Guides

GUARDDUTY

Suggest Edits
docs.aws.amazon.com
AWS documentation

AcceptAdministratorInvitation

valid {
    input.Body.administratorId == STRING
    input.Body.invitationId == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

AcceptInvitation

valid {
    input.Body.masterId == STRING
    input.Body.invitationId == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ArchiveFindings

valid {
    input.Body.findingIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateDetector

enum_DetectorFeature := [ "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING" ]
enum_FeatureAdditionalConfiguration := [ "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT" ]
enum_FeatureStatus := [ "ENABLED", "DISABLED" ]
enum_FindingPublishingFrequency := [ "FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS" ]

valid {
    input.Body.enable == BOOLEAN
    input.Body.clientToken == STRING
    input.Body.findingPublishingFrequency == enum_FindingPublishingFrequency[_]
    input.Body.dataSources.s3Logs.enable == BOOLEAN
    input.Body.dataSources.kubernetes.auditLogs.enable == BOOLEAN
    input.Body.dataSources.malwareProtection.scanEc2InstanceWithFindings.ebsVolumes == BOOLEAN
    input.Body.tags.STRING == STRING
    input.Body.features[_].name == enum_DetectorFeature[_]
    input.Body.features[_].status == enum_FeatureStatus[_]
    input.Body.features[_].additionalConfiguration[_].name == enum_FeatureAdditionalConfiguration[_]
    input.Body.features[_].additionalConfiguration[_].status == enum_FeatureStatus[_]
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateFilter

enum_FilterAction := [ "NOOP", "ARCHIVE" ]

valid {
    input.Body.name == STRING
    input.Body.description == STRING
    input.Body.action == enum_FilterAction[_]
    input.Body.rank == INTEGER
    input.Body.findingCriteria.criterion.STRING.eq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.neq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.gt == INTEGER
    input.Body.findingCriteria.criterion.STRING.gte == INTEGER
    input.Body.findingCriteria.criterion.STRING.lt == INTEGER
    input.Body.findingCriteria.criterion.STRING.lte == INTEGER
    input.Body.findingCriteria.criterion.STRING.equals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.notEquals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.greaterThan == LONG
    input.Body.findingCriteria.criterion.STRING.greaterThanOrEqual == LONG
    input.Body.findingCriteria.criterion.STRING.lessThan == LONG
    input.Body.findingCriteria.criterion.STRING.lessThanOrEqual == LONG
    input.Body.clientToken == STRING
    input.Body.tags.STRING == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateIPSet

enum_IpSetFormat := [ "TXT", "STIX", "OTX_CSV", "ALIEN_VAULT", "PROOF_POINT", "FIRE_EYE" ]

valid {
    input.Body.name == STRING
    input.Body.format == enum_IpSetFormat[_]
    input.Body.location == STRING
    input.Body.activate == BOOLEAN
    input.Body.clientToken == STRING
    input.Body.tags.STRING == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateMalwareProtectionPlan

enum_MalwareProtectionPlanTaggingActionStatus := [ "ENABLED", "DISABLED" ]

valid {
    input.Body.clientToken == STRING
    input.Body.role == STRING
    input.Body.protectedResource.s3Bucket.bucketName == STRING
    input.Body.protectedResource.s3Bucket.objectPrefixes[_] == STRING
    input.Body.actions.tagging.status == enum_MalwareProtectionPlanTaggingActionStatus[_]
    input.Body.tags.STRING == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateMembers

valid {
    input.Body.accountDetails[_].accountId == STRING
    input.Body.accountDetails[_].email == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreatePublishingDestination

enum_DestinationType := [ "S3" ]

valid {
    input.Body.destinationType == enum_DestinationType[_]
    input.Body.destinationProperties.destinationArn == STRING
    input.Body.destinationProperties.kmsKeyArn == STRING
    input.Body.clientToken == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateSampleFindings

valid {
    input.Body.findingTypes[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

