guardduty

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 24 Imported by: 0

README

GuardDuty

Parity grade: A- · SDK aws-sdk-go-v2/service/guardduty@v1.85.0 · last audited 2026-07-25 (2cff93209)

Coverage

Metric Value
Operations audited 63 (62 ok, 1 partial)
Feature families 14 (12 ok, 2 partial)
Known gaps 5
Deferred items 4
Resource leaks clean
Known gaps
  • GetMalwareScan still doesn't emit scanConfiguration/scanResultDetails/scannedResources[] (the per-resource detail list, not just its count) -- this backend has no state model for individual scanned files/objects/volumes within a scan, so these three remain absent. All three are optional on the real output so a real client won't error, just gets nil/absent fields. scanStatusReason/scanCompletedAt are correctly absent for a RUNNING scan (this backend's scans never transition to SKIPPED/COMPLETED/FAILED, so those states -- and the fields real AWS would populate for them -- are unreachable).
  • GetOrganizationStatistics.organizationDetails.organizationStatistics.countByFeature is always [] -- this backend has no per-feature member-account enrollment tracking (which member accounts have S3_DATA_EVENTS vs EKS_AUDIT_LOGS etc. enabled), only OrgConfig.Features at the requesting-account level. Real types.OrganizationFeatureStatistics needs a name+enabledAccountsCount(+additionalConfiguration) per feature across the whole org, which would require a materially larger state model.
  • GetRemainingFreeTrialDays' per-account accounts[].features/dataSources are always empty and freeTrialDaysRemaining is a hardcoded 30 -- no free-trial state (enrollment date, feature-level trial windows) is tracked anywhere in this backend. Shape is correct; values are placeholders.
  • DescribeMalwareScans/ListMalwareScans/ListDetectors/ListFilters/ListIPSets/ListThreatIntelSets/ListMembers/ListInvitations/ListOrganizationAdminAccounts/ListPublishingDestinations/ListMalwareProtectionPlans/ListCoverage all still ignore FilterCriteria/SortCriteria/MaxResults and never emit a NextToken -- every one of these returns its full result set in one page. FIXED for ListFindings only this pass (see ops above); the rest are unchanged. NextToken is an optional response field on all of these so this remains non-fatal to a real client, just unpaginated.
  • Investigation.status is always RUNNING; endTime/error never populate because no investigation this backend creates ever transitions to COMPLETED or FAILED -- those transitions require account-level finding correlation and Bedrock-backed analysis this emulator does not implement. This mirrors MalwareScan's identical, pre-existing RUNNING-forever limitation (see GetMalwareScan's gap above) rather than being a new bug class. Confidence/Risk/RiskLevel/Summary/Cloud/Metadata (Investigation) and Confidence/RiskLevel/Title (InvestigationSummary) are real optional members that only the (unimplemented) analysis engine would ever populate on AWS itself; they are correctly and permanently absent here, never fabricated. See TestWireShape_Investigation_NoFabricatedAnalysis.
Deferred
  • GetOrganizationStatistics.countByFeature per-feature org-wide enrollment tracking (would need a new state model, not just a wire-shape fix)
  • GetRemainingFreeTrialDays real free-trial state (enrollment timestamps, feature-level trial windows)
  • Pagination (MaxResults/NextToken) + FilterCriteria/SortCriteria for every List op other than ListFindings and now ListInvestigations
  • A real threat-analysis engine for investigations (finding correlation, Bedrock-backed risk/confidence scoring, natural-language summary) -- would require a materially larger feature (this emulator has no equivalent of any AI-scored analysis anywhere else in the service either), not a wire-shape fix

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrDetectorNotFound is returned when a detector does not exist.
	ErrDetectorNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrDetectorAlreadyExists is returned when a detector already exists.
	ErrDetectorAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrFilterNotFound is returned when a filter does not exist.
	ErrFilterNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFilterAlreadyExists is returned when a filter already exists.
	ErrFilterAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrFindingNotFound is returned when a finding does not exist.
	ErrFindingNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrIPSetNotFound is returned when an IP set does not exist.
	ErrIPSetNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrIPSetAlreadyExists is returned when an IP set already exists.
	ErrIPSetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrThreatIntelSetNotFound is returned when a threat intel set does not exist.
	ErrThreatIntelSetNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrThreatIntelSetAlreadyExists is returned when a threat intel set already exists.
	ErrThreatIntelSetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New("BadRequestException", awserr.ErrInvalidParameter)
)
View Source 
var (
	ErrMemberNotFound                = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMemberAlreadyExists           = awserr.New(errConflictException, awserr.ErrConflict)
	ErrPublishingDestNotFound        = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrPublishingDestAlreadyExists   = awserr.New(errConflictException, awserr.ErrConflict)
	ErrMalwareScanNotFound           = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMalwareProtPlanNotFound       = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrMalwareProtPlanAlreadyExists  = awserr.New(errConflictException, awserr.ErrConflict)
	ErrThreatEntitySetNotFound       = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrThreatEntitySetAlreadyExists  = awserr.New(errConflictException, awserr.ErrConflict)
	ErrTrustedEntitySetNotFound      = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	ErrTrustedEntitySetAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrInvestigationNotFound is returned when an investigation does not exist.
	ErrInvestigationNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
)
View Source 
var ErrNilAppContext = errors.New("guardduty: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AdditionalConfig 

type AdditionalConfig struct {
	Name   string `json:"name"`
	Status string `json:"status"`
}

AdditionalConfig holds extra feature-level configuration.

type AdminAccount 

type AdminAccount struct {
	AccountID          string `json:"accountId"`
	InvitationID       string `json:"invitationId"`
	InvitedAt          string `json:"invitedAt"`
	RelationshipStatus string `json:"relationshipStatus"`
	// contains filtered or unexported fields
}

AdminAccount represents the administrator account relationship for GetAdministratorAccount.

type Condition added in v1.2.0 

type Condition struct {
	GreaterThan        *int64   `json:"greaterThan,omitempty"`
	GreaterThanOrEqual *int64   `json:"greaterThanOrEqual,omitempty"`
	LessThan           *int64   `json:"lessThan,omitempty"`
	LessThanOrEqual    *int64   `json:"lessThanOrEqual,omitempty"`
	Gt                 *int32   `json:"gt,omitempty"`
	Gte                *int32   `json:"gte,omitempty"`
	Lt                 *int32   `json:"lt,omitempty"`
	Lte                *int32   `json:"lte,omitempty"`
	Equals             []string `json:"equals,omitempty"`
	NotEquals          []string `json:"notEquals,omitempty"`
	Eq                 []string `json:"eq,omitempty"`
	Neq                []string `json:"neq,omitempty"`
	Matches            []string `json:"matches,omitempty"`
	NotMatches         []string `json:"notMatches,omitempty"`
}

Condition represents a single finding-criteria condition, matching aws-sdk-go-v2/service/guardduty/types.Condition field-for-field (including the deprecated Eq/Neq/Gt/Gte/Lt/Lte aliases real clients may still send).

type DestinationProperties 

type DestinationProperties struct {
	DestinationArn string `json:"destinationArn,omitempty"`
	KmsKeyArn      string `json:"kmsKeyArn,omitempty"`
}

DestinationProperties holds properties for a publishing destination.

type Detector 

type Detector struct {
	CreatedAt                  time.Time         `json:"createdAt"`
	UpdatedAt                  time.Time         `json:"updatedAt"`
	DetectorID                 string            `json:"detectorId"`
	Status                     string            `json:"status"`
	FindingPublishingFrequency string            `json:"findingPublishingFrequency,omitempty"`
	ServiceRole                string            `json:"serviceRole"`
	Tags                       map[string]string `json:"tags,omitempty"`
	Features                   []DetectorFeature `json:"features,omitempty"`
}

Detector represents a GuardDuty detector.

type DetectorFeature 

type DetectorFeature struct {
	Name                    string             `json:"name"`
	Status                  string             `json:"status"`
	AdditionalConfiguration []AdditionalConfig `json:"additionalConfiguration,omitempty"`
}

DetectorFeature represents a feature configuration for a detector.

type Filter 

type Filter struct {
	CreatedAt       time.Time         `json:"createdAt"`
	UpdatedAt       time.Time         `json:"updatedAt"`
	FindingCriteria map[string]any    `json:"findingCriteria,omitempty"`
	Tags            map[string]string `json:"tags,omitempty"`
	Name            string            `json:"name"`
	Description     string            `json:"description,omitempty"`
	Action          string            `json:"action"`
	DetectorID      string            `json:"-"`
	Rank            int32             `json:"rank"`
}

Filter represents a GuardDuty filter.

type Finding 

type Finding struct {
	AccountID     string          `json:"accountId"`
	SchemaVersion string          `json:"schemaVersion"`
	CreatedAt     string          `json:"createdAt"`
	Description   string          `json:"description"`
	DetectorID    string          `json:"detectorId"`
	ID            string          `json:"id"`
	Type          string          `json:"type"`
	Title         string          `json:"title"`
	Region        string          `json:"region"`
	UpdatedAt     string          `json:"updatedAt"`
	Arn           string          `json:"arn"`
	Resource      FindingResource `json:"resource"`
	Service       FindingService  `json:"service"`
	Severity      float64         `json:"severity"`
}

Finding represents a GuardDuty finding.

type FindingCriteria added in v1.2.0 

type FindingCriteria struct {
	Criterion map[string]Condition `json:"criterion,omitempty"`
}

FindingCriteria represents the criteria used for querying findings, matching types.FindingCriteria.

type FindingResource 

type FindingResource struct {
	ResourceType string `json:"resourceType"`
}

FindingResource describes the AWS resource involved in a finding.

type FindingService 

type FindingService struct {
	DetectorID     string `json:"detectorId"`
	EventFirstSeen string `json:"eventFirstSeen"`
	EventLastSeen  string `json:"eventLastSeen"`
	ResourceRole   string `json:"resourceRole"`
	ServiceName    string `json:"serviceName"`
	UserFeedback   string `json:"userFeedback,omitempty"`
	Count          int32  `json:"count"`
	Archived       bool   `json:"archived"`
}

FindingService holds service-level metadata for a finding.

type FindingStatisticsQuery added in v1.2.0 

type FindingStatisticsQuery struct {
	Criteria   map[string]Condition
	GroupBy    string
	OrderBy    string
	MaxResults int32
}

FindingStatisticsQuery holds the optional filter/group-by parameters for GetFindingsStatistics, mirroring types.GetFindingsStatisticsInput's FindingCriteria, GroupBy, and OrderBy fields.

type FindingsQuery added in v1.2.0 

type FindingsQuery struct {
	Criteria   map[string]Condition
	SortAttr   string
	SortOrder  string
	NextToken  string
	MaxResults int32
}

FindingsQuery holds the optional filter/sort/pagination parameters for ListFindings, mirroring types.ListFindingsInput's FindingCriteria, SortCriteria, MaxResults, and NextToken fields.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler handles GuardDuty HTTP requests.

func NewHandler 

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches GuardDuty requests by path prefix.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend. Without this, cli.go's generic setupPersistence (which type-asserts the registered service.Registerable, i.e. *Handler, for Snapshot/Restore) never finds a persistable GuardDuty service even though InMemoryBackend itself has always implemented Snapshot/Restore -- the backend methods were dead wiring until Handler delegated to them.

type IPSet 

type IPSet struct {
	CreatedAt  time.Time         `json:"createdAt"`
	UpdatedAt  time.Time         `json:"updatedAt"`
	IPSetID    string            `json:"ipSetId"`
	Name       string            `json:"name"`
	Format     string            `json:"format"`
	Location   string            `json:"location"`
	Status     string            `json:"status"`
	Tags       map[string]string `json:"tags,omitempty"`
	DetectorID string            `json:"-"`
}

IPSet represents a GuardDuty IP set.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using pkgs/store tables.

