 files changed

+220
-1
lines changed

2 files changed

+220
-1
lines changed

‎.changes/next-release/feature-AmazonGuardDuty-211c0eb.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Amazon GuardDuty",
4+
"contributor": "",
5+
"description": "Adding support for extended threat detection for Amazon EC2 and Amazon ECS. Adding support for wild card suppression rules."
6+
}

‎services/guardduty/src/main/resources/codegen-resources/service-2.json‎

Lines changed: 214 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1947,6 +1947,17 @@
19471947
},
19481948
"documentation":"<p>Contains information about the Autonomous System (AS) associated with the network endpoints involved in an attack sequence.</p>"
19491949
},
1950+
"AutoscalingAutoScalingGroup":{
1951+
"type":"structure",
1952+
"members":{
1953+
"Ec2InstanceUids":{
1954+
"shape":"Ec2InstanceUids",
1955+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that are part of the same Auto Scaling Group.</p>",
1956+
"locationName":"ec2InstanceUids"
1957+
}
1958+
},
1959+
"documentation":"<p>Contains information about the Auto Scaling Group involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
1960+
},
19501961
"AwsApiCallAction":{
19511962
"type":"structure",
19521963
"members":{
@@ -2113,6 +2124,17 @@
21132124
},
21142125
"documentation":"<p>Contains information on the status of CloudTrail as a data source for the detector.</p>"
21152126
},
2127+
"CloudformationStack":{
2128+
"type":"structure",
2129+
"members":{
2130+
"Ec2InstanceUids":{
2131+
"shape":"Ec2InstanceUids",
2132+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that were created as part of the same CloudFormation stack.</p>",
2133+
"locationName":"ec2InstanceUids"
2134+
}
2135+
},
2136+
"documentation":"<p>Contains information about the CloudFormation stack involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
2137+
},
21162138
"ClusterStatus":{
21172139
"type":"string",
21182140
"enum":[
@@ -2192,6 +2214,16 @@
21922214
"shape":"Long",
21932215
"documentation":"<p>Represents a <i>less than or equal</i> condition to be applied to a single field when querying for findings.</p>",
21942216
"locationName":"lessThanOrEqual"
2217+
},
2218+
"Matches":{
2219+
"shape":"Matches",
2220+
"documentation":"<p>Represents the <i>match</i> condition to be applied to a single field when querying for findings. </p> <note> <p> The <i>matches</i> condition is available only for create-filter and update-filter APIs. </p> </note>",
2221+
"locationName":"matches"
2222+
},
2223+
"NotMatches":{
2224+
"shape":"NotMatches",
2225+
"documentation":"<p>Represents the <i>not match</i> condition to be applied to a single field when querying for findings. </p> <note> <p> The <i>not-matches</i> condition is available only for create-filter and update-filter APIs. </p> </note>",
2226+
"locationName":"notMatches"
21952227
}
21962228
},
21972229
"documentation":"<p>Contains information about the condition.</p>"
@@ -4251,6 +4283,17 @@
42514283
},
42524284
"documentation":"<p>Describes the configuration of scanning EBS volumes as a data source.</p>"
42534285
},
4286+
"Ec2Image":{
4287+
"type":"structure",
4288+
"members":{
4289+
"Ec2InstanceUids":{
4290+
"shape":"Ec2InstanceUids",
4291+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that were launched with the same Amazon Machine Image (AMI).</p>",
4292+
"locationName":"ec2InstanceUids"
4293+
}
4294+
},
4295+
"documentation":"<p>Contains information about the Amazon EC2 Image involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
4296+
},
42544297
"Ec2ImageDetails":{
42554298
"type":"structure",
42564299
"members":{
@@ -4320,6 +4363,21 @@
43204363
"max":25,
43214364
"min":0
43224365
},
4366+
"Ec2LaunchTemplate":{
4367+
"type":"structure",
4368+
"members":{
4369+
"Ec2InstanceUids":{
4370+
"shape":"Ec2InstanceUids",
4371+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that share the same Amazon EC2 launch template.</p>",
4372+
"locationName":"ec2InstanceUids"
4373+
},
4374+
"Version":{
4375+
"shape":"LaunchTemplateVersion",