CreateThreatIntelSet

enum_ThreatIntelSetFormat := [ "TXT", "STIX", "OTX_CSV", "ALIEN_VAULT", "PROOF_POINT", "FIRE_EYE" ]

valid {
    input.Body.name == STRING
    input.Body.format == enum_ThreatIntelSetFormat[_]
    input.Body.location == STRING
    input.Body.activate == BOOLEAN
    input.Body.clientToken == STRING
    input.Body.tags.STRING == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeclineInvitations

valid {
    input.Body.accountIds[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteDetector

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteFilter

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.filterName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteIPSet

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.ipSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteInvitations

valid {
    input.Body.accountIds[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteMalwareProtectionPlan

valid {
    input.ReqMap.malwareProtectionPlanId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteMembers

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeletePublishingDestination

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.destinationId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DeleteThreatIntelSet

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.threatIntelSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeMalwareScans

enum_CriterionKey := [ "EC2_INSTANCE_ARN", "SCAN_ID", "ACCOUNT_ID", "GUARDDUTY_FINDING_ID", "SCAN_START_TIME", "SCAN_STATUS", "SCAN_TYPE" ]
enum_OrderBy := [ "ASC", "DESC" ]

valid {
    input.Body.nextToken == STRING
    input.Body.maxResults == INTEGER
    input.Body.filterCriteria.filterCriterion[_].criterionKey == enum_CriterionKey[_]
    input.Body.filterCriteria.filterCriterion[_].filterCondition.equalsValue == STRING
    input.Body.filterCriteria.filterCriterion[_].filterCondition.greaterThan == LONG
    input.Body.filterCriteria.filterCriterion[_].filterCondition.lessThan == LONG
    input.Body.sortCriteria.attributeName == STRING
    input.Body.sortCriteria.orderBy == enum_OrderBy[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribeOrganizationConfiguration

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DescribePublishingDestination

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.destinationId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DisableOrganizationAdminAccount

valid {
    input.Body.adminAccountId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DisassociateFromAdministratorAccount

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DisassociateFromMasterAccount

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

DisassociateMembers

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

EnableOrganizationAdminAccount

valid {
    input.Body.adminAccountId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetAdministratorAccount

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetCoverageStatistics

enum_CoverageFilterCriterionKey := [ "ACCOUNT_ID", "CLUSTER_NAME", "RESOURCE_TYPE", "COVERAGE_STATUS", "ADDON_VERSION", "MANAGEMENT_TYPE", "EKS_CLUSTER_NAME", "ECS_CLUSTER_NAME", "AGENT_VERSION", "INSTANCE_ID", "CLUSTER_ARN" ]
enum_CoverageStatisticsType := [ "COUNT_BY_RESOURCE_TYPE", "COUNT_BY_COVERAGE_STATUS" ]

valid {
    input.Body.filterCriteria.filterCriterion[_].criterionKey == enum_CoverageFilterCriterionKey[_]
    input.Body.filterCriteria.filterCriterion[_].filterCondition.equals[_] == STRING
    input.Body.filterCriteria.filterCriterion[_].filterCondition.notEquals[_] == STRING
    input.Body.statisticsType[_] == enum_CoverageStatisticsType[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetDetector

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetFilter

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.filterName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetFindings

enum_OrderBy := [ "ASC", "DESC" ]

valid {
    input.Body.findingIds[_] == STRING
    input.Body.sortCriteria.attributeName == STRING
    input.Body.sortCriteria.orderBy == enum_OrderBy[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetFindingsStatistics

enum_FindingStatisticType := [ "COUNT_BY_SEVERITY" ]
enum_GroupByType := [ "ACCOUNT", "DATE", "FINDING_TYPE", "RESOURCE", "SEVERITY" ]
enum_OrderBy := [ "ASC", "DESC" ]

valid {
    input.Body.findingStatisticTypes[_] == enum_FindingStatisticType[_]
    input.Body.findingCriteria.criterion.STRING.eq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.neq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.gt == INTEGER
    input.Body.findingCriteria.criterion.STRING.gte == INTEGER
    input.Body.findingCriteria.criterion.STRING.lt == INTEGER
    input.Body.findingCriteria.criterion.STRING.lte == INTEGER
    input.Body.findingCriteria.criterion.STRING.equals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.notEquals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.greaterThan == LONG
    input.Body.findingCriteria.criterion.STRING.greaterThanOrEqual == LONG
    input.Body.findingCriteria.criterion.STRING.lessThan == LONG
    input.Body.findingCriteria.criterion.STRING.lessThanOrEqual == LONG
    input.Body.groupBy == enum_GroupByType[_]
    input.Body.orderBy == enum_OrderBy[_]
    input.Body.maxResults == INTEGER
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetIPSet

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.ipSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetInvitationsCount

valid {
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetMalwareProtectionPlan

valid {
    input.ReqMap.malwareProtectionPlanId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetMalwareScanSettings

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetMasterAccount

valid {
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetMemberDetectors

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetMembers

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetOrganizationStatistics

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetRemainingFreeTrialDays

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetThreatIntelSet

valid {
    input.ReqMap.detectorId == STRING
    input.ReqMap.threatIntelSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

GetUsageStatistics

enum_DataSource := [ "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_LOGS", "KUBERNETES_AUDIT_LOGS", "EC2_MALWARE_SCAN" ]
enum_UsageFeature := [ "FLOW_LOGS", "CLOUD_TRAIL", "DNS_LOGS", "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "LAMBDA_NETWORK_LOGS", "EKS_RUNTIME_MONITORING", "FARGATE_RUNTIME_MONITORING", "EC2_RUNTIME_MONITORING", "RDS_DBI_PROTECTION_PROVISIONED", "RDS_DBI_PROTECTION_SERVERLESS" ]
enum_UsageStatisticType := [ "SUM_BY_ACCOUNT", "SUM_BY_DATA_SOURCE", "SUM_BY_RESOURCE", "TOP_RESOURCES", "SUM_BY_FEATURES", "TOP_ACCOUNTS_BY_FEATURE" ]

valid {
    input.Body.usageStatisticsType == enum_UsageStatisticType[_]
    input.Body.usageCriteria.accountIds[_] == STRING
    input.Body.usageCriteria.dataSources[_] == enum_DataSource[_]
    input.Body.usageCriteria.resources[_] == STRING
    input.Body.usageCriteria.features[_] == enum_UsageFeature[_]
    input.Body.unit == STRING
    input.Body.maxResults == INTEGER
    input.Body.nextToken == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

InviteMembers

valid {
    input.Body.accountIds[_] == STRING
    input.Body.disableEmailNotification == BOOLEAN
    input.Body.message == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListCoverage

enum_CoverageFilterCriterionKey := [ "ACCOUNT_ID", "CLUSTER_NAME", "RESOURCE_TYPE", "COVERAGE_STATUS", "ADDON_VERSION", "MANAGEMENT_TYPE", "EKS_CLUSTER_NAME", "ECS_CLUSTER_NAME", "AGENT_VERSION", "INSTANCE_ID", "CLUSTER_ARN" ]
enum_CoverageSortKey := [ "ACCOUNT_ID", "CLUSTER_NAME", "COVERAGE_STATUS", "ISSUE", "ADDON_VERSION", "UPDATED_AT", "EKS_CLUSTER_NAME", "ECS_CLUSTER_NAME", "INSTANCE_ID" ]
enum_OrderBy := [ "ASC", "DESC" ]

valid {
    input.Body.nextToken == STRING
    input.Body.maxResults == INTEGER
    input.Body.filterCriteria.filterCriterion[_].criterionKey == enum_CoverageFilterCriterionKey[_]
    input.Body.filterCriteria.filterCriterion[_].filterCondition.equals[_] == STRING
    input.Body.filterCriteria.filterCriterion[_].filterCondition.notEquals[_] == STRING
    input.Body.sortCriteria.attributeName == enum_CoverageSortKey[_]
    input.Body.sortCriteria.orderBy == enum_OrderBy[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListDetectors

valid {
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListFilters

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListFindings

enum_OrderBy := [ "ASC", "DESC" ]

valid {
    input.Body.findingCriteria.criterion.STRING.eq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.neq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.gt == INTEGER
    input.Body.findingCriteria.criterion.STRING.gte == INTEGER
    input.Body.findingCriteria.criterion.STRING.lt == INTEGER
    input.Body.findingCriteria.criterion.STRING.lte == INTEGER
    input.Body.findingCriteria.criterion.STRING.equals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.notEquals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.greaterThan == LONG
    input.Body.findingCriteria.criterion.STRING.greaterThanOrEqual == LONG
    input.Body.findingCriteria.criterion.STRING.lessThan == LONG
    input.Body.findingCriteria.criterion.STRING.lessThanOrEqual == LONG
    input.Body.sortCriteria.attributeName == STRING
    input.Body.sortCriteria.orderBy == enum_OrderBy[_]
    input.Body.maxResults == INTEGER
    input.Body.nextToken == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListIPSets

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListInvitations

valid {
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListMalwareProtectionPlans

valid {
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListMembers

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.Qs.onlyAssociated == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListOrganizationAdminAccounts

valid {
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListPublishingDestinations

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListTagsForResource

valid {
    input.ReqMap.resourceArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

ListThreatIntelSets

valid {
    input.ReqMap.detectorId == STRING
    input.Qs.maxResults == INTEGER
    input.Qs.nextToken == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StartMalwareScan

valid {
    input.Body.resourceArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StartMonitoringMembers

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

StopMonitoringMembers

valid {
    input.Body.accountIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

TagResource

valid {
    input.Body.tags.STRING == STRING
    input.ReqMap.resourceArn == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UnarchiveFindings

valid {
    input.Body.findingIds[_] == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UntagResource

valid {
    input.ReqMap.resourceArn == STRING
    input.Qs.tagKeys[_] == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateDetector

enum_DetectorFeature := [ "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING" ]
enum_FeatureAdditionalConfiguration := [ "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT" ]
enum_FeatureStatus := [ "ENABLED", "DISABLED" ]
enum_FindingPublishingFrequency := [ "FIFTEEN_MINUTES", "ONE_HOUR", "SIX_HOURS" ]

valid {
    input.Body.enable == BOOLEAN
    input.Body.findingPublishingFrequency == enum_FindingPublishingFrequency[_]
    input.Body.dataSources.s3Logs.enable == BOOLEAN
    input.Body.dataSources.kubernetes.auditLogs.enable == BOOLEAN
    input.Body.dataSources.malwareProtection.scanEc2InstanceWithFindings.ebsVolumes == BOOLEAN
    input.Body.features[_].name == enum_DetectorFeature[_]
    input.Body.features[_].status == enum_FeatureStatus[_]
    input.Body.features[_].additionalConfiguration[_].name == enum_FeatureAdditionalConfiguration[_]
    input.Body.features[_].additionalConfiguration[_].status == enum_FeatureStatus[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateFilter

enum_FilterAction := [ "NOOP", "ARCHIVE" ]

valid {
    input.Body.description == STRING
    input.Body.action == enum_FilterAction[_]
    input.Body.rank == INTEGER
    input.Body.findingCriteria.criterion.STRING.eq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.neq[_] == STRING
    input.Body.findingCriteria.criterion.STRING.gt == INTEGER
    input.Body.findingCriteria.criterion.STRING.gte == INTEGER
    input.Body.findingCriteria.criterion.STRING.lt == INTEGER
    input.Body.findingCriteria.criterion.STRING.lte == INTEGER
    input.Body.findingCriteria.criterion.STRING.equals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.notEquals[_] == STRING
    input.Body.findingCriteria.criterion.STRING.greaterThan == LONG
    input.Body.findingCriteria.criterion.STRING.greaterThanOrEqual == LONG
    input.Body.findingCriteria.criterion.STRING.lessThan == LONG
    input.Body.findingCriteria.criterion.STRING.lessThanOrEqual == LONG
    input.ReqMap.detectorId == STRING
    input.ReqMap.filterName == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateFindingsFeedback

enum_Feedback := [ "USEFUL", "NOT_USEFUL" ]

valid {
    input.Body.findingIds[_] == STRING
    input.Body.feedback == enum_Feedback[_]
    input.Body.comments == STRING
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateIPSet

valid {
    input.Body.name == STRING
    input.Body.location == STRING
    input.Body.activate == BOOLEAN
    input.ReqMap.detectorId == STRING
    input.ReqMap.ipSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateMalwareProtectionPlan

enum_MalwareProtectionPlanTaggingActionStatus := [ "ENABLED", "DISABLED" ]

valid {
    input.Body.role == STRING
    input.Body.actions.tagging.status == enum_MalwareProtectionPlanTaggingActionStatus[_]
    input.Body.protectedResource.s3Bucket.objectPrefixes[_] == STRING
    input.ReqMap.malwareProtectionPlanId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateMalwareScanSettings

enum_EbsSnapshotPreservation := [ "NO_RETENTION", "RETENTION_WITH_FINDING" ]

valid {
    input.Body.scanResourceCriteria.include.EC2_INSTANCE_TAG.mapEquals[_].key == STRING
    input.Body.scanResourceCriteria.include.EC2_INSTANCE_TAG.mapEquals[_].value == STRING
    input.Body.scanResourceCriteria.exclude.EC2_INSTANCE_TAG.mapEquals[_].key == STRING
    input.Body.scanResourceCriteria.exclude.EC2_INSTANCE_TAG.mapEquals[_].value == STRING
    input.Body.ebsSnapshotPreservation == enum_EbsSnapshotPreservation[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateMemberDetectors

enum_FeatureStatus := [ "ENABLED", "DISABLED" ]
enum_OrgFeature := [ "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING" ]
enum_OrgFeatureAdditionalConfiguration := [ "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT" ]

valid {
    input.Body.accountIds[_] == STRING
    input.Body.dataSources.s3Logs.enable == BOOLEAN
    input.Body.dataSources.kubernetes.auditLogs.enable == BOOLEAN
    input.Body.dataSources.malwareProtection.scanEc2InstanceWithFindings.ebsVolumes == BOOLEAN
    input.Body.features[_].name == enum_OrgFeature[_]
    input.Body.features[_].status == enum_FeatureStatus[_]
    input.Body.features[_].additionalConfiguration[_].name == enum_OrgFeatureAdditionalConfiguration[_]
    input.Body.features[_].additionalConfiguration[_].status == enum_FeatureStatus[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateOrganizationConfiguration

enum_AutoEnableMembers := [ "NEW", "ALL", "NONE" ]
enum_OrgFeature := [ "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION", "RDS_LOGIN_EVENTS", "EKS_RUNTIME_MONITORING", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING" ]
enum_OrgFeatureAdditionalConfiguration := [ "EKS_ADDON_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EC2_AGENT_MANAGEMENT" ]
enum_OrgFeatureStatus := [ "NEW", "NONE", "ALL" ]

valid {
    input.Body.autoEnable == BOOLEAN
    input.Body.dataSources.s3Logs.autoEnable == BOOLEAN
    input.Body.dataSources.kubernetes.auditLogs.autoEnable == BOOLEAN
    input.Body.dataSources.malwareProtection.scanEc2InstanceWithFindings.ebsVolumes.autoEnable == BOOLEAN
    input.Body.features[_].name == enum_OrgFeature[_]
    input.Body.features[_].autoEnable == enum_OrgFeatureStatus[_]
    input.Body.features[_].additionalConfiguration[_].name == enum_OrgFeatureAdditionalConfiguration[_]
    input.Body.features[_].additionalConfiguration[_].autoEnable == enum_OrgFeatureStatus[_]
    input.Body.autoEnableOrganizationMembers == enum_AutoEnableMembers[_]
    input.ReqMap.detectorId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdatePublishingDestination

valid {
    input.Body.destinationProperties.destinationArn == STRING
    input.Body.destinationProperties.kmsKeyArn == STRING
    input.ReqMap.detectorId == STRING
    input.ReqMap.destinationId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

UpdateThreatIntelSet

valid {
    input.Body.name == STRING
    input.Body.location == STRING
    input.Body.activate == BOOLEAN
    input.ReqMap.detectorId == STRING
    input.ReqMap.threatIntelSetId == STRING
    input.ProviderMetadata.Account == STRING
    input.ProviderMetadata.AccessKeyId == STRING
    input.ProviderMetadata.Region == STRING
}

Updated 23 days ago