The AWS SDK for JavaScript v2 has reached end-of-support.
We recommend that you migrate to AWS SDK for JavaScript v3. For additional details and information on how to migrate, please refer to the announcement.

Class: AWS.GuardDuty

Inherits:
AWS.Service show all
Identifier:
guardduty
API Version:
2017-11-28
Defined in:
(unknown)

Overview

Constructs a service interface object. Each API operation is exposed as a function on service.

Service Description

Amazon GuardDuty is a continuous security monitoring service that analyzes and processes the following foundational data sources - VPC flow logs, Amazon Web Services CloudTrail management event logs, CloudTrail S3 data event logs, EKS audit logs, DNS logs, Amazon EBS volume data, runtime activity belonging to container workloads, such as Amazon EKS, Amazon ECS (including Amazon Web Services Fargate), and Amazon EC2 instances. It uses threat intelligence feeds, such as lists of malicious IPs and domains, and machine learning to identify unexpected, potentially unauthorized, and malicious activity within your Amazon Web Services environment. This can include issues like escalations of privileges, uses of exposed credentials, or communication with malicious IPs, domains, or presence of malware on your Amazon EC2 instances and container workloads. For example, GuardDuty can detect compromised EC2 instances and container workloads serving malware, or mining bitcoin.

GuardDuty also monitors Amazon Web Services account access behavior for signs of compromise, such as unauthorized infrastructure deployments like EC2 instances deployed in a Region that has never been used, or unusual API calls like a password policy change to reduce password strength.

GuardDuty informs you about the status of your Amazon Web Services environment by producing security findings that you can view in the GuardDuty console or through Amazon EventBridge. For more information, see the Amazon GuardDuty User Guide .

Sending a Request Using GuardDuty

var guardduty = new AWS.GuardDuty();
guardduty.acceptAdministratorInvitation(params, function (err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Locking the API Version

In order to ensure that the GuardDuty object uses this specific API, you can construct the object by passing the apiVersion option to the constructor:

var guardduty = new AWS.GuardDuty({apiVersion: '2017-11-28'});

You can also set the API version globally in AWS.config.apiVersions using the guardduty service identifier:

AWS.config.apiVersions = {
  guardduty: '2017-11-28',
  // other service API versions
};

var guardduty = new AWS.GuardDuty();

Version:

  • 2017-11-28

Constructor Summary collapse

Property Summary collapse

Properties inherited from AWS.Service

apiVersions

Method Summary collapse

Methods inherited from AWS.Service

makeRequest, makeUnauthenticatedRequest, waitFor, setupRequestListeners, defineService

Constructor Details

new AWS.GuardDuty(options = {}) ⇒ Object

Constructs a service object. This object has one method for each API operation.

Examples:

Constructing a GuardDuty object

var guardduty = new AWS.GuardDuty({apiVersion: '2017-11-28'});

Options Hash (options):

  • params (map) —

    An optional map of parameters to bind to every request sent by this service object. For more information on bound parameters, see "Working with Services" in the Getting Started Guide.

  • endpoint (String|AWS.Endpoint) —

    The endpoint URI to send requests to. The default endpoint is built from the configured region. The endpoint should be a string like 'https://{service}.{region}.amazonaws.com' or an Endpoint object.

  • accessKeyId (String) —

    your AWS access key ID.

  • secretAccessKey (String) —

    your AWS secret access key.

  • sessionToken (AWS.Credentials) —

    the optional AWS session token to sign requests with.

  • credentials (AWS.Credentials) —

    the AWS credentials to sign requests with. You can either specify this object, or specify the accessKeyId and secretAccessKey options directly.

  • credentialProvider (AWS.CredentialProviderChain) —

    the provider chain used to resolve credentials if no static credentials property is set.

  • region (String) —

    the region to send service requests to. See AWS.GuardDuty.region for more information.

  • maxRetries (Integer) —

    the maximum amount of retries to attempt with a request. See AWS.GuardDuty.maxRetries for more information.

  • maxRedirects (Integer) —

    the maximum amount of redirects to follow with a request. See AWS.GuardDuty.maxRedirects for more information.

  • sslEnabled (Boolean) —

    whether to enable SSL for requests.

  • paramValidation (Boolean|map) —

    whether input parameters should be validated against the operation description before sending the request. Defaults to true. Pass a map to enable any of the following specific validation features:

    • min [Boolean] — Validates that a value meets the min constraint. This is enabled by default when paramValidation is set to true.
    • max [Boolean] — Validates that a value meets the max constraint.
    • pattern [Boolean] — Validates that a string value matches a regular expression.
    • enum [Boolean] — Validates that a string value matches one of the allowable enum values.
  • computeChecksums (Boolean) —

    whether to compute checksums for payload bodies when the service accepts it (currently supported in S3 only)

  • convertResponseTypes (Boolean) —

    whether types are converted when parsing response data. Currently only supported for JSON based services. Turning this off may improve performance on large response payloads. Defaults to true.

  • correctClockSkew (Boolean) —

    whether to apply a clock skew correction and retry requests that fail because of an skewed client clock. Defaults to false.

  • s3ForcePathStyle (Boolean) —

    whether to force path style URLs for S3 objects.

  • s3BucketEndpoint (Boolean) —

    whether the provided endpoint addresses an individual bucket (false if it addresses the root API endpoint). Note that setting this configuration option requires an endpoint to be provided explicitly to the service constructor.

  • s3DisableBodySigning (Boolean) —

    whether S3 body signing should be disabled when using signature version v4. Body signing can only be disabled when using https. Defaults to true.

  • s3UsEast1RegionalEndpoint ('legacy'|'regional') —

    when region is set to 'us-east-1', whether to send s3 request to global endpoints or 'us-east-1' regional endpoints. This config is only applicable to S3 client. Defaults to legacy

  • s3UseArnRegion (Boolean) —

    whether to override the request region with the region inferred from requested resource's ARN. Only available for S3 buckets Defaults to true

  • retryDelayOptions (map) —

    A set of options to configure the retry delay on retryable errors. Currently supported options are:

    • base [Integer] — The base number of milliseconds to use in the exponential backoff for operation retries. Defaults to 100 ms for all services except DynamoDB, where it defaults to 50ms.
    • customBackoff [function] — A custom function that accepts a retry count and error and returns the amount of time to delay in milliseconds. If the result is a non-zero negative value, no further retry attempts will be made. The base option will be ignored if this option is supplied. The function is only called for retryable errors.
  • httpOptions (map) —

    A set of options to pass to the low-level HTTP request. Currently supported options are: