> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GuardDuty Get Findings

Describes Amazon GuardDuty findings specified by finding IDs.

<Note>
  External Documentation

  To learn more, visit the [AWS documentation](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFindings.html#API_GetFindings).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter     | Description                                                                                                                                                                                                                                                               |
  | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | AWS Region(s) | Enter the desired AWS Region(s).<br /><br />To execute the action in multiple regions, provide a comma-separated list.<br />For example: `us-east-1,eu-west-2`.<br /><br />If you wish to run the action in all available regions, use the asterisk symbol (`*`) instead. |
  | Detector ID   | The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.                                                                                                                                                                          |
  | Finding IDs   | A comma-separated list of finding IDs you want to retrieve.                                                                                                                                                                                                               |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter                        | Description                                                                    |
  | -------------------------------- | ------------------------------------------------------------------------------ |
  | Disable XML To JSON Auto Convert | When checked, XML responses are not automatically converted into JSON format.  |
  | Order By                         | The order by which the sorted findings are to be displayed.                    |
  | Sort By                          | Represents the finding attribute (for example, accountId) to sort findings by. |
</div>

## Example Output

```json theme={"dark"}
{
	"Findings": [
		{
			"AccountId": "string",
			"Arn": "string",
			"Confidence": 0,
			"CreatedAt": "string",
			"Description": "string",
			"Id": "string",
			"Partition": "string",
			"Region": "string",
			"Resource": {
				"AccessKeyDetails": {
					"AccessKeyId": "string",
					"PrincipalId": "string",
					"UserName": "string",
					"UserType": "string"
				},
				"InstanceDetails": {
					"AvailabilityZone": "string",
					"IamInstanceProfile": {
						"Arn": "string",
						"Id": "string"
					},
					"ImageDescription": "string",
					"ImageId": "string",
					"InstanceId": "string",
					"InstanceState": "string",
					"InstanceType": "string",
					"LaunchTime": "string",
					"NetworkInterfaces": [
						{
							"Ipv6Addresses": [
								"string"
							],
							"NetworkInterfaceId": "string",
							"PrivateDnsName": "string",
							"PrivateIpAddress": "string",
							"PrivateIpAddresses": [
								{
									"PrivateDnsName": "string",
									"PrivateIpAddress": "string"
								}
							],
							"PublicDnsName": "string",
							"PublicIp": "string",
							"SecurityGroups": [
								{
									"GroupId": "string",
									"GroupName": "string"
								}
							],
							"SubnetId": "string",
							"VpcId": "string"
						}
					],
					"OutpostArn": "string",
					"Platform": "string",
					"ProductCodes": [
						{
							"Code": "string",
							"ProductType": "string"
						}
					],
					"Tags": [
						{
							"Key": "string",
							"Value": "string"
						}
					]
				},
				"ResourceType": "string",
				"S3BucketDetails": [
					{
						"Arn": "string",
						"CreatedAt": "date-time",
						"DefaultServerSideEncryption": {
							"EncryptionType": "string",
							"KmsMasterKeyArn": "string"
						},
						"Name": "string",
						"Owner": {
							"Id": "string"
						},
						"PublicAccess": {
							"EffectivePermission": "string",
							"PermissionConfiguration": {
								"AccountLevelPermissions": {
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									}
								},
								"BucketLevelPermissions": {
									"AccessControlList": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									},
									"BlockPublicAccess": {
										"BlockPublicAcls": false,
										"BlockPublicPolicy": false,
										"IgnorePublicAcls": false,
										"RestrictPublicBuckets": false
									},
									"BucketPolicy": {
										"AllowsPublicReadAccess": false,
										"AllowsPublicWriteAccess": false
									}
								}
							}
						},
						"Tags": [
							{
								"Key": "string",
								"Value": "string"
							}
						],
						"Type": "string"
					}
				]
			},
			"SchemaVersion": "string",
			"Service": {
				"Action": {
					"ActionType": "string",
					"AwsApiCallAction": {
						"Api": "string",
						"CallerType": "string",
						"DomainDetails": {
							"Domain": "string"
						},
						"ErrorCode": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"ServiceName": "string"
					},
					"DnsRequestAction": {
						"Domain": "string"
					},
					"NetworkConnectionAction": {
						"Blocked": false,
						"ConnectionDirection": "string",
						"LocalIpDetails": {
							"IpAddressV4": "string"
						},
						"LocalPortDetails": {
							"Port": 0,
							"PortName": "string"
						},
						"Protocol": "string",
						"RemoteIpDetails": {
							"City": {
								"CityName": "string"
							},
							"Country": {
								"CountryCode": "string",
								"CountryName": "string"
							},
							"GeoLocation": {
								"Lat": 0,
								"Lon": 0
							},
							"IpAddressV4": "string",
							"Organization": {
								"Asn": "string",
								"AsnOrg": "string",
								"Isp": "string",
								"Org": "string"
							}
						},
						"RemotePortDetails": {
							"Port": 0,
							"PortName": "string"
						}
					},
					"PortProbeAction": {
						"Blocked": false,
						"PortProbeDetails": [
							{
								"LocalIpDetails": {
									"IpAddressV4": "string"
								},
								"LocalPortDetails": {
									"Port": 0,
									"PortName": "string"
								},
								"RemoteIpDetails": {
									"City": {
										"CityName": "string"
									},
									"Country": {
										"CountryCode": "string",
										"CountryName": "string"
									},
									"GeoLocation": {
										"Lat": 0,
										"Lon": 0
									},
									"IpAddressV4": "string",
									"Organization": {
										"Asn": "string",
										"AsnOrg": "string",
										"Isp": "string",
										"Org": "string"
									}
								}
							}
						]
					}
				},
				"Archived": false,
				"Count": 0,
				"DetectorId": "string",
				"EventFirstSeen": "string",
				"EventLastSeen": "string",
				"Evidence": {
					"ThreatIntelligenceDetails": [
						{
							"ThreatListName": "string",
							"ThreatNames": [
								"string"
							]
						}
					]
				},
				"ResourceRole": "string",
				"ServiceName": "string",
				"UserFeedback": "string"
			},
			"Severity": 0,
			"Title": "string",
			"Type": "string",
			"UpdatedAt": "string"
		}
	]
}
```

## Workflow Library Example

[Guardduty Get Findings with Aws and Send Results Via Email](https://library.blinkops.com/workflows/guardduty-get-findings-with-aws-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/guardduty-get-findings-with-aws-and-send-results-via-email/canvas" />
</div>