4376+
"documentation":"<p>Version of the EC2 launch template.</p>"
4377+
}
4378+
},
4379+
"documentation":"<p>Contains information about the Amazon EC2 launch template involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
4380+
},
43234381
"Ec2NetworkInterface":{
43244382
"type":"structure",
43254383
"members":{
@@ -4360,6 +4418,33 @@
43604418
"type":"list",
43614419
"member":{"shape":"String"}
43624420
},
4421+
"Ec2Vpc":{
4422+
"type":"structure",
4423+
"members":{
4424+
"Ec2InstanceUids":{
4425+
"shape":"Ec2InstanceUids",
4426+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that were launched within the same Virtual Private Cloud (VPC).</p>",
4427+
"locationName":"ec2InstanceUids"
4428+
}
4429+
},
4430+
"documentation":"<p>Contains information about the Amazon EC2 VPC involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
4431+
},
4432+
"EcsCluster":{
4433+
"type":"structure",
4434+
"members":{
4435+
"Status":{
4436+
"shape":"EcsClusterStatus",
4437+
"documentation":"<p>The current status of the Amazon ECS cluster.</p>",
4438+
"locationName":"status"
4439+
},
4440+
"Ec2InstanceUids":{
4441+
"shape":"Ec2InstanceUids",
4442+
"documentation":"<p>A list of unique identifiers for the Amazon EC2 instances that serve as container instances in the Amazon ECS cluster.</p>",
4443+
"locationName":"ec2InstanceUids"
4444+
}
4445+
},
4446+
"documentation":"<p>Contains information about the Amazon ECS cluster involved in a GuardDuty finding, including cluster identification and status.</p>"
4447+
},
43634448
"EcsClusterDetails":{
43644449
"type":"structure",
43654450
"members":{
@@ -4406,6 +4491,49 @@
44064491
},
44074492
"documentation":"<p>Contains information about the details of the ECS Cluster.</p>"
44084493
},
4494+
"EcsClusterStatus":{
4495+
"type":"string",
4496+
"enum":[
4497+
"ACTIVE",
4498+
"PROVISIONING",
4499+
"DEPROVISIONING",
4500+
"FAILED",
4501+
"INACTIVE"
4502+
]
4503+
},
4504+
"EcsLaunchType":{
4505+
"type":"string",
4506+
"enum":[
4507+
"FARGATE",
4508+
"EC2"
4509+
]
4510+
},
4511+
"EcsTask":{
4512+
"type":"structure",
4513+
"members":{
4514+
"CreatedAt":{
4515+
"shape":"Timestamp",
4516+
"documentation":"<p>The timestamp indicating when the Amazon ECS task was created, in UTC format.</p>",
4517+
"locationName":"createdAt"
4518+
},
4519+
"TaskDefinitionArn":{
4520+
"shape":"String",
4521+
"documentation":"<p>The ARN of task definition which describes the container and volume definitions of the Amazon ECS task.</p>",
4522+
"locationName":"taskDefinitionArn"
4523+
},
4524+
"LaunchType":{
4525+
"shape":"EcsLaunchType",
4526+
"documentation":"<p>The infrastructure type on which the Amazon ECS task runs.</p>",
4527+
"locationName":"launchType"
4528+
},
4529+
"ContainerUids":{
4530+
"shape":"ContainerUids",
4531+
"documentation":"<p>A list of unique identifiers for the containers associated with the Amazon ECS task.</p>",
4532+
"locationName":"containerUids"
4533+
}
4534+
},
4535+
"documentation":"<p>Contains information about Amazon ECS task involved in a GuardDuty finding, including task definition and container identifiers.</p>"
4536+
},
44094537
"EcsTaskDetails":{
44104538
"type":"structure",
44114539
"members":{
@@ -4847,7 +4975,15 @@
48474975
"ACCESS_KEY",
48484976
"EKS_CLUSTER",
48494977
"KUBERNETES_WORKLOAD",
4850-
"CONTAINER"
4978+
"CONTAINER",
4979+
"ECS_CLUSTER",
4980+
"ECS_TASK",
4981+
"AUTOSCALING_AUTO_SCALING_GROUP",
4982+
"IAM_INSTANCE_PROFILE",
4983+
"CLOUDFORMATION_STACK",
4984+
"EC2_LAUNCH_TEMPLATE",
4985+
"EC2_VPC",
4986+
"EC2_IMAGE"
48514987
]
48524988
},
48534989
"FindingStatisticType":{
@@ -6090,6 +6226,17 @@
60906226
},
60916227
"documentation":"<p>Contains information about the EC2 instance profile.</p>"
60926228
},
6229+
"IamInstanceProfileV2":{
6230+
"type":"structure",
6231+
"members":{
6232+
"Ec2InstanceUids":{
6233+
"shape":"Ec2InstanceUids",
6234+
"documentation":"<p>A list of unique identifiers for the compromised Amazon EC2 instances that share the same IAM instance profile.</p>",
6235+
"locationName":"ec2InstanceUids"
