UpdateDetector - Amazon GuardDuty
Request SyntaxURI Request ParametersRequest BodyResponse SyntaxResponse ElementsErrorsSee Also

UpdateDetector

Updates the GuardDuty detector specified by the detector ID.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the AWS Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Request Syntax

POST /detector/detectorId HTTP/1.1
Content-type: application/json

{
   "dataSources": { 
      "kubernetes": { 
         "auditLogs": { 
            "enable": boolean
         }
      },
      "malwareProtection": { 
         "scanEc2InstanceWithFindings": { 
            "ebsVolumes": boolean
         }
      },
      "s3Logs": { 
         "enable": boolean
      }
   },
   "enable": boolean,
   "features": [ 
      { 
         "additionalConfiguration": [ 
            { 
               "name": "string",
               "status": "string"
            }
         ],
         "name": "string",
         "status": "string"
      }
   ],
   "findingPublishingFrequency": "string"
}

URI Request Parameters

The request uses the following URI parameters.

detectorId

The unique ID of the detector to update.

To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.

Length Constraints: Minimum length of 1. Maximum length of 300.

Required: Yes

Request Body

The request accepts the following data in JSON format.

dataSources

This parameter has been deprecated.

Describes which data sources will be updated.

There might be regional differences because some data sources might not be available in all the AWS Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Type: DataSourceConfigurations object

Required: No

enable

Specifies whether the detector is enabled or not enabled.

Type: Boolean

Required: No

features

Provides the features that will be updated for the detector.

Type: Array of DetectorFeatureConfiguration objects

Required: No

findingPublishingFrequency

An enum value that specifies how frequently findings are exported, such as to CloudWatch Events.

Type: String

Valid Values: FIFTEEN_MINUTES | ONE_HOUR | SIX_HOURS

Required: No

Response Syntax

HTTP/1.1 200

Response Elements

If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.

Errors

For information about the errors that are common to all actions, see Common Errors.

BadRequestException

A bad request exception object.

HTTP Status Code: 400

InternalServerErrorException

An internal server error exception object.

HTTP Status Code: 500

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: