guardduty

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: MIT Imports: 21 Imported by: 0

README

GuardDuty

Parity grade: A · SDK aws-sdk-go-v2/service/guardduty@v1.78.2 · last audited 2026-07-12 (7f3594fa)

Coverage
Operations audited 51 (49 ok, 2 partial)
Feature families 13 (9 ok, 1 partial, 3 deferred)
Known gaps 4
Deferred items 3
Resource leaks clean
Known gaps
  • GetMalwareScan (services/guardduty/handler_appendixa.go:handleGetMalwareScan) still doesn't emit adminDetectorId/resourceArn/resourceType/scanCategory/scanConfiguration/scanResultDetails/scanStatusReason/scannedResources(+count)/skippedResourcesCount/failedResourcesCount — the real op has a materially richer response than DescribeMalwareScans/ListMalwareScans' Scan shape, and this backend only tracks the older Scan-shape fields. All missing fields are optional on the real output so a real client won't error, just gets nil/absent fields.
  • GetFindingsStatistics (services/guardduty/backend.go:GetFindingsStatistics) only implements the deprecated countBySeverity; groupedByAccount/groupedByDate/groupedByFindingType/groupedByResource/groupedBySeverity (selected via the request's GroupBy param) are not implemented.
  • ListFindings/ListDetectors/ListFilters/ListIPSets/ListThreatIntelSets/etc. ignore FindingCriteria/SortCriteria/MaxResults and never emit a NextToken — every list op returns its full result set in one page. NextToken is an optional response field so this is non-fatal to real clients, but large result sets won't paginate.
  • PublishingDestination lacks ExpectedBucketOwner-style extras present on some other Create*/Get* outputs (e.g. GetThreatEntitySetOutput.ErrorDetails/ExpectedBucketOwner) -- not tracked anywhere in this backend, so always absent.
Deferred
  • organization family (response-shape deep audit)
  • coverage/usage/freeTrial family (response-shape deep audit)
  • malware protection plan Actions/ProtectedResource schema validation

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrDetectorNotFound is returned when a detector does not exist.
	ErrDetectorNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrDetectorAlreadyExists is returned when a detector already exists.
	ErrDetectorAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrFilterNotFound is returned when a filter does not exist.
	ErrFilterNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFilterAlreadyExists is returned when a filter already exists.
	ErrFilterAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrFindingNotFound is returned when a finding does not exist.
	ErrFindingNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrIPSetNotFound is returned when an IP set does not exist.
	ErrIPSetNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrIPSetAlreadyExists is returned when an IP set already exists.
	ErrIPSetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrThreatIntelSetNotFound is returned when a threat intel set does not exist.
	ErrThreatIntelSetNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrThreatIntelSetAlreadyExists is returned when a threat intel set already exists.
	ErrThreatIntelSetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New("BadRequestException", awserr.ErrInvalidParameter)
)
View Source 
var (
	ErrMemberNotFound                = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMemberAlreadyExists           = awserr.New(errConflictException, awserr.ErrConflict)
	ErrPublishingDestNotFound        = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrPublishingDestAlreadyExists   = awserr.New(errConflictException, awserr.ErrConflict)
	ErrMalwareScanNotFound           = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMalwareProtPlanNotFound       = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMalwareProtPlanAlreadyExists  = awserr.New(errConflictException, awserr.ErrConflict)
	ErrThreatEntitySetNotFound       = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrThreatEntitySetAlreadyExists  = awserr.New(errConflictException, awserr.ErrConflict)
	ErrTrustedEntitySetNotFound      = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrTrustedEntitySetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
)
View Source 
var ErrNilAppContext = errors.New("guardduty: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AdditionalConfig 

type AdditionalConfig struct {
	Name   string `json:"name"`
	Status string `json:"status"`
}

AdditionalConfig holds extra feature-level configuration.

type AdminAccount 

type AdminAccount struct {
	AccountID          string `json:"accountId"`
	InvitationID       string `json:"invitationId"`
	InvitedAt          string `json:"invitedAt"`
	RelationshipStatus string `json:"relationshipStatus"`
	// contains filtered or unexported fields
}

AdminAccount represents the administrator account relationship for GetAdministratorAccount.

type DestinationProperties 

type DestinationProperties struct {
	DestinationArn string `json:"destinationArn,omitempty"`
	KmsKeyArn      string `json:"kmsKeyArn,omitempty"`
}

DestinationProperties holds properties for a publishing destination.

type Detector 

type Detector struct {
	CreatedAt                  time.Time         `json:"createdAt"`
	UpdatedAt                  time.Time         `json:"updatedAt"`
	DetectorID                 string            `json:"detectorId"`
	Status                     string            `json:"status"`
	FindingPublishingFrequency string            `json:"findingPublishingFrequency,omitempty"`
	ServiceRole                string            `json:"serviceRole"`
	Tags                       map[string]string `json:"tags,omitempty"`
	Features                   []DetectorFeature `json:"features,omitempty"`
}

