ListThreatIntelSets - Amazon GuardDuty


Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.

Request Syntax

GET /detector/detectorId/threatintelset?maxResults=MaxResults&nextToken=NextToken HTTP/1.1

URI Request Parameters

The request uses the following URI parameters.


The unique ID of the detector that the threatIntelSet is associated with.

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes


You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.

Valid Range: Minimum value of 1. Maximum value of 50.


You can use this parameter to paginate results in the response. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

Request Body

The request does not have a request body.

Response Syntax

HTTP/1.1 200 Content-type: application/json { "nextToken": "string", "threatIntelSetIds": [ "string" ] }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


The pagination parameter to be used on the next list operation to retrieve more items.

Type: String


The IDs of the ThreatIntelSet resources.

Type: Array of strings

Array Members: Minimum number of 0 items. Maximum number of 50 items.


For information about the errors that are common to all actions, see Common Errors.


A bad request exception object.

HTTP Status Code: 400


An internal server error exception object.

HTTP Status Code: 500

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: