Describes Amazon GuardDuty findings specified by finding IDs.

External Documentation

To learn more, visit the AWS documentation.

​
Basic Parameters

ParameterDescription
AWS Region(s)Enter the desired AWS Region(s).

To execute the action in multiple regions, provide a comma-separated list.
For example: us-east-1,eu-west-2.

If you wish to run the action in all available regions, use the asterisk symbol (*) instead.
Detector IDThe ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
Finding IDsA comma-separated list of finding IDs you want to retrieve.

​
Advanced Parameters

ParameterDescription
Disable XML To JSON Auto ConvertWhen checked, XML responses are not automatically converted into JSON format.
Order ByThe order by which the sorted findings are to be displayed.
Sort ByRepresents the finding attribute (for example, accountId) to sort findings by.

​
Example Output

{
	"Findings": [
		{
			"AccountId": "string",
			"Arn": "string",
			"Confidence": 0,
			"CreatedAt": "string",
			"Description": "string",
			"Id": "string",
			"Partition": "string",
			"Region": "string",
			"Resource": {
				"AccessKeyDetails": {
					"AccessKeyId": "string",
					"PrincipalId": "string",
					"UserName": "string",
					"UserType": "string"
				},
				"InstanceDetails": {
					"AvailabilityZone": "string",
					"IamInstanceProfile": {
						"Arn": "string",
						"Id": "string"
					},
					"ImageDescription": "string",
					"ImageId": "string",
					"InstanceId": "string",
					"InstanceState": "string",
					"InstanceType": "string",
					"LaunchTime": "string",
					"NetworkInterfaces": [
						{
							"Ipv6Addresses": [
								"string"
							],
							"NetworkInterfaceId": "string",
							"PrivateDnsName": "string",
							"PrivateIpAddress": "string",
							"PrivateIpAddresses": [
								{
									"PrivateDnsName": "string",
									"PrivateIpAddress": "string"
								}
							],
							"PublicDnsName": "string",
							"PublicIp": "string",
							"SecurityGroups": [
								{
									"GroupId": "string",
									"GroupName": "string"
								}
							],
							"SubnetId": "string",
							"VpcId": "string"
						}
					],
					"OutpostArn": "string",
					"Platform": "string",
					"ProductCodes": [
						{
							"Code": "string",
							"ProductType": "string"
						}
					],
					"Tags": [
						{
							"Key": "string",
							"Value": "string"
						}
					]
				},
				"ResourceType": "string",
				"S3BucketDetails": [
					{
						"Arn": "string",
						"CreatedAt": "date-time",
						"DefaultServerSideEncryption": {
							"EncryptionType": "string",
							"KmsMasterKeyArn": "string"
						},
						"Name": "string",
						"Owner": {
							"Id": "string"
						},
						"PublicAccess": {
							"EffectivePermission": "string",
							"PermissionConfiguration": {
								"AccountLevelPermissions": {
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									}
								},
								"BucketLevelPermissions": {
									"AccessControlList": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									},
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									},
									"BucketPolicy": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									}
								}
							}
						},
						"Tags": [
							{
								"Key": "string",
								"Value": "string"
							}
						],
						"Type": "string"
					}
				]
			},
			"SchemaVersion": "string",
			"Service": {
				"Action": {
					"ActionType": "string",
					"AwsApiCallAction": {
						"Api": "string",
						"CallerType": "string",
						"DomainDetails": {
							"Domain": "string"
						},
						"ErrorCode": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"ServiceName": "string"
					},
					"DnsRequestAction": {
						"Domain": "string"
					},
					"NetworkConnectionAction": {
						"Blocked": false,
						"ConnectionDirection": "string",
						"LocalIpDetails": {
							"IpAddressV4": "string"
						},
						"LocalPortDetails": {
							"Port": 0,
							"PortName": "string"
						},
						"Protocol": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"RemotePortDetails": {
							"Port": 0,
							"PortName": "string"
						}
					},
					"PortProbeAction": {
						"Blocked": false,
						"PortProbeDetails": [
							{
								"LocalIpDetails": {
									"IpAddressV4": "string"
								},
								"LocalPortDetails": {
									"Port": 0,
									"PortName": "string"
								},
								"RemoteIpDetails": {
									"City": {
										"CityName": "string"
									},
									"Country": {
										"CountryCode": "string",
										"CountryName": "string"
									},
									"GeoLocation": {
										"Lat": 0,
										"Lon": 0
									},
									"IpAddressV4": "string",
									"Organization": {
										"Asn": "string",
										"AsnOrg": "string",
										"Isp": "string",
										"Org": "string"
									}
								}
							}
						]
					}
				},
				"Archived": false,
				"Count": 0,
				"DetectorId": "string",
				"EventFirstSeen": "string",
				"EventLastSeen": "string",
				"Evidence": {
					"ThreatIntelligenceDetails": [
						{
							"ThreatListName": "string",
							"ThreatNames": [
								"string"
							]
						}
					]
				},
				"ResourceRole": "string",
				"ServiceName": "string",
				"UserFeedback": "string"
			},
			"Severity": 0,
			"Title": "string",
			"Type": "string",
			"UpdatedAt": "string"
		}
	]
}

​
Workflow Library Example

Guardduty Get Findings with Aws and Send Results Via Email

Preview this Workflow on desktop