6236+
}
6237+
},
6238+
"documentation":"<p>Contains information about the IAM instance profile involved in a GuardDuty finding, including unique identifiers of the Amazon EC2 instances.</p>"
6239+
},
60936240
"ImpersonatedUser":{
60946241
"type":"structure",
60956242
"members":{
@@ -6832,6 +6979,10 @@
68326979
},
68336980
"documentation":"<p>Information about the Lambda function involved in the finding.</p>"
68346981
},
6982+
"LaunchTemplateVersion":{
6983+
"type":"string",
6984+
"max":256
6985+
},
68356986
"Lineage":{
68366987
"type":"list",
68376988
"member":{"shape":"LineageObject"}
@@ -7859,6 +8010,17 @@
78598010
},
78608011
"documentation":"<p>Contains information about the administrator account and invitation.</p>"
78618012
},
8013+
"Match":{
8014+
"type":"string",
8015+
"max":512,
8016+
"min":1
8017+
},
8018+
"Matches":{
8019+
"type":"list",
8020+
"member":{"shape":"Match"},
8021+
"max":5,
8022+
"min":1
8023+
},
78628024
"MaxResults":{
78638025
"type":"integer",
78648026
"max":50,
@@ -8295,6 +8457,17 @@
82958457
"type":"list",
82968458
"member":{"shape":"String"}
82978459
},
8460+
"NotMatch":{
8461+
"type":"string",
8462+
"max":512,
8463+
"min":1
8464+
},
8465+
"NotMatches":{
8466+
"type":"list",
8467+
"member":{"shape":"NotMatch"},
8468+
"max":5,
8469+
"min":1
8470+
},
82988471
"ObservationTexts":{
82998472
"type":"list",
83008473
"member":{"shape":"String"}
@@ -9368,6 +9541,46 @@
93689541
"shape":"ContainerFindingResource",
93699542
"documentation":"<p>Contains detailed information about the container associated with the activity that prompted GuardDuty to generate a finding.</p>",
93709543
"locationName":"container"
9544+
},
9545+
"EcsCluster":{
9546+
"shape":"EcsCluster",
9547+
"documentation":"<p>Contains detailed information about the Amazon ECS cluster associated with the activity that prompted GuardDuty to generate a finding.</p>",
9548+
"locationName":"ecsCluster"
9549+
},
9550+
"EcsTask":{
9551+
"shape":"EcsTask",
9552+
"documentation":"<p>Contains detailed information about the Amazon ECS task associated with the activity that prompted GuardDuty to generate a finding.</p>",
9553+
"locationName":"ecsTask"
9554+
},
9555+
"IamInstanceProfile":{
9556+
"shape":"IamInstanceProfileV2",
9557+
"documentation":"<p>Contains detailed information about the IAM instance profile associated with the activity that prompted GuardDuty to generate a finding.</p>",
9558+
"locationName":"iamInstanceProfile"
9559+
},
9560+
"AutoscalingAutoScalingGroup":{
9561+
"shape":"AutoscalingAutoScalingGroup",
9562+
"documentation":"<p>Contains detailed information about the Auto Scaling Group associated with the activity that prompted GuardDuty to generate a finding.</p>",
9563+
"locationName":"autoscalingAutoScalingGroup"
9564+
},
9565+
"Ec2LaunchTemplate":{
9566+
"shape":"Ec2LaunchTemplate",
9567+
"documentation":"<p>Contains detailed information about the EC2 launch template associated with the activity that prompted GuardDuty to generate a finding.</p>",
9568+
"locationName":"ec2LaunchTemplate"
9569+
},
9570+
"Ec2Vpc":{
9571+
"shape":"Ec2Vpc",
9572+
"documentation":"<p>Contains detailed information about the EC2 VPC associated with the activity that prompted GuardDuty to generate a finding.</p>",
9573+
"locationName":"ec2Vpc"
9574+
},
9575+
"Ec2Image":{
9576+
"shape":"Ec2Image",
9577+
"documentation":"<p>Contains detailed information about the EC2 Image associated with the activity that prompted GuardDuty to generate a finding.</p>",
9578+
"locationName":"ec2Image"
9579+
},
9580+
"CloudformationStack":{
9581+
"shape":"CloudformationStack",
9582+
"documentation":"<p>Contains detailed information about the CloudFormation stack associated with the activity that prompted GuardDuty to generate a finding.</p>",
9583+
"locationName":"cloudformationStack"
93719584
}
93729585
},
93739586
"documentation":"<p>Contains information about the Amazon Web Services resource that is associated with the activity that prompted GuardDuty to generate a finding.</p>"

0 commit comments

Comments
 (0)