See store_setup.go for how the tables/indexes below are registered and persistence.go for how they are snapshotted/restored. tags (a map[string]string value map, not *T) and memberSeq (a scalar counter) are the only state left as plain fields -- see persistence.go's file doc comment for the per-field persistence audit.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AcceptAdministratorInvitation 

func (b *InMemoryBackend) AcceptAdministratorInvitation(detectorID, administratorID, invitationID string) error

AcceptAdministratorInvitation records acceptance of an administrator invitation.

func (*InMemoryBackend) AcceptInvitation 

func (b *InMemoryBackend) AcceptInvitation(detectorID, masterID, invitationID string) error

AcceptInvitation records acceptance of a legacy master invitation.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the configured account ID.

func (*InMemoryBackend) ArchiveFindings 

func (b *InMemoryBackend) ArchiveFindings(detectorID string, findingIDs []string) error

ArchiveFindings marks findings as archived.

func (*InMemoryBackend) CreateDetector 

func (b *InMemoryBackend) CreateDetector(
	enable bool,
	frequency string,
	tags map[string]string,
	features []DetectorFeature,
) (*Detector, error)

CreateDetector creates a new GuardDuty detector for this account+region.

func (*InMemoryBackend) CreateFilter 

func (b *InMemoryBackend) CreateFilter(
	detectorID, name, description, action string,
	rank int32,
	findingCriteria map[string]any,
	tags map[string]string,
) (*Filter, error)

CreateFilter creates a new filter for a detector.

func (*InMemoryBackend) CreateIPSet 

func (b *InMemoryBackend) CreateIPSet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*IPSet, error)

CreateIPSet creates a new IP set.

func (*InMemoryBackend) CreateInvestigation added in v1.2.0 

func (b *InMemoryBackend) CreateInvestigation(detectorID, triggerPrompt string) (*Investigation, error)

CreateInvestigation starts a new GuardDuty Extended Threat Detection investigation for detectorID.

This backend has no threat-analysis engine (no Bedrock model, no finding correlation, no account-level analysis), so the investigation it creates never progresses past RUNNING -- see the Investigation type doc (models.go) for why that is the honest choice here rather than fabricating a COMPLETED result with invented findings/risk/summary.

detectorID is validated against this backend's real detector table (a nonexistent detector fails with ErrDetectorNotFound, the same ResourceNotFoundException every other detector-scoped op in this package returns), and the real "AI_ANALYST feature must be enabled on your detector" precondition is enforced against the same Detector.Features this package already models for Create/UpdateDetector.

func (*InMemoryBackend) CreateMalwareProtectionPlan 

func (b *InMemoryBackend) CreateMalwareProtectionPlan(
	role string,
	protectedResource, actions map[string]any,
	tags map[string]string,
) (*MalwareProtectionPlan, error)

CreateMalwareProtectionPlan creates a new malware protection plan.

func (*InMemoryBackend) CreateMembers 

func (b *InMemoryBackend) CreateMembers(
	detectorID string,
	accountDetails []map[string]any,
) ([]*Member, []map[string]any)

CreateMembers creates member accounts for a detector.

func (*InMemoryBackend) CreatePublishingDestination 

func (b *InMemoryBackend) CreatePublishingDestination(
	detectorID, destType string,
	props DestinationProperties,
	tags map[string]string,
) (*PublishingDestination, error)

CreatePublishingDestination creates a new publishing destination for a detector.

func (*InMemoryBackend) CreateSampleFindings 

func (b *InMemoryBackend) CreateSampleFindings(detectorID string, findingTypes []string) error

CreateSampleFindings creates sample findings for a detector.

func (*InMemoryBackend) CreateThreatEntitySet 

func (b *InMemoryBackend) CreateThreatEntitySet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
	expectedBucketOwner string,
) (*ThreatEntitySet, error)

CreateThreatEntitySet creates a new threat entity set.

func (*InMemoryBackend) CreateThreatIntelSet 

func (b *InMemoryBackend) CreateThreatIntelSet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
) (*ThreatIntelSet, error)

CreateThreatIntelSet creates a new threat intelligence set.

func (*InMemoryBackend) CreateTrustedEntitySet 

func (b *InMemoryBackend) CreateTrustedEntitySet(
	detectorID, name, format, location string,
	activate bool,
	tags map[string]string,
	expectedBucketOwner string,
) (*TrustedEntitySet, error)

CreateTrustedEntitySet creates a new trusted entity set.

func (*InMemoryBackend) DeclineInvitations 

func (b *InMemoryBackend) DeclineInvitations(accountIDs []string) []map[string]any

DeclineInvitations declines invitations from specified accounts.

func (*InMemoryBackend) DeleteDetector 

func (b *InMemoryBackend) DeleteDetector(detectorID string) error

DeleteDetector removes a detector.

func (*InMemoryBackend) DeleteFilter 

func (b *InMemoryBackend) DeleteFilter(detectorID, filterName string) error

DeleteFilter removes a filter.

func (*InMemoryBackend) DeleteIPSet 

func (b *InMemoryBackend) DeleteIPSet(detectorID, ipSetID string) error

DeleteIPSet removes an IP set.

func (*InMemoryBackend) DeleteInvitations 

func (b *InMemoryBackend) DeleteInvitations(accountIDs []string) []map[string]any

DeleteInvitations deletes invitations from specified accounts.

func (*InMemoryBackend) DeleteMalwareProtectionPlan 

func (b *InMemoryBackend) DeleteMalwareProtectionPlan(planID string) error

DeleteMalwareProtectionPlan removes a malware protection plan.

func (*InMemoryBackend) DeleteMembers 

func (b *InMemoryBackend) DeleteMembers(detectorID string, accountIDs []string) []map[string]any

DeleteMembers removes member accounts from a detector.

func (*InMemoryBackend) DeletePublishingDestination 

func (b *InMemoryBackend) DeletePublishingDestination(detectorID, destID string) error

DeletePublishingDestination removes a publishing destination.

func (*InMemoryBackend) DeleteThreatEntitySet 

func (b *InMemoryBackend) DeleteThreatEntitySet(detectorID, setID string) error

DeleteThreatEntitySet removes a threat entity set.

func (*InMemoryBackend) DeleteThreatIntelSet 

func (b *InMemoryBackend) DeleteThreatIntelSet(detectorID, setID string) error

DeleteThreatIntelSet removes a threat intelligence set.

func (*InMemoryBackend) DeleteTrustedEntitySet 

func (b *InMemoryBackend) DeleteTrustedEntitySet(detectorID, setID string) error

DeleteTrustedEntitySet removes a trusted entity set.

