AwsGuardDuty 資源 ASFF

以下是 AWS AwsGuardDuty資源的安全性發現格式 (ASFF) 語法。

AWS Security Hub 將來自各種來源的發現正常化為ASFF. 如需有關的背景資訊ASFF，請參閱AWS 安全性發現格式 (ASFF)。

AwsGuardDutyDetector

該AwsGuardDutyDetector對象提供有關 Amazon GuardDuty 檢測器的信息。檢測器是代表 GuardDuty 服務的對象。需要一個檢測器才 GuardDuty 能成為可操作。

下面的例子顯示 AWS AwsGuardDutyDetector物件的安全性發現格式 (ASFF)。若要檢視AwsGuardDutyDetector屬性的描述，請參閱AwsGuardDutyDetector中的 AWS Security Hub API參考。

範例

"AwsGuardDutyDetector": {
    "FindingPublishingFrequency": "SIX_HOURS",
    "ServiceRole": "arn:aws:iam::123456789012:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
    "Status": "ENABLED",
    "DataSources": {
        "CloudTrail": {
            "Status": "ENABLED"
        },
        "DnsLogs": {
            "Status": "ENABLED"
        },
        "FlowLogs": {
            "Status": "ENABLED"
        },
        "S3Logs": {
             "Status": "ENABLED"
         },
         "Kubernetes": {
             "AuditLogs": {
                "Status": "ENABLED"
             }
         },
         "MalwareProtection": {
             "ScanEc2InstanceWithFindings": {
                "EbsVolumes": {
                    "Status": "ENABLED"
                 }
             },
            "ServiceRole": "arn:aws:iam::123456789012:role/aws-service-role/malware-protection.guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDutyMalwareProtection"
         }
    }
}