To learn more, visit the AWS documentation.

​
Basic Parameters​

ParameterDescription
AWS Region(s)Enter the desired AWS Region(s).To execute the action in multiple regions, provide a comma-separated list.For example: us-east-1,eu-west-2.If you wish to run the action in all available regions, use the asterisk symbol (*) instead.
Detector IDThe ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
Finding IDsA comma-separated list of finding IDs you want to retrieve.

​
Advanced Parameters​

ParameterDescription
Disable XML To JSON Auto ConvertWhen checked, XML responses are not automatically converted into JSON format.
Order ByThe order by which the sorted findings are to be displayed.
Sort ByRepresents the finding attribute (for example, accountId) to sort findings by.

​
Example Output​

{    "Findings": [        {            "AccountId": "string",            "Arn": "string",            "Confidence": 0,            "CreatedAt": "string",            "Description": "string",            "Id": "string",            "Partition": "string",            "Region": "string",            "Resource": {                "AccessKeyDetails": {                    "AccessKeyId": "string",                    "PrincipalId": "string",                    "UserName": "string",                    "UserType": "string"                },                "InstanceDetails": {                    "AvailabilityZone": "string",                    "IamInstanceProfile": {                        "Arn": "string",                        "Id": "string"                    },                    "ImageDescription": "string",                    "ImageId": "string",                    "InstanceId": "string",                    "InstanceState": "string",                    "InstanceType": "string",                    "LaunchTime": "string",                    "NetworkInterfaces": [                        {                            "Ipv6Addresses": [                                "string"                            ],                            "NetworkInterfaceId": "string",                            "PrivateDnsName": "string",                            "PrivateIpAddress": "string",                            "PrivateIpAddresses": [                                {                                    "PrivateDnsName": "string",                                    "PrivateIpAddress": "string"                                }                            ],                            "PublicDnsName": "string",                            "PublicIp": "string",                            "SecurityGroups": [                                {                                    "GroupId": "string",                                    "GroupName": "string"                                }                            ],                            "SubnetId": "string",                            "VpcId": "string"                        }                    ],                    "OutpostArn": "string",                    "Platform": "string",                    "ProductCodes": [                        {                            "Code": "string",                            "ProductType": "string"                        }                    ],                    "Tags": [                        {                            "Key": "string",                            "Value": "string"                        }                    ]                },                "ResourceType": "string",                "S3BucketDetails": [                    {                        "Arn": "string",                        "CreatedAt": "date-time",                        "DefaultServerSideEncryption": {                            "EncryptionType": "string",                            "KmsMasterKeyArn": "string"                        },                        "Name": "string",                        "Owner": {                            "Id": "string"                        },                        "PublicAccess": {                            "EffectivePermission": "string",                            "PermissionConfiguration": {                                "AccountLevelPermissions": {                                    "BlockPublicAccess": {                                        "BlockPublicAcls": false,                                        "BlockPublicPolicy": false,                                        "IgnorePublicAcls": false,                                        "RestrictPublicBuckets": false                                    }                                },                                "BucketLevelPermissions": {                                    "AccessControlList": {                                        "AllowsPublicReadAccess": false,                                        "AllowsPublicWriteAccess": false                                    },                                    "BlockPublicAccess": {                                        "BlockPublicAcls": false,                                        "BlockPublicPolicy": false,                                        "IgnorePublicAcls": false,                                        "RestrictPublicBuckets": false                                    },                                    "BucketPolicy": {                                        "AllowsPublicReadAccess": false,                                        "AllowsPublicWriteAccess": false                                    }                                }                            }                        },                        "Tags": [                            {                                "Key": "string",                                "Value": "string"                            }                        ],                        "Type": "string"                    }                ]            },            "SchemaVersion": "string",            "Service": {                "Action": {                    "ActionType": "string",                    "AwsApiCallAction": {                        "Api": "string",                        "CallerType": "string",                        "DomainDetails": {                            "Domain": "string"                        },                        "ErrorCode": "string",                        "RemoteIpDetails": {                            "City": {                                "CityName": "string"                            },                            "Country": {                                "CountryCode": "string",                                "CountryName": "string"                            },                            "GeoLocation": {                                "Lat": 0,                                "Lon": 0                            },                            "IpAddressV4": "string",                            "Organization": {                                "Asn": "string",                                "AsnOrg": "string",                                "Isp": "string",                                "Org": "string"                            }                        },                        "ServiceName": "string"                    },                    "DnsRequestAction": {                        "Domain": "string"                    },                    "NetworkConnectionAction": {                        "Blocked": false,                        "ConnectionDirection": "string",                        "LocalIpDetails": {                            "IpAddressV4": "string"                        },                        "LocalPortDetails": {                            "Port": 0,                            "PortName": "string"                        },                        "Protocol": "string",                        "RemoteIpDetails": {                            "City": {                                "CityName": "string"                            },                            "Country": {                                "CountryCode": "string",                                "CountryName": "string"                            },                            "GeoLocation": {                                "Lat": 0,                                "Lon": 0                            },                            "IpAddressV4": "string",                            "Organization": {                                "Asn": "string",                                "AsnOrg": "string",                                "Isp": "string",                                "Org": "string"                            }                        },                        "RemotePortDetails": {                            "Port": 0,                            "PortName": "string"                        }                    },                    "PortProbeAction": {                        "Blocked": false,                        "PortProbeDetails": [                            {                                "LocalIpDetails": {                                    "IpAddressV4": "string"                                },                                "LocalPortDetails": {                                    "Port": 0,                                    "PortName": "string"                                },                                "RemoteIpDetails": {                                    "City": {                                        "CityName": "string"                                    },                                    "Country": {                                        "CountryCode": "string",                                        "CountryName": "string"                                    },                                    "GeoLocation": {                                        "Lat": 0,                                        "Lon": 0                                    },                                    "IpAddressV4": "string",                                    "Organization": {                                        "Asn": "string",                                        "AsnOrg": "string",                                        "Isp": "string",                                        "Org": "string"                                    }                                }                            }                        ]                    }                },                "Archived": false,                "Count": 0,                "DetectorId": "string",                "EventFirstSeen": "string",                "EventLastSeen": "string",                "Evidence": {                    "ThreatIntelligenceDetails": [                        {                            "ThreatListName": "string",                            "ThreatNames": [                                "string"                            ]                        }                    ]                },                "ResourceRole": "string",                "ServiceName": "string",                "UserFeedback": "string"            },            "Severity": 0,            "Title": "string",            "Type": "string",            "UpdatedAt": "string"        }    ]}

​
Workflow Library Example​

Guardduty Get Findings with Aws and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

GuardDuty Get DetectorGuardDuty Invite Members