func (*InMemoryBackend) DescribeMalwareScans 

func (b *InMemoryBackend) DescribeMalwareScans(detectorID string) ([]*MalwareScan, error)

DescribeMalwareScans returns malware scans associated with a detector.

func (*InMemoryBackend) DescribeOrganizationConfiguration 

func (b *InMemoryBackend) DescribeOrganizationConfiguration(detectorID string) (*OrgConfig, error)

DescribeOrganizationConfiguration returns org config for a detector.

func (*InMemoryBackend) DescribePublishingDestination 

func (b *InMemoryBackend) DescribePublishingDestination(detectorID, destID string) (*PublishingDestination, error)

DescribePublishingDestination retrieves a publishing destination.

func (*InMemoryBackend) DisableOrganizationAdminAccount 

func (b *InMemoryBackend) DisableOrganizationAdminAccount(adminAccountID string) error

DisableOrganizationAdminAccount removes an account as org admin.

func (*InMemoryBackend) DisassociateFromAdministratorAccount 

func (b *InMemoryBackend) DisassociateFromAdministratorAccount(detectorID string) error

DisassociateFromAdministratorAccount removes the administrator relationship.

func (*InMemoryBackend) DisassociateFromMasterAccount 

func (b *InMemoryBackend) DisassociateFromMasterAccount(detectorID string) error

DisassociateFromMasterAccount removes the legacy master relationship.

func (*InMemoryBackend) DisassociateMembers 

func (b *InMemoryBackend) DisassociateMembers(detectorID string, accountIDs []string) []map[string]any

DisassociateMembers disassociates member accounts from a detector.

func (*InMemoryBackend) EnableOrganizationAdminAccount 

func (b *InMemoryBackend) EnableOrganizationAdminAccount(adminAccountID string) error

EnableOrganizationAdminAccount designates an account as org admin.

func (*InMemoryBackend) GetAdministratorAccount 

func (b *InMemoryBackend) GetAdministratorAccount(detectorID string) (*AdminAccount, error)

GetAdministratorAccount returns the administrator account for a detector.

func (*InMemoryBackend) GetCoverageStatistics 

func (b *InMemoryBackend) GetCoverageStatistics(detectorID string) (map[string]any, error)

GetCoverageStatistics returns coverage statistics for a detector.

func (*InMemoryBackend) GetDetector 

func (b *InMemoryBackend) GetDetector(detectorID string) (*Detector, error)

GetDetector retrieves a detector by ID.

func (*InMemoryBackend) GetFilter 

func (b *InMemoryBackend) GetFilter(detectorID, filterName string) (*Filter, error)

GetFilter retrieves a filter.

func (*InMemoryBackend) GetFindings 

func (b *InMemoryBackend) GetFindings(detectorID string, findingIDs []string) ([]*Finding, error)

GetFindings returns findings by IDs.

func (*InMemoryBackend) GetFindingsStatistics 

func (b *InMemoryBackend) GetFindingsStatistics(detectorID string, q FindingStatisticsQuery) (map[string]any, error)

GetFindingsStatistics returns finding statistics for a detector. When q.GroupBy is unset it returns the deprecated countBySeverity aggregate (FindingStatistics.CountBySeverity); when set to one of ACCOUNT/DATE/FINDING_TYPE/RESOURCE/SEVERITY it returns the corresponding groupedByX list instead, matching real GuardDuty's documented behavior ("This parameter is deprecated. Please set GroupBy to 'SEVERITY' to return GroupedBySeverity instead.").

func (*InMemoryBackend) GetIPSet 

func (b *InMemoryBackend) GetIPSet(detectorID, ipSetID string) (*IPSet, error)

GetIPSet retrieves an IP set.

func (*InMemoryBackend) GetInvestigation added in v1.2.0 

func (b *InMemoryBackend) GetInvestigation(detectorID, investigationID string) (*Investigation, error)

GetInvestigation retrieves an investigation by ID.

func (*InMemoryBackend) GetInvitationsCount 

func (b *InMemoryBackend) GetInvitationsCount() int

GetInvitationsCount returns the count of pending invitations.

func (*InMemoryBackend) GetMalwareProtectionPlan 

func (b *InMemoryBackend) GetMalwareProtectionPlan(planID string) (*MalwareProtectionPlan, error)

GetMalwareProtectionPlan retrieves a malware protection plan.

func (*InMemoryBackend) GetMalwareScan 

func (b *InMemoryBackend) GetMalwareScan(scanID string) (*MalwareScan, error)

GetMalwareScan retrieves a malware scan by ID.

func (*InMemoryBackend) GetMalwareScanSettings 

func (b *InMemoryBackend) GetMalwareScanSettings(detectorID string) (*MalwareScanSettings, error)

GetMalwareScanSettings returns malware scan settings for a detector.

func (*InMemoryBackend) GetMasterAccount 

func (b *InMemoryBackend) GetMasterAccount(detectorID string) (*AdminAccount, error)

GetMasterAccount returns the legacy master account for a detector.

func (*InMemoryBackend) GetMemberDetectors 

func (b *InMemoryBackend) GetMemberDetectors(
	detectorID string,
	accountIDs []string,
) ([]map[string]any, []map[string]any)

GetMemberDetectors returns detector configurations for member accounts.

func (*InMemoryBackend) GetMembers 

func (b *InMemoryBackend) GetMembers(detectorID string, accountIDs []string) ([]*Member, []map[string]any)

GetMembers retrieves member account details.

func (*InMemoryBackend) GetOrganizationStatistics 

func (b *InMemoryBackend) GetOrganizationStatistics() map[string]any

GetOrganizationStatistics returns org-level statistics.