Detector represents a GuardDuty detector.

type DetectorFeature 

type DetectorFeature struct {
	Name                    string             `json:"name"`
	Status                  string             `json:"status"`
	AdditionalConfiguration []AdditionalConfig `json:"additionalConfiguration,omitempty"`
}

DetectorFeature represents a feature configuration for a detector.

type Filter 

type Filter struct {
	CreatedAt       time.Time         `json:"createdAt"`
	UpdatedAt       time.Time         `json:"updatedAt"`
	FindingCriteria map[string]any    `json:"findingCriteria,omitempty"`
	Tags            map[string]string `json:"tags,omitempty"`
	Name            string            `json:"name"`
	Description     string            `json:"description,omitempty"`
	Action          string            `json:"action"`
	DetectorID      string            `json:"-"`
	Rank            int32             `json:"rank"`
}

Filter represents a GuardDuty filter.

type Finding 

type Finding struct {
	AccountID     string          `json:"accountId"`
	SchemaVersion string          `json:"schemaVersion"`
	CreatedAt     string          `json:"createdAt"`
	Description   string          `json:"description"`
	DetectorID    string          `json:"detectorId"`
	ID            string          `json:"id"`
	Type          string          `json:"type"`
	Title         string          `json:"title"`
	Region        string          `json:"region"`
	UpdatedAt     string          `json:"updatedAt"`
	Arn           string          `json:"arn"`
	Resource      FindingResource `json:"resource"`
	Service       FindingService  `json:"service"`
	Severity      float64         `json:"severity"`
}

Finding represents a GuardDuty finding.

type FindingResource 

type FindingResource struct {
	ResourceType string `json:"resourceType"`
}

FindingResource describes the AWS resource involved in a finding.

type FindingService 

type FindingService struct {
	DetectorID     string `json:"detectorId"`
	EventFirstSeen string `json:"eventFirstSeen"`
	EventLastSeen  string `json:"eventLastSeen"`
	ResourceRole   string `json:"resourceRole"`
	ServiceName    string `json:"serviceName"`
	UserFeedback   string `json:"userFeedback,omitempty"`
	Count          int32  `json:"count"`
	Archived       bool   `json:"archived"`
}

FindingService holds service-level metadata for a finding.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles GuardDuty HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches GuardDuty requests by path prefix.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Without this, cli.go's generic setupPersistence (which type-asserts the registered service.Registerable, i.e. *Handler, for Snapshot/Restore) never finds a persistable GuardDuty service even though InMemoryBackend itself has always implemented Snapshot/Restore -- the backend methods were dead wiring until Handler delegated to them.

type IPSet 

type IPSet struct {
	CreatedAt  time.Time         `json:"createdAt"`
	UpdatedAt  time.Time         `json:"updatedAt"`
	IPSetID    string            `json:"ipSetId"`
	Name       string            `json:"name"`
	Format     string            `json:"format"`
	Location   string            `json:"location"`
	Status     string            `json:"status"`
	Tags       map[string]string `json:"tags,omitempty"`
	DetectorID string            `json:"-"`
}

IPSet represents a GuardDuty IP set.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using pkgs/store tables.

See store_setup.go for how the tables/indexes below are registered and persistence.go for how they are snapshotted/restored. tags (a map[string]string value map, not *T) and memberSeq (a scalar counter) are the only state left as plain fields -- see persistence.go's file doc comment for the per-field persistence audit.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AcceptAdministratorInvitation 

func (b *InMemoryBackend) AcceptAdministratorInvitation(detectorID, administratorID, invitationID string) error

AcceptAdministratorInvitation records acceptance of an administrator invitation.

func (*InMemoryBackend) AcceptInvitation 

func (b *InMemoryBackend) AcceptInvitation(detectorID, masterID, invitationID string) error

AcceptInvitation records acceptance of a legacy master invitation.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the configured account ID.

func (*InMemoryBackend) ArchiveFindings 

func (b *InMemoryBackend) ArchiveFindings(detectorID string, findingIDs []string) error

ArchiveFindings marks findings as archived.

func (*InMemoryBackend) CreateDetector 

func (b *InMemoryBackend) CreateDetector(
	enable bool,
	frequency string,
	tags map[string]string,
	features []DetectorFeature,
) (*Detector, error)

CreateDetector creates a new GuardDuty detector for this account+region.

func (*InMemoryBackend) CreateFilter 

func (b *InMemoryBackend) CreateFilter(
	detectorID, name, description, action string,
	rank int32,
	findingCriteria map[string]any,
	tags map[string]string,
) (*Filter, error)

CreateFilter creates a new filter for a detector.

func (*InMemoryBackend) CreateIPSet 

func (b *InMemoryBackend) CreateIPSet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*IPSet, error)

CreateIPSet creates a new IP set.

func (*InMemoryBackend) CreateMalwareProtectionPlan 

func (b *InMemoryBackend) CreateMalwareProtectionPlan(
	role string,
	protectedResource, actions map[string]any,
	tags map[string]string,
) (*MalwareProtectionPlan, error)

CreateMalwareProtectionPlan creates a new malware protection plan.

func (*InMemoryBackend) CreateMembers 

func (b *InMemoryBackend) CreateMembers(
	detectorID string,
	accountDetails []map[string]any,
) ([]*Member, []map[string]any)

CreateMembers creates member accounts for a detector.

func (*InMemoryBackend) CreatePublishingDestination 

func (b *InMemoryBackend) CreatePublishingDestination(
	detectorID, destType string,
	props DestinationProperties,
	tags map[string]string,
) (*PublishingDestination, error)

CreatePublishingDestination creates a new publishing destination for a detector.

func (*InMemoryBackend) CreateSampleFindings 

func (b *InMemoryBackend) CreateSampleFindings(detectorID string, findingTypes []string) error

CreateSampleFindings creates sample findings for a detector.

func (*InMemoryBackend) CreateThreatEntitySet 

func (b *InMemoryBackend) CreateThreatEntitySet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*ThreatEntitySet, error)

CreateThreatEntitySet creates a new threat entity set.

func (*InMemoryBackend) CreateThreatIntelSet 

func (b *InMemoryBackend) CreateThreatIntelSet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*ThreatIntelSet, error)

CreateThreatIntelSet creates a new threat intelligence set.

func (*InMemoryBackend) CreateTrustedEntitySet 

func (b *InMemoryBackend) CreateTrustedEntitySet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*TrustedEntitySet, error)

CreateTrustedEntitySet creates a new trusted entity set.

func (*InMemoryBackend) DeclineInvitations 

func (b *InMemoryBackend) DeclineInvitations(accountIDs []string) []map[string]any

DeclineInvitations declines invitations from specified accounts.

func (*InMemoryBackend) DeleteDetector 

func (b *InMemoryBackend) DeleteDetector(detectorID string) error

DeleteDetector removes a detector.

func (*InMemoryBackend) DeleteFilter 

func (b *InMemoryBackend) DeleteFilter(detectorID, filterName string) error

DeleteFilter removes a filter.

func (*InMemoryBackend) DeleteIPSet 

func (b *InMemoryBackend) DeleteIPSet(detectorID, ipSetID string) error

DeleteIPSet removes an IP set.

func (*InMemoryBackend) DeleteInvitations 

func (b *InMemoryBackend) DeleteInvitations(accountIDs []string) []map[string]any

DeleteInvitations deletes invitations from specified accounts.

func (*InMemoryBackend) DeleteMalwareProtectionPlan 

func (b *InMemoryBackend) DeleteMalwareProtectionPlan(planID string) error

DeleteMalwareProtectionPlan removes a malware protection plan.

func (*InMemoryBackend) DeleteMembers 

func (b *InMemoryBackend) DeleteMembers(detectorID string, accountIDs []string) []map[string]any

DeleteMembers removes member accounts from a detector.

func (*InMemoryBackend) DeletePublishingDestination 

func (b *InMemoryBackend) DeletePublishingDestination(detectorID, destID string) error

DeletePublishingDestination removes a publishing destination.

func (*InMemoryBackend) DeleteThreatEntitySet 

func (b *InMemoryBackend) DeleteThreatEntitySet(detectorID, setID string) error

DeleteThreatEntitySet removes a threat entity set.

func (*InMemoryBackend) DeleteThreatIntelSet 

func (b *InMemoryBackend) DeleteThreatIntelSet(detectorID, setID string) error

DeleteThreatIntelSet removes a threat intelligence set.

func (*InMemoryBackend) DeleteTrustedEntitySet 

func (b *InMemoryBackend) DeleteTrustedEntitySet(detectorID, setID string) error

DeleteTrustedEntitySet removes a trusted entity set.

func (*InMemoryBackend) DescribeMalwareScans 

func (b *InMemoryBackend) DescribeMalwareScans(detectorID string) ([]*MalwareScan, error)

DescribeMalwareScans returns malware scans associated with a detector.

func (*InMemoryBackend) DescribeOrganizationConfiguration 

func (b *InMemoryBackend) DescribeOrganizationConfiguration(detectorID string) (*OrgConfig, error)

DescribeOrganizationConfiguration returns org config for a detector.

func (*InMemoryBackend) DescribePublishingDestination 

func (b *InMemoryBackend) DescribePublishingDestination(detectorID, destID string) (*PublishingDestination, error)

DescribePublishingDestination retrieves a publishing destination.

func (*InMemoryBackend) DisableOrganizationAdminAccount 

func (b *InMemoryBackend) DisableOrganizationAdminAccount(adminAccountID string) error

DisableOrganizationAdminAccount removes an account as org admin.

func (*InMemoryBackend) DisassociateFromAdministratorAccount 

func (b *InMemoryBackend) DisassociateFromAdministratorAccount(detectorID string) error

DisassociateFromAdministratorAccount removes the administrator relationship.

func (*InMemoryBackend) DisassociateFromMasterAccount 

func (b *InMemoryBackend) DisassociateFromMasterAccount(detectorID string) error

DisassociateFromMasterAccount removes the legacy master relationship.

func (*InMemoryBackend) DisassociateMembers 

func (b *InMemoryBackend) DisassociateMembers(detectorID string, accountIDs []string) []map[string]any

DisassociateMembers disassociates member accounts from a detector.

func (*InMemoryBackend) EnableOrganizationAdminAccount 

func (b *InMemoryBackend) EnableOrganizationAdminAccount(adminAccountID string) error

EnableOrganizationAdminAccount designates an account as org admin.

func (*InMemoryBackend) GetAdministratorAccount 

func (b *InMemoryBackend) GetAdministratorAccount(detectorID string) (*AdminAccount, error)

GetAdministratorAccount returns the administrator account for a detector.

func (*InMemoryBackend) GetCoverageStatistics 

func (b *InMemoryBackend) GetCoverageStatistics(detectorID string) (map[string]any, error)

GetCoverageStatistics returns coverage statistics for a detector.

func (*InMemoryBackend) GetDetector 

func (b *InMemoryBackend) GetDetector(detectorID string) (*Detector, error)

GetDetector retrieves a detector by ID.

func (*InMemoryBackend) GetFilter 

func (b *InMemoryBackend) GetFilter(detectorID, filterName string) (*Filter, error)

GetFilter retrieves a filter.

func (*InMemoryBackend) GetFindings 

func (b *InMemoryBackend) GetFindings(detectorID string, findingIDs []string) ([]*Finding, error)

GetFindings returns findings by IDs.

func (*InMemoryBackend) GetFindingsStatistics 

func (b *InMemoryBackend) GetFindingsStatistics(detectorID string) (map[string]any, error)

GetFindingsStatistics returns finding statistics for a detector.

func (*InMemoryBackend) GetIPSet 

func (b *InMemoryBackend) GetIPSet(detectorID, ipSetID string) (*IPSet, error)

GetIPSet retrieves an IP set.

func (*InMemoryBackend) GetInvitationsCount 

func (b *InMemoryBackend) GetInvitationsCount() int

GetInvitationsCount returns the count of pending invitations.

func (*InMemoryBackend) GetMalwareProtectionPlan 

func (b *InMemoryBackend) GetMalwareProtectionPlan(planID string) (*MalwareProtectionPlan, error)

GetMalwareProtectionPlan retrieves a malware protection plan.

func (*InMemoryBackend) GetMalwareScan 

func (b *InMemoryBackend) GetMalwareScan(scanID string) (*MalwareScan, error)

GetMalwareScan retrieves a malware scan by ID.

func (*InMemoryBackend) GetMalwareScanSettings 

func (b *InMemoryBackend) GetMalwareScanSettings(detectorID string) (*MalwareScanSettings, error)

GetMalwareScanSettings returns malware scan settings for a detector.

func (*InMemoryBackend) GetMasterAccount 

func (b *InMemoryBackend) GetMasterAccount(detectorID string) (*AdminAccount, error)

GetMasterAccount returns the legacy master account for a detector.

func (*InMemoryBackend) GetMemberDetectors 

func (b *InMemoryBackend) GetMemberDetectors(
	detectorID string,
	accountIDs []string,
) ([]map[string]any, []map[string]any)

GetMemberDetectors returns detector configurations for member accounts.

func (*InMemoryBackend) GetMembers 

func (b *InMemoryBackend) GetMembers(detectorID string, accountIDs []string) ([]*Member, []map[string]any)

GetMembers retrieves member account details.

func (*InMemoryBackend) GetOrganizationStatistics 

func (b *InMemoryBackend) GetOrganizationStatistics() map[string]any

GetOrganizationStatistics returns org-level statistics.

func (*InMemoryBackend) GetRemainingFreeTrialDays 

func (b *InMemoryBackend) GetRemainingFreeTrialDays(detectorID string) (map[string]any, error)

GetRemainingFreeTrialDays returns remaining free trial days.

func (*InMemoryBackend) GetThreatEntitySet 

func (b *InMemoryBackend) GetThreatEntitySet(detectorID, setID string) (*ThreatEntitySet, error)

GetThreatEntitySet retrieves a threat entity set.

func (*InMemoryBackend) GetThreatIntelSet 

func (b *InMemoryBackend) GetThreatIntelSet(detectorID, setID string) (*ThreatIntelSet, error)

GetThreatIntelSet retrieves a threat intelligence set.

func (*InMemoryBackend) GetTrustedEntitySet 

func (b *InMemoryBackend) GetTrustedEntitySet(detectorID, setID string) (*TrustedEntitySet, error)

GetTrustedEntitySet retrieves a trusted entity set.

func (*InMemoryBackend) GetUsageStatistics 

func (b *InMemoryBackend) GetUsageStatistics(detectorID string) (map[string]any, error)

