AWS::GuardDuty::ThreatIntelSet - AWS CloudFormation

AWS::GuardDuty::ThreatIntelSet

The AWS::GuardDuty::ThreatIntelSet resource specifies a new ThreatIntelSet. A ThreatIntelSet consists of known malicious IP addresses. GuardDuty generates findings based on the ThreatIntelSet when it is activated.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::GuardDuty::ThreatIntelSet", "Properties" : { "Activate" : Boolean, "DetectorId" : String, "Format" : String, "Location" : String, "Name" : String } }

YAML

Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: Boolean DetectorId: String Format: String Location: String Name: String

Properties

Activate

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

Required: Yes

Type: Boolean

Update requires: No interruption

DetectorId

The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.

Required: Yes

Type: String

Minimum: 1

Maximum: 300

Update requires: Replacement

Format

The format of the file that contains the ThreatIntelSet.

Required: Yes

Type: String

Allowed values: ALIEN_VAULT | FIRE_EYE | OTX_CSV | PROOF_POINT | STIX | TXT

Update requires: Replacement

Location

The URI of the file that contains the ThreatIntelSet. For example: https://s3.us-west-2.amazonaws.com/my-bucket/my-object-key.

Required: Yes

Type: String

Minimum: 1

Maximum: 300

Update requires: No interruption

Name

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

Required: No

Type: String

Minimum: 1

Maximum: 300

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the unique ID of the ThreatIntelSet.

For more information about using the Ref function, see Ref.

Examples

Declare a ThreatIntelSet Resource

The following example shows how to declare a GuardDuty ThreatIntelSet resource:

JSON

"mythreatintelset": { "Type": "AWS::GuardDuty::ThreatIntelSet", "Properties": { "Activate": true, "DetectorId": "12abc34d567e8f4912ab3d45e67891f2", "Format": "TXT", "Location": "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt", "Name": "MyThreatIntelSet" } }

YAML

mythreatintelset: Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: true DetectorId: "12abc34d567e8f4912ab3d45e67891f2" Format: "TXT" Location: "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt" Name: "MyThreatIntelSet"