Real GetOrganizationStatisticsOutput wraps everything under a single organizationDetails object (types.OrganizationDetails), which itself carries updatedAt (epoch seconds) alongside the nested organizationStatistics object -- both were previously missing entirely. activeAccountsCount/totalAccountsCount/enabledAccountsCount/ memberAccountsCount are computed from the members table (the accounts actually associated with this account's GuardDuty organization), not orgAdminAccounts (a distinct concept: which accounts are *delegated administrators*, not which accounts are *members*).

func (*InMemoryBackend) GetRemainingFreeTrialDays 

func (b *InMemoryBackend) GetRemainingFreeTrialDays(detectorID string) (map[string]any, error)

GetRemainingFreeTrialDays returns remaining free trial days.

func (*InMemoryBackend) GetThreatEntitySet 

func (b *InMemoryBackend) GetThreatEntitySet(detectorID, setID string) (*ThreatEntitySet, error)

GetThreatEntitySet retrieves a threat entity set.

func (*InMemoryBackend) GetThreatIntelSet 

func (b *InMemoryBackend) GetThreatIntelSet(detectorID, setID string) (*ThreatIntelSet, error)

GetThreatIntelSet retrieves a threat intelligence set.

func (*InMemoryBackend) GetTrustedEntitySet 

func (b *InMemoryBackend) GetTrustedEntitySet(detectorID, setID string) (*TrustedEntitySet, error)

GetTrustedEntitySet retrieves a trusted entity set.

func (*InMemoryBackend) GetUsageStatistics 

func (b *InMemoryBackend) GetUsageStatistics(detectorID string, q UsageQuery) (map[string]any, error)

GetUsageStatistics returns usage statistics for a detector. Real GuardDuty accounting isn't modeled by this backend, so every Total is a deterministic zero amount; the fix here is emitting the real UsageStatistics wire shape (Total{amount,unit} objects, sumByFeature, topAccountsByFeature, topResources) instead of the old ad hoc field set, and honoring UsageStatisticType by nulling out every field except the one requested, per GetUsageStatisticsOutput's doc ("If a UsageStatisticType was provided, the objects representing other types will be null.").

func (*InMemoryBackend) InviteMembers 

func (b *InMemoryBackend) InviteMembers(detectorID string, accountIDs []string) []map[string]any

InviteMembers sends invitations to member accounts.

func (*InMemoryBackend) ListCoverage 

func (b *InMemoryBackend) ListCoverage(detectorID string) ([]map[string]any, error)

ListCoverage returns coverage resources for a detector.

func (*InMemoryBackend) ListDetectors 

func (b *InMemoryBackend) ListDetectors() []string

ListDetectors returns all detector IDs.

func (*InMemoryBackend) ListFilters 

func (b *InMemoryBackend) ListFilters(detectorID string) ([]string, error)

ListFilters returns filter names for a detector.

func (*InMemoryBackend) ListFindings 

func (b *InMemoryBackend) ListFindings(detectorID string, q FindingsQuery) ([]string, string, error)

ListFindings returns finding IDs for a detector, filtered by q.Criteria, sorted per q.SortAttr/q.SortOrder (defaulting to ID ascending), and paginated per q.MaxResults/q.NextToken.

func (*InMemoryBackend) ListIPSets 

func (b *InMemoryBackend) ListIPSets(detectorID string) ([]string, error)

ListIPSets returns IP set IDs for a detector.

func (*InMemoryBackend) ListInvestigations added in v1.2.0 

func (b *InMemoryBackend) ListInvestigations(
	detectorID string, q InvestigationsQuery,
) ([]*Investigation, string, error)

ListInvestigations returns investigations for a detector, sorted per q.SortAttr/q.SortOrder and paginated per q.MaxResults/q.NextToken.

Every investigation this backend ever creates has an identical Status (RUNNING) and empty EndTime/RiskLevel/Confidence -- see the Investigation type doc -- so START_TIME is the only sort attribute that can ever produce a real ordering; the others (END_TIME, STATUS, RISK_LEVEL, CONFIDENCE) are accepted without error (matching a real client that requests them) but resolve to the same StartTime-based order since there is nothing real to differentiate investigations by. This is not a gap: it is the honest consequence of every investigation being permanently RUNNING.

func (*InMemoryBackend) ListInvitations 

func (b *InMemoryBackend) ListInvitations() []*Invitation

ListInvitations returns all pending invitations.

func (*InMemoryBackend) ListMalwareProtectionPlans 

func (b *InMemoryBackend) ListMalwareProtectionPlans() []*MalwareProtectionPlan

ListMalwareProtectionPlans returns all malware protection plans.

func (*InMemoryBackend) ListMalwareScans 

func (b *InMemoryBackend) ListMalwareScans() []*MalwareScan

ListMalwareScans returns all malware scans globally.

func (*InMemoryBackend) ListMembers 

func (b *InMemoryBackend) ListMembers(detectorID string, onlyAssociated bool) ([]*Member, error)

ListMembers returns member accounts for a detector.

func (*InMemoryBackend) ListOrganizationAdminAccounts 

func (b *InMemoryBackend) ListOrganizationAdminAccounts() []*OrgAdminAccount

ListOrganizationAdminAccounts returns all org admin accounts.

func (*InMemoryBackend) ListPublishingDestinations 

func (b *InMemoryBackend) ListPublishingDestinations(detectorID string) ([]*PublishingDestination, error)

ListPublishingDestinations returns publishing destinations for a detector.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns tags for a resource.

func (*InMemoryBackend) ListThreatEntitySets 

func (b *InMemoryBackend) ListThreatEntitySets(detectorID string) ([]string, error)

ListThreatEntitySets returns threat entity set IDs for a detector.

func (*InMemoryBackend) ListThreatIntelSets 

func (b *InMemoryBackend) ListThreatIntelSets(detectorID string) ([]string, error)

ListThreatIntelSets returns threat intel set IDs for a detector.

func (*InMemoryBackend) ListTrustedEntitySets 

func (b *InMemoryBackend) ListTrustedEntitySets(detectorID string) ([]string, error)

ListTrustedEntitySets returns trusted entity set IDs for a detector.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the configured region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON. It implements persistence.Persistable via Handler.Restore (see below).

func (*InMemoryBackend) SendObjectMalwareScan 

func (b *InMemoryBackend) SendObjectMalwareScan(
	s3ObjectDetails map[string]any,
) (string, error)

SendObjectMalwareScan initiates a malware scan on an S3 object.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON. It implements persistence.Persistable via Handler.Snapshot (see below).

func (*InMemoryBackend) StartMalwareScan 

func (b *InMemoryBackend) StartMalwareScan(resourceARN string) (string, error)

StartMalwareScan initiates a malware scan.