GetUsageStatistics returns usage statistics for a detector.

func (*InMemoryBackend) InviteMembers 

func (b *InMemoryBackend) InviteMembers(detectorID string, accountIDs []string) []map[string]any

InviteMembers sends invitations to member accounts.

func (*InMemoryBackend) ListCoverage 

func (b *InMemoryBackend) ListCoverage(detectorID string) ([]map[string]any, error)

ListCoverage returns coverage resources for a detector.

func (*InMemoryBackend) ListDetectors 

func (b *InMemoryBackend) ListDetectors() []string

ListDetectors returns all detector IDs.

func (*InMemoryBackend) ListFilters 

func (b *InMemoryBackend) ListFilters(detectorID string) ([]string, error)

ListFilters returns filter names for a detector.

func (*InMemoryBackend) ListFindings 

func (b *InMemoryBackend) ListFindings(detectorID string) ([]string, error)

ListFindings returns finding IDs for a detector.

func (*InMemoryBackend) ListIPSets 

func (b *InMemoryBackend) ListIPSets(detectorID string) ([]string, error)

ListIPSets returns IP set IDs for a detector.

func (*InMemoryBackend) ListInvitations 

func (b *InMemoryBackend) ListInvitations() []*Invitation

ListInvitations returns all pending invitations.

func (*InMemoryBackend) ListMalwareProtectionPlans 

func (b *InMemoryBackend) ListMalwareProtectionPlans() []*MalwareProtectionPlan

ListMalwareProtectionPlans returns all malware protection plans.

func (*InMemoryBackend) ListMalwareScans 

func (b *InMemoryBackend) ListMalwareScans() []*MalwareScan

ListMalwareScans returns all malware scans globally.

func (*InMemoryBackend) ListMembers 

func (b *InMemoryBackend) ListMembers(detectorID string, onlyAssociated bool) ([]*Member, error)

ListMembers returns member accounts for a detector.

func (*InMemoryBackend) ListOrganizationAdminAccounts 

func (b *InMemoryBackend) ListOrganizationAdminAccounts() []*OrgAdminAccount

ListOrganizationAdminAccounts returns all org admin accounts.

func (*InMemoryBackend) ListPublishingDestinations 

func (b *InMemoryBackend) ListPublishingDestinations(detectorID string) ([]*PublishingDestination, error)

ListPublishingDestinations returns publishing destinations for a detector.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns tags for a resource.

func (*InMemoryBackend) ListThreatEntitySets 

func (b *InMemoryBackend) ListThreatEntitySets(detectorID string) ([]string, error)

ListThreatEntitySets returns threat entity set IDs for a detector.

func (*InMemoryBackend) ListThreatIntelSets 

func (b *InMemoryBackend) ListThreatIntelSets(detectorID string) ([]string, error)

ListThreatIntelSets returns threat intel set IDs for a detector.

func (*InMemoryBackend) ListTrustedEntitySets 

func (b *InMemoryBackend) ListTrustedEntitySets(detectorID string) ([]string, error)

ListTrustedEntitySets returns trusted entity set IDs for a detector.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the configured region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON. It implements persistence.Persistable via Handler.Restore (see below).

func (*InMemoryBackend) SendObjectMalwareScan 

func (b *InMemoryBackend) SendObjectMalwareScan(
	s3ObjectDetails map[string]any,
) (string, error)

SendObjectMalwareScan initiates a malware scan on an S3 object.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON. It implements persistence.Persistable via Handler.Snapshot (see below).

func (*InMemoryBackend) StartMalwareScan 

func (b *InMemoryBackend) StartMalwareScan(resourceARN string) (string, error)

StartMalwareScan initiates a malware scan.

func (*InMemoryBackend) StartMonitoringMembers 

func (b *InMemoryBackend) StartMonitoringMembers(detectorID string, accountIDs []string) []map[string]any

StartMonitoringMembers starts monitoring member accounts.

func (*InMemoryBackend) StopMonitoringMembers 

func (b *InMemoryBackend) StopMonitoringMembers(detectorID string, accountIDs []string) []map[string]any

StopMonitoringMembers stops monitoring member accounts.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource sets tags on a resource.

func (*InMemoryBackend) UnarchiveFindings 

func (b *InMemoryBackend) UnarchiveFindings(detectorID string, findingIDs []string) error

UnarchiveFindings marks findings as unarchived.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateDetector 

func (b *InMemoryBackend) UpdateDetector(
	detectorID string,
	enable *bool,
	frequency string,
	features []DetectorFeature,
) error

UpdateDetector updates a detector's configuration.

func (*InMemoryBackend) UpdateFilter 

func (b *InMemoryBackend) UpdateFilter(
	detectorID, filterName, description, action string,
	rank int32,
	findingCriteria map[string]any,
) (*Filter, error)

UpdateFilter updates a filter's configuration.

