Amazon GuardDuty Guardduty Threatentityset API

openapi: 3.2.0
info:
  title: Amazon GuardDuty Threatentityset API
  version: '2017-11-28'
  description: Generated from AWS's published Smithy model for Amazon GuardDuty. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Threatentityset
paths:
  /detector/{DetectorId}/threatentityset:
    post:
      operationId: CreateThreatEntitySet
      summary: Create Threat Entity Set
      description: Creates a new threat entity set. In a threat entity set, you can provide known malicious threat entities for your Amazon Web Services environment. GuardDuty generates findings based on the entries in the threat entity sets. Only users of the administrator account can manage entity sets, which automatically apply to member accounts.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateThreatEntitySetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateThreatEntitySetRequest'
      tags:
      - Threatentityset
    get:
      operationId: ListThreatEntitySets
      summary: List Threat Entity Sets
      description: Lists the threat entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the threat entity sets that are returned as a response, belong to the administrator account.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListThreatEntitySetsResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListThreatEntitySetsRequest'
      tags:
      - Threatentityset
  /detector/{DetectorId}/threatentityset/{ThreatEntitySetId}:
    delete:
      operationId: DeleteThreatEntitySet
      summary: Delete Threat Entity Set
      description: Deletes the threat entity set that is associated with the specified threatEntitySetId.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteThreatEntitySetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteThreatEntitySetRequest'
      tags:
      - Threatentityset
    get:
      operationId: GetThreatEntitySet
      summary: Get Threat Entity Set
      description: Retrieves the threat entity set associated with the specified threatEntitySetId.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetThreatEntitySetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetThreatEntitySetRequest'
      tags:
      - Threatentityset
    post:
      operationId: UpdateThreatEntitySet
      summary: Update Threat Entity Set
      description: Updates the threat entity set associated with the specified threatEntitySetId.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateThreatEntitySetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateThreatEntitySetRequest'
      tags:
      - Threatentityset
components:
  schemas:
    DeleteThreatEntitySetResponse:
      type: object
      properties: {}
    InternalServerErrorException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    GetThreatEntitySetResponse:
      type: object
      properties:
        Name:
          type: string
          description: The name of the threat entity set associated with the specified threatEntitySetId.
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the file that contains the threat entity set.
        Location:
          type: string
          description: The URI of the file that contains the threat entity set.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
        Status:
          type: string
          enum:
          - INACTIVE
          - ACTIVATING
          - ACTIVE
          - DEACTIVATING
          - ERROR
          - DELETE_PENDING
          - DELETED
          description: The status of the associated threat entity set.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags associated with the threat entity set resource.
        CreatedAt:
          type: string
          format: date-time
          description: The timestamp when the associated threat entity set was created.
        UpdatedAt:
          type: string
          format: date-time
          description: The timestamp when the associated threat entity set was updated.
        ErrorDetails:
          type: string
          description: The error details when the status is shown as ERROR.
      required:
      - Name
      - Format
      - Location
      - Status
    GetThreatEntitySetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector associated with the threat entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatEntitySetId:
          type: string
          description: The unique ID that helps GuardDuty identify the threat entity set.
      required:
      - DetectorId
      - ThreatEntitySetId
    ListThreatEntitySetsRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the GuardDuty detector that is associated with this threat entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50.
        NextToken:
          type: string
          description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
      required:
      - DetectorId
    ListThreatEntitySetsResponse:
      type: object
      properties:
        ThreatEntitySetIds:
          type: array
          items:
            type: string
          description: The IDs of the threat entity set resources.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more items.
      required:
      - ThreatEntitySetIds
    UpdateThreatEntitySetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the GuardDuty detector associated with the threat entity set that you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatEntitySetId:
          type: string
          description: The ID returned by GuardDuty after updating the threat entity set resource.
        Name:
          type: string
          description: A user-friendly name to identify the trusted entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_).
        Location:
          type: string
          description: The URI of the file that contains the trusted entity set.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
        Activate:
          type: boolean
          description: A boolean value that indicates whether GuardDuty is to start using this updated threat entity set. After you update an entity set, you will need to activate it again. It might take up to 15 minutes for the updated entity set to be effective.
      required:
      - DetectorId
      - ThreatEntitySetId
    CreateThreatEntitySetResponse:
      type: object
      properties:
        ThreatEntitySetId:
          type: string
          description: The ID returned by GuardDuty after creation of the threat entity set resource.
      required:
      - ThreatEntitySetId
    UpdateThreatEntitySetResponse:
      type: object
      properties: {}
    BadRequestException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    DeleteThreatEntitySetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector associated with the threat entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatEntitySetId:
          type: string
          description: The unique ID that helps GuardDuty identify which threat entity set needs to be deleted.
      required:
      - DetectorId
      - ThreatEntitySetId
    CreateThreatEntitySetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector of the GuardDuty account for which you want to create a threat entity set. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        Name:
          type: string
          description: A user-friendly name to identify the threat entity set. The name of your list can include lowercase letters, uppercase letters, numbers, dash (-), and underscore (_).
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the file that contains the threat entity set.
        Location:
          type: string
          description: 'The URI of the file that contains the threat entity set. The format of the Location URL must be a valid Amazon S3 URL format. Invalid URL formats will result in an error, regardless of whether you activate the entity set or not. For more information about format of the location URLs, see Format of location URL under Step 2: Adding trusted or threat intelligence data in the Amazon GuardDuty User Guide.'
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
        Activate:
          type: boolean
          description: A boolean value that indicates whether GuardDuty should start using the uploaded threat entity set to generate findings.
        ClientToken:
          type: string
          description: The idempotency token for the create request.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags to be added to a new threat entity set resource.
      required:
      - DetectorId
      - Name
      - Format
      - Location
      - Activate
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: guardduty
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)