StartMalwareScanInput carries no detectorId (a real client only supplies resourceArn) -- GuardDuty resolves the requesting account's own detector internally. This backend enforces the same "one detector per Region" model as CreateDetector, so it mirrors that by attaching the scan to whichever single detector exists for this account/region, if any (per GetMalwareScanOutput's doc: "If the customer is not a GuardDuty customer, this field will not be present").

func (*InMemoryBackend) StartMonitoringMembers 

func (b *InMemoryBackend) StartMonitoringMembers(detectorID string, accountIDs []string) []map[string]any

StartMonitoringMembers starts monitoring member accounts.

func (*InMemoryBackend) StopMonitoringMembers 

func (b *InMemoryBackend) StopMonitoringMembers(detectorID string, accountIDs []string) []map[string]any

StopMonitoringMembers stops monitoring member accounts.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource sets tags on a resource.

func (*InMemoryBackend) UnarchiveFindings 

func (b *InMemoryBackend) UnarchiveFindings(detectorID string, findingIDs []string) error

UnarchiveFindings marks findings as unarchived.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateDetector 

func (b *InMemoryBackend) UpdateDetector(
	detectorID string,
	enable *bool,
	frequency string,
	features []DetectorFeature,
) error

UpdateDetector updates a detector's configuration.

func (*InMemoryBackend) UpdateFilter 

func (b *InMemoryBackend) UpdateFilter(
	detectorID, filterName, description, action string,
	rank int32,
	findingCriteria map[string]any,
) (*Filter, error)

UpdateFilter updates a filter's configuration.

func (*InMemoryBackend) UpdateFindingsFeedback 

func (b *InMemoryBackend) UpdateFindingsFeedback(detectorID string, findingIDs []string, feedback string) error

UpdateFindingsFeedback updates the feedback for findings.

func (*InMemoryBackend) UpdateIPSet 

func (b *InMemoryBackend) UpdateIPSet(detectorID, ipSetID, name, location string, activate *bool) error

UpdateIPSet updates an IP set.

func (*InMemoryBackend) UpdateMalwareProtectionPlan 

func (b *InMemoryBackend) UpdateMalwareProtectionPlan(
	planID, role string,
	protectedResource, actions map[string]any,
) error

UpdateMalwareProtectionPlan updates a malware protection plan.

func (*InMemoryBackend) UpdateMalwareScanSettings 

func (b *InMemoryBackend) UpdateMalwareScanSettings(
	detectorID string,
	settings *MalwareScanSettings,
) error

UpdateMalwareScanSettings updates malware scan settings for a detector.

func (*InMemoryBackend) UpdateMemberDetectors 

func (b *InMemoryBackend) UpdateMemberDetectors(
	detectorID string,
	accountIDs []string,
) []map[string]any

UpdateMemberDetectors updates detector configurations for member accounts.

func (*InMemoryBackend) UpdateOrganizationConfiguration 

func (b *InMemoryBackend) UpdateOrganizationConfiguration(
	detectorID string,
	autoEnable bool,
	features []OrgFeature,
) error

UpdateOrganizationConfiguration updates org config for a detector.

func (*InMemoryBackend) UpdatePublishingDestination 

func (b *InMemoryBackend) UpdatePublishingDestination(
	detectorID, destID string,
	props DestinationProperties,
) error

UpdatePublishingDestination updates a publishing destination.

func (*InMemoryBackend) UpdateThreatEntitySet 

func (b *InMemoryBackend) UpdateThreatEntitySet(
	detectorID, setID, name, location string,
	activate *bool,
	expectedBucketOwner string,
) error

UpdateThreatEntitySet updates a threat entity set.

func (*InMemoryBackend) UpdateThreatIntelSet 

func (b *InMemoryBackend) UpdateThreatIntelSet(detectorID, setID, name, location string, activate *bool) error

UpdateThreatIntelSet updates a threat intelligence set.

func (*InMemoryBackend) UpdateTrustedEntitySet 

func (b *InMemoryBackend) UpdateTrustedEntitySet(
	detectorID, setID, name, location string,
	activate *bool,
	expectedBucketOwner string,
) error

UpdateTrustedEntitySet updates a trusted entity set.

type Investigation added in v1.2.0 

type Investigation struct {
	StartTime       time.Time `json:"startTime"`
	EndTime         time.Time `json:"endTime"`
	InvestigationID string    `json:"investigationId"`
	Status          string    `json:"status"`
	TriggerPrompt   string    `json:"triggerPrompt"`
	TriggeredBy     string    `json:"triggeredBy"`
	Confidence      string    `json:"confidence,omitempty"`
	RiskLevel       string    `json:"riskLevel,omitempty"`
	Risk            string    `json:"risk,omitempty"`
	ErrorDetail     string    `json:"error,omitempty"`
	Summary         string    `json:"summary,omitempty"`
	DetectorID      string    `json:"-"`
}

Investigation represents a GuardDuty Extended Threat Detection investigation (CreateInvestigation/GetInvestigation/ListInvestigations).

This backend has no threat-analysis engine: it cannot correlate findings, perform account-level analysis, score risk/confidence, or produce a natural-language summary. Every investigation this backend creates is therefore modeled honestly as perpetually RUNNING -- the same treatment this package already gives MalwareScan, which for the identical reason never transitions out of RUNNING either (see GetMalwareScan's PARITY.md note: "this backend's scans never transition to SKIPPED/COMPLETED/ FAILED").

Cloud, Confidence, Error, Metadata, Risk, RiskLevel, EndTime, and Summary are real *optional* members on types.Investigation/types.InvestigationSummary that AWS only populates once analysis actually runs (Cloud/Metadata) or completes/fails (Confidence/EndTime/Error/Risk/RiskLevel/Summary). Since that never happens here, they stay at their zero value below and every wire response correctly omits them -- see handler_investigations.go -- rather than fabricating severity scores, threat indicators, related findings, or anomaly counts this emulator has no way to compute for real.

type InvestigationSortCriteria added in v1.2.0 

type InvestigationSortCriteria struct {
	AttributeName string `json:"attributeName"`
	OrderBy       string `json:"orderBy"`
}

InvestigationSortCriteria mirrors types.InvestigationSortCriteria's wire shape (attributeName/orderBy) for request parsing.

type InvestigationsQuery added in v1.2.0 

type InvestigationsQuery struct {
	SortAttr   string
	SortOrder  string
	NextToken  string
	MaxResults int32
}

InvestigationsQuery holds the optional sort/pagination parameters for ListInvestigations, mirroring types.ListInvestigationsInput's SortCriteria, MaxResults, and NextToken fields.

type Invitation 

type Invitation struct {
	AccountID          string `json:"accountId"`
	InvitationID       string `json:"invitationId"`
	InvitedAt          string `json:"invitedAt"`
	RelationshipStatus string `json:"relationshipStatus"`
}

Invitation represents a pending GuardDuty invitation.

type MalwareProtectionPlan 

type MalwareProtectionPlan struct {
	CreatedAt               time.Time         `json:"createdAt"`
	ProtectedResource       map[string]any    `json:"protectedResource"`
	Actions                 map[string]any    `json:"actions"`
	Tags                    map[string]string `json:"tags,omitempty"`
	MalwareProtectionPlanID string            `json:"malwareProtectionPlanId"`
	Arn                     string            `json:"arn"`
	Role                    string            `json:"role"`
	Status                  string            `json:"status"`
	StatusReasons           []any             `json:"statusReasons"`
}

MalwareProtectionPlan represents a malware protection plan.

type MalwareProtectionPlanActionsInput added in v1.2.0 

type MalwareProtectionPlanActionsInput struct {
	Tagging *MalwareProtectionPlanTaggingActionInput `json:"tagging,omitempty"`
}

MalwareProtectionPlanActionsInput mirrors types.MalwareProtectionPlanActions.

type MalwareProtectionPlanTaggingActionInput added in v1.2.0 

type MalwareProtectionPlanTaggingActionInput struct {
	Status string `json:"status,omitempty"`
}

MalwareProtectionPlanTaggingActionInput mirrors types.MalwareProtectionPlanTaggingAction. Status must be one of the real MalwareProtectionPlanTaggingActionStatus enum values (ENABLED/DISABLED).

type MalwareScan 

type MalwareScan struct {
	ScanID                string         `json:"scanId"`
	DetectorID            string         `json:"detectorId"`
	AdminDetectorID       string         `json:"adminDetectorId,omitempty"`
	AccountID             string         `json:"accountId"`
	ResourceArn           string         `json:"resourceArn,omitempty"`
	ResourceType          string         `json:"resourceType,omitempty"`
	ScanCategory          string         `json:"scanCategory,omitempty"`
	ScanStartTime         time.Time      `json:"scanStartTime"`
	ScanEndTime           time.Time      `json:"scanEndTime"`
	ScanStatus            string         `json:"scanStatus"`
	ScanType              string         `json:"scanType"`
	ScanStatusReason      string         `json:"scanStatusReason,omitempty"`
	TriggerDetails        map[string]any `json:"triggerDetails"`
	ResourceDetails       map[string]any `json:"resourceDetails"`
	Findings              []any          `json:"findings"`
	ScannedResourcesCount int32          `json:"scannedResourcesCount"`
	SkippedResourcesCount int32          `json:"skippedResourcesCount"`
	FailedResourcesCount  int32          `json:"failedResourcesCount"`
}

MalwareScan represents a GuardDuty malware scan result. It backs both the older Scan shape (DescribeMalwareScans/ListMalwareScans) and the richer, distinct GetMalwareScanOutput shape (see handleGetMalwareScan) -- the two real API shapes only share scanId/detectorId/scanStatus/scanType by name, so this struct is a superset covering both.

type MalwareScanSettings 

type MalwareScanSettings struct {
	ScanResourceCriteria    map[string]any `json:"scanResourceCriteria"`
	EbsSnapshotPreservation string         `json:"ebsSnapshotPreservation"`
	// contains filtered or unexported fields
}

MalwareScanSettings holds malware scan configuration for a detector.

type Member 

type Member struct {
	UpdatedAt          time.Time `json:"updatedAt"`
	AccountID          string    `json:"accountId"`
	AdministratorID    string    `json:"administratorId"`
	MasterID           string    `json:"masterId"`
	DetectorID         string    `json:"detectorId"`
	Email              string    `json:"email"`
	RelationshipStatus string    `json:"relationshipStatus"`
	InvitedAt          string    `json:"invitedAt"`
}

Member represents a GuardDuty member account.

type OrgAdminAccount 

type OrgAdminAccount struct {
	AdminAccountID string `json:"adminAccountId"`
	AdminStatus    string `json:"adminStatus"`
}

OrgAdminAccount represents an organization admin account.

type OrgConfig 

type OrgConfig struct {
	DataSources map[string]any `json:"dataSources"`

	Features                  []OrgFeature `json:"features"`
	AutoEnable                bool         `json:"autoEnable"`
	MemberAccountLimitReached bool         `json:"memberAccountLimitReached"`
	// contains filtered or unexported fields
}

OrgConfig holds org-level GuardDuty configuration.

type OrgFeature 

type OrgFeature struct {
	AutoEnable string `json:"autoEnable"`
	Name       string `json:"name"`
}

OrgFeature holds org-level feature configuration.

type ProtectedResourceInput added in v1.2.0 

type ProtectedResourceInput struct {
	S3Bucket *S3BucketResourceInput `json:"s3Bucket,omitempty"`
}

ProtectedResourceInput mirrors types.CreateProtectedResource (also reused verbatim by GetMalwareProtectionPlanOutput.ProtectedResource -- Create and Get share the same shape on the real API). "Presently, S3Bucket is the only supported protected resource" per the SDK doc comment, so it is the only member modeled.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS GuardDuty.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the GuardDuty service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type PublishingDestination 

type PublishingDestination struct {
	DestinationProperties      DestinationProperties `json:"destinationProperties"`
	Tags                       map[string]string     `json:"tags,omitempty"`
	DestinationID              string                `json:"destinationId"`
	DestinationType            string                `json:"destinationType"`
	Status                     string                `json:"status"`
	ServicePrincipal           string                `json:"servicePrincipal,omitempty"`
	DetectorID                 string                `json:"-"`
	PublishingFailureStartedAt int64                 `json:"publishingFailureStartedAt,omitempty"`
}