func (*InMemoryBackend) UpdateFindingsFeedback 

func (b *InMemoryBackend) UpdateFindingsFeedback(detectorID string, findingIDs []string, feedback string) error

UpdateFindingsFeedback updates the feedback for findings.

func (*InMemoryBackend) UpdateIPSet 

func (b *InMemoryBackend) UpdateIPSet(detectorID, ipSetID, name, location string, activate *bool) error

UpdateIPSet updates an IP set.

func (*InMemoryBackend) UpdateMalwareProtectionPlan 

func (b *InMemoryBackend) UpdateMalwareProtectionPlan(
	planID, role string,
	protectedResource, actions map[string]any,
) error

UpdateMalwareProtectionPlan updates a malware protection plan.

func (*InMemoryBackend) UpdateMalwareScanSettings 

func (b *InMemoryBackend) UpdateMalwareScanSettings(
	detectorID string,
	settings *MalwareScanSettings,
) error

UpdateMalwareScanSettings updates malware scan settings for a detector.

func (*InMemoryBackend) UpdateMemberDetectors 

func (b *InMemoryBackend) UpdateMemberDetectors(
	detectorID string,
	accountIDs []string,
) []map[string]any

UpdateMemberDetectors updates detector configurations for member accounts.

func (*InMemoryBackend) UpdateOrganizationConfiguration 

func (b *InMemoryBackend) UpdateOrganizationConfiguration(
	detectorID string,
	autoEnable bool,
	features []OrgFeature,
) error

UpdateOrganizationConfiguration updates org config for a detector.

func (*InMemoryBackend) UpdatePublishingDestination 

func (b *InMemoryBackend) UpdatePublishingDestination(
	detectorID, destID string,
	props DestinationProperties,
) error

UpdatePublishingDestination updates a publishing destination.

func (*InMemoryBackend) UpdateThreatEntitySet 

func (b *InMemoryBackend) UpdateThreatEntitySet(
	detectorID, setID, name, location string,
	activate *bool,
) error

UpdateThreatEntitySet updates a threat entity set.

func (*InMemoryBackend) UpdateThreatIntelSet 

func (b *InMemoryBackend) UpdateThreatIntelSet(detectorID, setID, name, location string, activate *bool) error

UpdateThreatIntelSet updates a threat intelligence set.

func (*InMemoryBackend) UpdateTrustedEntitySet 

func (b *InMemoryBackend) UpdateTrustedEntitySet(
	detectorID, setID, name, location string,
	activate *bool,
) error

UpdateTrustedEntitySet updates a trusted entity set.

type Invitation 

type Invitation struct {
	AccountID          string `json:"accountId"`
	InvitationID       string `json:"invitationId"`
	InvitedAt          string `json:"invitedAt"`
	RelationshipStatus string `json:"relationshipStatus"`
}

Invitation represents a pending GuardDuty invitation.

type MalwareProtectionPlan 

type MalwareProtectionPlan struct {
	CreatedAt               time.Time         `json:"createdAt"`
	ProtectedResource       map[string]any    `json:"protectedResource"`
	Actions                 map[string]any    `json:"actions"`
	Tags                    map[string]string `json:"tags,omitempty"`
	MalwareProtectionPlanID string            `json:"malwareProtectionPlanId"`
	Arn                     string            `json:"arn"`
	Role                    string            `json:"role"`
	Status                  string            `json:"status"`
	StatusReasons           []any             `json:"statusReasons"`
}

MalwareProtectionPlan represents a malware protection plan.

type MalwareScan 

type MalwareScan struct {
	ScanID          string         `json:"scanId"`
	DetectorID      string         `json:"detectorId"`
	AccountID       string         `json:"accountId"`
	ScanStartTime   time.Time      `json:"scanStartTime"`
	ScanEndTime     time.Time      `json:"scanEndTime"`
	ScanStatus      string         `json:"scanStatus"`
	ScanType        string         `json:"scanType"`
	TriggerDetails  map[string]any `json:"triggerDetails"`
	ResourceDetails map[string]any `json:"resourceDetails"`
	Findings        []any          `json:"findings"`
}

MalwareScan represents a GuardDuty malware scan result.

type MalwareScanSettings 

type MalwareScanSettings struct {
	ScanResourceCriteria    map[string]any `json:"scanResourceCriteria"`
	EbsSnapshotPreservation string         `json:"ebsSnapshotPreservation"`
	// contains filtered or unexported fields
}

MalwareScanSettings holds malware scan configuration for a detector.

type Member 

type Member struct {
	UpdatedAt          time.Time `json:"updatedAt"`
	AccountID          string    `json:"accountId"`
	AdministratorID    string    `json:"administratorId"`
	MasterID           string    `json:"masterId"`
	DetectorID         string    `json:"detectorId"`
	Email              string    `json:"email"`
	RelationshipStatus string    `json:"relationshipStatus"`
	InvitedAt          string    `json:"invitedAt"`
}

Member represents a GuardDuty member account.

