CreateThreatIntelSet
Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.
Request Syntax
POST /detector/detectorId/threatintelset HTTP/1.1
Content-type: application/json
{
"activate": boolean,
"clientToken": "string",
"format": "string",
"location": "string",
"name": "string",
"tags": {
"string" : "string"
}
}URI Request Parameters
The request uses the following URI parameters.
- detectorId
-
The unique ID of the detector of the GuardDuty account for which you want to create a
ThreatIntelSet.To find the
detectorIdin the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.Length Constraints: Minimum length of 1. Maximum length of 300.
Required: Yes
Request Body
The request accepts the following data in JSON format.
- activate
-
A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
Type: Boolean
Required: Yes
- clientToken
-
The idempotency token for the create request.
Type: String
Length Constraints: Minimum length of 0. Maximum length of 64.
Required: No
- format
-
The format of the file that contains the ThreatIntelSet.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 300.
Valid Values:
TXT | STIX | OTX_CSV | ALIEN_VAULT | PROOF_POINT | FIRE_EYERequired: Yes
- location
-
The URI of the file that contains the ThreatIntelSet.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 300.
Required: Yes
- name
-
A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 300.
Required: Yes
-
The tags to be added to a new threat list resource.
Type: String to string map
Map Entries: Maximum number of 200 items.
Key Length Constraints: Minimum length of 1. Maximum length of 128.
Key Pattern:
^(?!aws:)[a-zA-Z+-=._:/]+$Value Length Constraints: Maximum length of 256.
Required: No
Response Syntax
HTTP/1.1 200
Content-type: application/json
{
"threatIntelSetId": "string"
}Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- threatIntelSetId
-
The ID of the ThreatIntelSet resource.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors.
- BadRequestException
-
A bad request exception object.
HTTP Status Code: 400
- InternalServerErrorException
-
An internal server error exception object.
HTTP Status Code: 500
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
