GuardDuty Detector

Resource Type

AWS.GuardDuty.Detector

Resource ID Format

For GuardDuty Detector resources, the resource ID is constructed as such:

[AccountId]:[region]:AWS.GuardDuty.Detector

Example:

123456789012:us-west-2:AWS.GuardDuty.Detector

This allows you to differentiate between GuardDuty Detector resources across all AWS accounts you have linked by looking at the characters before the first colon, and to differentiate between GuardDuty Detector resources within an account by looking at the characters between the first and second colon.

Background

This resource represents a snapshot of an AWS GuardDuty detector.

Fields

Field

Type

Description

Master

Map

The master GuardDuty detector this account is subscribed to, if one exists

Status

String

Indicates whether the detector is ENABLED or DISABLED

Example

{
"AccountId": "123456789012",
"FindingPublishingFrequency": "SIX_HOURS",
"Id": "12a12345b12345c12ab12a1a1ab1a1ab1",
"Master": {
"AccountId": "99a12345b12345c12ab12a1a1ab1a1ab1",
"InvitationId": "11111111111111",
"InvitedAt": "2019",
"RelationshipStatus": "active"
},
"Region": "eu-central-1",
"ResourceId": "123456789012:eu-central-1:AWS.GuardDuty.Detector",
"ResourceType": "AWS.GuardDuty.Detector",
"ServiceRole": "arn:aws:iam::123456789012:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
"Status": "ENABLED",
"Tags": {
"KeyName1": "Value1"
},
"TimeCreated": "2019-01-01T00:00:00.000Z",
"UpdatedAt": "2019-01-01T00:00:00.000Z"
}