type OrgAdminAccount 

type OrgAdminAccount struct {
	AdminAccountID string `json:"adminAccountId"`
	AdminStatus    string `json:"adminStatus"`
}

OrgAdminAccount represents an organization admin account.

type OrgConfig 

type OrgConfig struct {
	DataSources map[string]any `json:"dataSources"`

	Features                  []OrgFeature `json:"features"`
	AutoEnable                bool         `json:"autoEnable"`
	MemberAccountLimitReached bool         `json:"memberAccountLimitReached"`
	// contains filtered or unexported fields
}

OrgConfig holds org-level GuardDuty configuration.

type OrgFeature 

type OrgFeature struct {
	AutoEnable string `json:"autoEnable"`
	Name       string `json:"name"`
}

OrgFeature holds org-level feature configuration.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS GuardDuty.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the GuardDuty service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type PublishingDestination 

type PublishingDestination struct {
	DestinationProperties      DestinationProperties `json:"destinationProperties"`
	Tags                       map[string]string     `json:"tags,omitempty"`
	DestinationID              string                `json:"destinationId"`
	DestinationType            string                `json:"destinationType"`
	Status                     string                `json:"status"`
	ServicePrincipal           string                `json:"servicePrincipal,omitempty"`
	DetectorID                 string                `json:"-"`
	PublishingFailureStartedAt int64                 `json:"publishingFailureStartedAt,omitempty"`
}

PublishingDestination represents a GuardDuty publishing destination.

type StorageBackend 

type StorageBackend interface {
	CreateDetector(enable bool, frequency string, tags map[string]string, features []DetectorFeature) (*Detector, error)
	GetDetector(detectorID string) (*Detector, error)
	UpdateDetector(detectorID string, enable *bool, frequency string, features []DetectorFeature) error
	DeleteDetector(detectorID string) error
	ListDetectors() []string

	CreateFilter(
		detectorID, name, description, action string,
		rank int32,
		findingCriteria map[string]any,
		tags map[string]string,
	) (*Filter, error)
	GetFilter(detectorID, filterName string) (*Filter, error)
	UpdateFilter(
		detectorID, filterName, description, action string,
		rank int32,
		findingCriteria map[string]any,
	) (*Filter, error)
	DeleteFilter(detectorID, filterName string) error
	ListFilters(detectorID string) ([]string, error)

	GetFindings(detectorID string, findingIDs []string) ([]*Finding, error)
	ListFindings(detectorID string) ([]string, error)
	ArchiveFindings(detectorID string, findingIDs []string) error
	UnarchiveFindings(detectorID string, findingIDs []string) error
	CreateSampleFindings(detectorID string, findingTypes []string) error
	GetFindingsStatistics(detectorID string) (map[string]any, error)
	UpdateFindingsFeedback(detectorID string, findingIDs []string, feedback string) error

	CreateIPSet(detectorID, name, format, location string, activate bool, tags map[string]string) (*IPSet, error)
	GetIPSet(detectorID, ipSetID string) (*IPSet, error)
	UpdateIPSet(detectorID, ipSetID, name, location string, activate *bool) error
	DeleteIPSet(detectorID, ipSetID string) error
	ListIPSets(detectorID string) ([]string, error)

	CreateThreatIntelSet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
	) (*ThreatIntelSet, error)
	GetThreatIntelSet(detectorID, setID string) (*ThreatIntelSet, error)
	UpdateThreatIntelSet(detectorID, setID, name, location string, activate *bool) error
	DeleteThreatIntelSet(detectorID, setID string) error
	ListThreatIntelSets(detectorID string) ([]string, error)

	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Member management
	CreateMembers(detectorID string, accountDetails []map[string]any) ([]*Member, []map[string]any)
	DeleteMembers(detectorID string, accountIDs []string) []map[string]any
	GetMembers(detectorID string, accountIDs []string) ([]*Member, []map[string]any)
	InviteMembers(detectorID string, accountIDs []string) []map[string]any
	ListMembers(detectorID string, onlyAssociated bool) ([]*Member, error)
	StartMonitoringMembers(detectorID string, accountIDs []string) []map[string]any
	StopMonitoringMembers(detectorID string, accountIDs []string) []map[string]any
	DisassociateMembers(detectorID string, accountIDs []string) []map[string]any
	GetMemberDetectors(detectorID string, accountIDs []string) ([]map[string]any, []map[string]any)
	UpdateMemberDetectors(detectorID string, accountIDs []string) []map[string]any

	// Invitation management
	AcceptAdministratorInvitation(detectorID, administratorID, invitationID string) error
	AcceptInvitation(detectorID, masterID, invitationID string) error
	GetAdministratorAccount(detectorID string) (*AdminAccount, error)
	GetMasterAccount(detectorID string) (*AdminAccount, error)
	DisassociateFromAdministratorAccount(detectorID string) error
	DisassociateFromMasterAccount(detectorID string) error
	DeclineInvitations(accountIDs []string) []map[string]any
	DeleteInvitations(accountIDs []string) []map[string]any
	GetInvitationsCount() int
	ListInvitations() []*Invitation

