Amazon GuardDuty Guardduty Threatintelset API

openapi: 3.2.0
info:
  title: Amazon GuardDuty Threatintelset API
  version: '2017-11-28'
  description: Generated from AWS's published Smithy model for Amazon GuardDuty. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Threatintelset
paths:
  /detector/{DetectorId}/threatintelset:
    post:
      operationId: CreateThreatIntelSet
      summary: Create Threat Intel Set
      description: Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateThreatIntelSetResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateThreatIntelSetRequest'
      tags:
      - Threatintelset
    get:
      operationId: ListThreatIntelSets
      summary: List Threat Intel Sets
      description: Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListThreatIntelSetsResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListThreatIntelSetsRequest'
      tags:
      - Threatintelset
  /detector/{DetectorId}/threatintelset/{ThreatIntelSetId}:
    delete:
      operationId: DeleteThreatIntelSet
      summary: Delete Threat Intel Set
      description: Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteThreatIntelSetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteThreatIntelSetRequest'
      tags:
      - Threatintelset
    get:
      operationId: GetThreatIntelSet
      summary: Get Threat Intel Set
      description: Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetThreatIntelSetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetThreatIntelSetRequest'
      tags:
      - Threatintelset
    post:
      operationId: UpdateThreatIntelSet
      summary: Update Threat Intel Set
      description: Updates the ThreatIntelSet specified by the ThreatIntelSet ID.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateThreatIntelSetResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateThreatIntelSetRequest'
      tags:
      - Threatintelset
components:
  schemas:
    UpdateThreatIntelSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The detectorID that specifies the GuardDuty service whose ThreatIntelSet you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatIntelSetId:
          type: string
          description: The unique ID that specifies the ThreatIntelSet that you want to update.
        Name:
          type: string
          description: The unique ID that specifies the ThreatIntelSet that you want to update.
        Location:
          type: string
          description: The updated URI of the file that contains the ThreateIntelSet.
        Activate:
          type: boolean
          description: The updated Boolean value that specifies whether the ThreateIntelSet is active or not.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
      required:
      - DetectorId
      - ThreatIntelSetId
    GetThreatIntelSetResponse:
      type: object
      properties:
        Name:
          type: string
          description: A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the threatIntelSet.
        Location:
          type: string
          description: The URI of the file that contains the ThreatIntelSet.
        Status:
          type: string
          enum:
          - INACTIVE
          - ACTIVATING
          - ACTIVE
          - DEACTIVATING
          - ERROR
          - DELETE_PENDING
          - DELETED
          description: The status of threatIntelSet file uploaded.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags of the threat list resource.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during ThreatIntelSet creation or update.
      required:
      - Name
      - Format
      - Location
      - Status
    InternalServerErrorException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    CreateThreatIntelSetResponse:
      type: object
      properties:
        ThreatIntelSetId:
          type: string
          description: The ID of the ThreatIntelSet resource.
      required:
      - ThreatIntelSetId
    GetThreatIntelSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatIntelSetId:
          type: string
          description: The unique ID of the threatIntelSet that you want to get.
      required:
      - DetectorId
      - ThreatIntelSetId
    ListThreatIntelSetsRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
        NextToken:
          type: string
          description: You can use this parameter to paginate results in the response. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
      required:
      - DetectorId
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    DeleteThreatIntelSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        ThreatIntelSetId:
          type: string
          description: The unique ID of the threatIntelSet that you want to delete.
      required:
      - DetectorId
      - ThreatIntelSetId
    UpdateThreatIntelSetResponse:
      type: object
      properties: {}
    CreateThreatIntelSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector of the GuardDuty account for which you want to create a threatIntelSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        Name:
          type: string
          description: A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the file that contains the ThreatIntelSet.
        Location:
          type: string
          description: The URI of the file that contains the ThreatIntelSet.
        Activate:
          type: boolean
          description: A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.
        ClientToken:
          type: string
          description: The idempotency token for the create request.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags to be added to a new threat list resource.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
      required:
      - DetectorId
      - Name
      - Format
      - Location
      - Activate
    DeleteThreatIntelSetResponse:
      type: object
      properties: {}
    ListThreatIntelSetsResponse:
      type: object
      properties:
        ThreatIntelSetIds:
          type: array
          items:
            type: string
          description: The IDs of the ThreatIntelSet resources.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more items.
      required:
      - ThreatIntelSetIds
    BadRequestException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: guardduty
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)