class Aws::GuardDuty::Types::CreateFilterRequest
@note When making an API call, you may pass CreateFilterRequest
data as a hash: { detector_id: "DetectorId", # required name: "FilterName", # required description: "FilterDescription", action: "NOOP", # accepts NOOP, ARCHIVE rank: 1, finding_criteria: { # required criterion: { "String" => { eq: ["String"], neq: ["String"], gt: 1, gte: 1, lt: 1, lte: 1, equals: ["String"], not_equals: ["String"], greater_than: 1, greater_than_or_equal: 1, less_than: 1, less_than_or_equal: 1, }, }, }, client_token: "ClientToken", tags: { "TagKey" => "TagValue", }, }
@!attribute [rw] detector_id
The ID of the detector belonging to the GuardDuty account that you want to create a filter for. @return [String]
@!attribute [rw] name
The name of the filter. Minimum length of 3. Maximum length of 64. Valid characters include alphanumeric characters, dot (.), underscore (\_), and dash (-). Spaces are not allowed. @return [String]
@!attribute [rw] description
The description of the filter. @return [String]
@!attribute [rw] action
Specifies the action that is to be applied to the findings that match the filter. @return [String]
@!attribute [rw] rank
Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings. @return [Integer]
@!attribute [rw] finding_criteria
Represents the criteria to be used in the filter for querying findings. You can only use the following attributes to query findings: * accountId * region * confidence * id * resource.accessKeyDetails.accessKeyId * resource.accessKeyDetails.principalId * resource.accessKeyDetails.userName * resource.accessKeyDetails.userType * resource.instanceDetails.iamInstanceProfile.id * resource.instanceDetails.imageId * resource.instanceDetails.instanceId * resource.instanceDetails.outpostArn * resource.instanceDetails.networkInterfaces.ipv6Addresses * resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress * resource.instanceDetails.networkInterfaces.publicDnsName * resource.instanceDetails.networkInterfaces.publicIp * resource.instanceDetails.networkInterfaces.securityGroups.groupId * resource.instanceDetails.networkInterfaces.securityGroups.groupName * resource.instanceDetails.networkInterfaces.subnetId * resource.instanceDetails.networkInterfaces.vpcId * resource.instanceDetails.tags.key * resource.instanceDetails.tags.value * resource.resourceType * service.action.actionType * service.action.awsApiCallAction.api * service.action.awsApiCallAction.callerType * service.action.awsApiCallAction.errorCode * service.action.awsApiCallAction.remoteIpDetails.city.cityName * service.action.awsApiCallAction.remoteIpDetails.country.countryName * service.action.awsApiCallAction.remoteIpDetails.ipAddressV4 * service.action.awsApiCallAction.remoteIpDetails.organization.asn * service.action.awsApiCallAction.remoteIpDetails.organization.asnOrg * service.action.awsApiCallAction.serviceName * service.action.dnsRequestAction.domain * service.action.networkConnectionAction.blocked * service.action.networkConnectionAction.connectionDirection * service.action.networkConnectionAction.localPortDetails.port * service.action.networkConnectionAction.protocol * service.action.networkConnectionAction.localIpDetails.ipAddressV4 * service.action.networkConnectionAction.remoteIpDetails.city.cityName * service.action.networkConnectionAction.remoteIpDetails.country.countryName * service.action.networkConnectionAction.remoteIpDetails.ipAddressV4 * service.action.networkConnectionAction.remoteIpDetails.organization.asn * service.action.networkConnectionAction.remoteIpDetails.organization.asnOrg * service.action.networkConnectionAction.remotePortDetails.port * service.additionalInfo.threatListName * service.archived When this attribute is set to TRUE, only archived findings are listed. When it's set to FALSE, only unarchived findings are listed. When this attribute is not set, all existing findings are listed. * service.resourceRole * severity * type * updatedAt Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds. @return [Types::FindingCriteria]
@!attribute [rw] client_token
The idempotency token for the create request. **A suitable default value is auto-generated.** You should normally not need to pass this option. @return [String]
@!attribute [rw] tags
The tags to be added to a new filter resource. @return [Hash<String,String>]
@see docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/CreateFilterRequest AWS API Documentation
Constants
- SENSITIVE