	// Organization management
	EnableOrganizationAdminAccount(adminAccountID string) error
	DisableOrganizationAdminAccount(adminAccountID string) error
	ListOrganizationAdminAccounts() []*OrgAdminAccount
	DescribeOrganizationConfiguration(detectorID string) (*OrgConfig, error)
	UpdateOrganizationConfiguration(detectorID string, autoEnable bool, features []OrgFeature) error
	GetOrganizationStatistics() map[string]any

	// Publishing destinations
	CreatePublishingDestination(
		detectorID, destType string,
		props DestinationProperties,
		tags map[string]string,
	) (*PublishingDestination, error)
	DeletePublishingDestination(detectorID, destID string) error
	DescribePublishingDestination(detectorID, destID string) (*PublishingDestination, error)
	ListPublishingDestinations(detectorID string) ([]*PublishingDestination, error)
	UpdatePublishingDestination(detectorID, destID string, props DestinationProperties) error

	// Malware scanning
	DescribeMalwareScans(detectorID string) ([]*MalwareScan, error)
	ListMalwareScans() []*MalwareScan
	StartMalwareScan(resourceARN string) (string, error)
	GetMalwareScan(scanID string) (*MalwareScan, error)
	GetMalwareScanSettings(detectorID string) (*MalwareScanSettings, error)
	UpdateMalwareScanSettings(detectorID string, settings *MalwareScanSettings) error
	GetUsageStatistics(detectorID string) (map[string]any, error)
	GetRemainingFreeTrialDays(detectorID string) (map[string]any, error)
	GetCoverageStatistics(detectorID string) (map[string]any, error)
	ListCoverage(detectorID string) ([]map[string]any, error)

	// Malware protection plans
	CreateMalwareProtectionPlan(
		role string,
		protectedResource, actions map[string]any,
		tags map[string]string,
	) (*MalwareProtectionPlan, error)
	DeleteMalwareProtectionPlan(planID string) error
	GetMalwareProtectionPlan(planID string) (*MalwareProtectionPlan, error)
	ListMalwareProtectionPlans() []*MalwareProtectionPlan
	UpdateMalwareProtectionPlan(planID, role string, protectedResource, actions map[string]any) error
	SendObjectMalwareScan(s3ObjectDetails map[string]any) (string, error)

	// Threat entity sets
	CreateThreatEntitySet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
	) (*ThreatEntitySet, error)
	GetThreatEntitySet(detectorID, setID string) (*ThreatEntitySet, error)
	ListThreatEntitySets(detectorID string) ([]string, error)
	UpdateThreatEntitySet(detectorID, setID, name, location string, activate *bool) error
	DeleteThreatEntitySet(detectorID, setID string) error

	// Trusted entity sets
	CreateTrustedEntitySet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
	) (*TrustedEntitySet, error)
	GetTrustedEntitySet(detectorID, setID string) (*TrustedEntitySet, error)
	ListTrustedEntitySets(detectorID string) ([]string, error)
	UpdateTrustedEntitySet(detectorID, setID, name, location string, activate *bool) error
	DeleteTrustedEntitySet(detectorID, setID string) error

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for GuardDuty storage operations.

type ThreatEntitySet 

type ThreatEntitySet struct {
	CreatedAt         time.Time         `json:"createdAt"`
	UpdatedAt         time.Time         `json:"updatedAt"`
	Tags              map[string]string `json:"tags,omitempty"`
	ThreatEntitySetID string            `json:"threatEntitySetId"`
	DetectorID        string            `json:"-"`
	Name              string            `json:"name"`
	Format            string            `json:"format"`
	Location          string            `json:"location"`
	Status            string            `json:"status"`
}

ThreatEntitySet represents a GuardDuty threat entity set.

type ThreatIntelSet 

type ThreatIntelSet struct {
	CreatedAt        time.Time         `json:"createdAt"`
	UpdatedAt        time.Time         `json:"updatedAt"`
	ThreatIntelSetID string            `json:"threatIntelSetId"`
	Name             string            `json:"name"`
	Format           string            `json:"format"`
	Location         string            `json:"location"`
	Status           string            `json:"status"`
	Tags             map[string]string `json:"tags,omitempty"`
	DetectorID       string            `json:"-"`
}

ThreatIntelSet represents a GuardDuty threat intelligence set.

type TrustedEntitySet 

type TrustedEntitySet struct {
	CreatedAt          time.Time         `json:"createdAt"`
	UpdatedAt          time.Time         `json:"updatedAt"`
	Tags               map[string]string `json:"tags,omitempty"`
	TrustedEntitySetID string            `json:"trustedEntitySetId"`
	DetectorID         string            `json:"-"`
	Name               string            `json:"name"`
	Format             string            `json:"format"`
	Location           string            `json:"location"`
	Status             string            `json:"status"`
}

TrustedEntitySet represents a GuardDuty trusted entity set.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.