AWS::GuardDuty::ThreatIntelSet - AWS CloudFormation

AWS::GuardDuty::ThreatIntelSet

The AWS::GuardDuty::ThreatIntelSet resource specifies a new ThreatIntelSet. A ThreatIntelSet consists of known malicious IP addresses. GuardDuty generates findings based on the ThreatIntelSet when it is activated.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::GuardDuty::ThreatIntelSet", "Properties" : { "Activate" : Boolean, "DetectorId" : String, "Format" : String, "Location" : String, "Name" : String } }

YAML

Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: Boolean DetectorId: String Format: String Location: String Name: String

Properties

Activate

Specifies whether or not GuardDuty uses the ThreatIntelSet.

Required: Yes

Type: Boolean

Update requires: No interruption

DetectorId

The ID of the detector to associate the ThreatIntelSet with.

Required: Yes

Type: String

Update requires: Replacement

Format

The format of the file that contains the ThreatIntelSet.

Required: Yes

Type: String

Update requires: Replacement

Location

The URI of the file that contains the ThreatIntelSet.

Required: Yes

Type: String

Update requires: No interruption

Name

A name for the ThreatIntelSet. The name is displayed in all finding generated by activity associated with the IP addresses included in this ThreatIntelSet.

Required: No

Type: String

Update requires: No interruption

Return Values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the unique ID of the ThreatIntelSet.

For more information about using the Ref function, see Ref.

Examples

Declare a ThreatIntelSet Resource

The following example shows how to declare a GuardDuty ThreatIntelSet resource:

JSON

"mythreatintelset": { "Type": "AWS::GuardDuty::ThreatIntelSet", "Properties": { "Activate": true, "DetectorId": "12abc34d567e8f4912ab3d45e67891f2", "Format": "TXT", "Location": "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt", "Name": "MyThreatIntelSet" } }

YAML

mythreatintelset: Type: AWS::GuardDuty::ThreatIntelSet Properties: Activate: true DetectorId: "12abc34d567e8f4912ab3d45e67891f2" Format: "TXT" Location: "https://s3-us-west-2.amazonaws.com/mybucket/mythreatintelset.txt" Name: "MyThreatIntelSet"