GuardDuty Get Findings - BlinkOps Documentation

Describes Amazon GuardDuty findings specified by finding IDs.

External DocumentationTo learn more, visit the AWS documentation.

Basic Parameters

Parameter	Description
AWS Region(s)	Enter the desired AWS Region(s). To execute the action in multiple regions, provide a comma-separated list. For example: `us-east-1,eu-west-2`. If you wish to run the action in all available regions, use the asterisk symbol (`*`) instead.
Detector ID	The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.
Finding IDs	A comma-separated list of finding IDs you want to retrieve.

Advanced Parameters

Parameter	Description
Disable XML To JSON Auto Convert	When checked, XML responses are not automatically converted into JSON format.
Order By	The order by which the sorted findings are to be displayed.
Sort By	Represents the finding attribute (for example, accountId) to sort findings by.

Example Output

{
	"Findings": [
		{
			"AccountId": "string",
			"Arn": "string",
			"Confidence": 0,
			"CreatedAt": "string",
			"Description": "string",
			"Id": "string",
			"Partition": "string",
			"Region": "string",
			"Resource": {
				"AccessKeyDetails": {
					"AccessKeyId": "string",
					"PrincipalId": "string",
					"UserName": "string",
					"UserType": "string"
				},
				"InstanceDetails": {
					"AvailabilityZone": "string",
					"IamInstanceProfile": {
						"Arn": "string",
						"Id": "string"
					},
					"ImageDescription": "string",
					"ImageId": "string",
					"InstanceId": "string",
					"InstanceState": "string",
					"InstanceType": "string",
					"LaunchTime": "string",
					"NetworkInterfaces": [
						{
							"Ipv6Addresses": [
								"string"
							],
							"NetworkInterfaceId": "string",
							"PrivateDnsName": "string",
							"PrivateIpAddress": "string",
							"PrivateIpAddresses": [
								{
									"PrivateDnsName": "string",
									"PrivateIpAddress": "string"
								}
							],
							"PublicDnsName": "string",
							"PublicIp": "string",
							"SecurityGroups": [
								{
									"GroupId": "string",
									"GroupName": "string"
								}
							],
							"SubnetId": "string",
							"VpcId": "string"
						}
					],
					"OutpostArn": "string",
					"Platform": "string",
					"ProductCodes": [
						{
							"Code": "string",
							"ProductType": "string"
						}
					],
					"Tags": [
						{
							"Key": "string",
							"Value": "string"
						}
					]
				},
				"ResourceType": "string",
				"S3BucketDetails": [
					{
						"Arn": "string",
						"CreatedAt": "date-time",
						"DefaultServerSideEncryption": {
							"EncryptionType": "string",
							"KmsMasterKeyArn": "string"
						},
						"Name": "string",
						"Owner": {
							"Id": "string"
						},
						"PublicAccess": {
							"EffectivePermission": "string",
							"PermissionConfiguration": {
								"AccountLevelPermissions": {
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									}
								},
								"BucketLevelPermissions": {
									"AccessControlList": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									},
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									},
									"BucketPolicy": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									}
								}
							}
						},
						"Tags": [
							{
								"Key": "string",
								"Value": "string"
							}
						],
						"Type": "string"
					}
				]
			},
			"SchemaVersion": "string",
			"Service": {
				"Action": {
					"ActionType": "string",
					"AwsApiCallAction": {
						"Api": "string",
						"CallerType": "string",
						"DomainDetails": {
							"Domain": "string"
						},
						"ErrorCode": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"ServiceName": "string"
					},
					"DnsRequestAction": {
						"Domain": "string"
					},
					"NetworkConnectionAction": {
						"Blocked": false,
						"ConnectionDirection": "string",
						"LocalIpDetails": {
							"IpAddressV4": "string"
						},
						"LocalPortDetails": {
							"Port": 0,
							"PortName": "string"
						},
						"Protocol": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"RemotePortDetails": {
							"Port": 0,
							"PortName": "string"
						}
					},
					"PortProbeAction": {
						"Blocked": false,
						"PortProbeDetails": [
							{
								"LocalIpDetails": {
									"IpAddressV4": "string"
								},
								"LocalPortDetails": {
									"Port": 0,
									"PortName": "string"
								},
								"RemoteIpDetails": {
									"City": {
										"CityName": "string"
									},
									"Country": {
										"CountryCode": "string",
										"CountryName": "string"
									},
									"GeoLocation": {
										"Lat": 0,
										"Lon": 0
									},
									"IpAddressV4": "string",
									"Organization": {
										"Asn": "string",
										"AsnOrg": "string",
										"Isp": "string",
										"Org": "string"
									}
								}
							}
						]
					}
				},
				"Archived": false,
				"Count": 0,
				"DetectorId": "string",
				"EventFirstSeen": "string",
				"EventLastSeen": "string",
				"Evidence": {
					"ThreatIntelligenceDetails": [
						{
							"ThreatListName": "string",
							"ThreatNames": [
								"string"
							]
						}
					]
				},
				"ResourceRole": "string",
				"ServiceName": "string",
				"UserFeedback": "string"
			},
			"Severity": 0,
			"Title": "string",
			"Type": "string",
			"UpdatedAt": "string"
		}
	]
}