PublishingDestination represents a GuardDuty publishing destination.

type S3BucketResourceInput added in v1.2.0 

type S3BucketResourceInput struct {
	BucketName     string   `json:"bucketName,omitempty"`
	ObjectPrefixes []string `json:"objectPrefixes,omitempty"`
}

S3BucketResourceInput mirrors types.CreateS3BucketResource.

type SortCriteria added in v1.2.0 

type SortCriteria struct {
	AttributeName string `json:"attributeName,omitempty"`
	OrderBy       string `json:"orderBy,omitempty"`
}

SortCriteria represents the sort ordering for ListFindings, matching types.SortCriteria.

type StorageBackend 

type StorageBackend interface {
	CreateDetector(enable bool, frequency string, tags map[string]string, features []DetectorFeature) (*Detector, error)
	GetDetector(detectorID string) (*Detector, error)
	UpdateDetector(detectorID string, enable *bool, frequency string, features []DetectorFeature) error
	DeleteDetector(detectorID string) error
	ListDetectors() []string

	CreateFilter(
		detectorID, name, description, action string,
		rank int32,
		findingCriteria map[string]any,
		tags map[string]string,
	) (*Filter, error)
	GetFilter(detectorID, filterName string) (*Filter, error)
	UpdateFilter(
		detectorID, filterName, description, action string,
		rank int32,
		findingCriteria map[string]any,
	) (*Filter, error)
	DeleteFilter(detectorID, filterName string) error
	ListFilters(detectorID string) ([]string, error)

	GetFindings(detectorID string, findingIDs []string) ([]*Finding, error)
	ListFindings(detectorID string, query FindingsQuery) (ids []string, nextToken string, err error)
	ArchiveFindings(detectorID string, findingIDs []string) error
	UnarchiveFindings(detectorID string, findingIDs []string) error
	CreateSampleFindings(detectorID string, findingTypes []string) error
	GetFindingsStatistics(detectorID string, query FindingStatisticsQuery) (map[string]any, error)
	UpdateFindingsFeedback(detectorID string, findingIDs []string, feedback string) error

	CreateIPSet(detectorID, name, format, location string, activate bool, tags map[string]string) (*IPSet, error)
	GetIPSet(detectorID, ipSetID string) (*IPSet, error)
	UpdateIPSet(detectorID, ipSetID, name, location string, activate *bool) error
	DeleteIPSet(detectorID, ipSetID string) error
	ListIPSets(detectorID string) ([]string, error)

	CreateThreatIntelSet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
	) (*ThreatIntelSet, error)
	GetThreatIntelSet(detectorID, setID string) (*ThreatIntelSet, error)
	UpdateThreatIntelSet(detectorID, setID, name, location string, activate *bool) error
	DeleteThreatIntelSet(detectorID, setID string) error
	ListThreatIntelSets(detectorID string) ([]string, error)

	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Member management
	CreateMembers(detectorID string, accountDetails []map[string]any) ([]*Member, []map[string]any)
	DeleteMembers(detectorID string, accountIDs []string) []map[string]any
	GetMembers(detectorID string, accountIDs []string) ([]*Member, []map[string]any)
	InviteMembers(detectorID string, accountIDs []string) []map[string]any
	ListMembers(detectorID string, onlyAssociated bool) ([]*Member, error)
	StartMonitoringMembers(detectorID string, accountIDs []string) []map[string]any
	StopMonitoringMembers(detectorID string, accountIDs []string) []map[string]any
	DisassociateMembers(detectorID string, accountIDs []string) []map[string]any
	GetMemberDetectors(detectorID string, accountIDs []string) ([]map[string]any, []map[string]any)
	UpdateMemberDetectors(detectorID string, accountIDs []string) []map[string]any

	// Invitation management
	AcceptAdministratorInvitation(detectorID, administratorID, invitationID string) error
	AcceptInvitation(detectorID, masterID, invitationID string) error
	GetAdministratorAccount(detectorID string) (*AdminAccount, error)
	GetMasterAccount(detectorID string) (*AdminAccount, error)
	DisassociateFromAdministratorAccount(detectorID string) error
	DisassociateFromMasterAccount(detectorID string) error
	DeclineInvitations(accountIDs []string) []map[string]any
	DeleteInvitations(accountIDs []string) []map[string]any
	GetInvitationsCount() int
	ListInvitations() []*Invitation

	// Organization management
	EnableOrganizationAdminAccount(adminAccountID string) error
	DisableOrganizationAdminAccount(adminAccountID string) error
	ListOrganizationAdminAccounts() []*OrgAdminAccount
	DescribeOrganizationConfiguration(detectorID string) (*OrgConfig, error)
	UpdateOrganizationConfiguration(detectorID string, autoEnable bool, features []OrgFeature) error
	GetOrganizationStatistics() map[string]any

	// Publishing destinations
	CreatePublishingDestination(
		detectorID, destType string,
		props DestinationProperties,
		tags map[string]string,
	) (*PublishingDestination, error)
	DeletePublishingDestination(detectorID, destID string) error
	DescribePublishingDestination(detectorID, destID string) (*PublishingDestination, error)
	ListPublishingDestinations(detectorID string) ([]*PublishingDestination, error)
	UpdatePublishingDestination(detectorID, destID string, props DestinationProperties) error

	// Malware scanning
	DescribeMalwareScans(detectorID string) ([]*MalwareScan, error)
	ListMalwareScans() []*MalwareScan
	StartMalwareScan(resourceARN string) (string, error)
	GetMalwareScan(scanID string) (*MalwareScan, error)
	GetMalwareScanSettings(detectorID string) (*MalwareScanSettings, error)
	UpdateMalwareScanSettings(detectorID string, settings *MalwareScanSettings) error
	GetUsageStatistics(detectorID string, query UsageQuery) (map[string]any, error)
	GetRemainingFreeTrialDays(detectorID string) (map[string]any, error)
	GetCoverageStatistics(detectorID string) (map[string]any, error)
	ListCoverage(detectorID string) ([]map[string]any, error)

	// Malware protection plans
	CreateMalwareProtectionPlan(
		role string,
		protectedResource, actions map[string]any,
		tags map[string]string,
	) (*MalwareProtectionPlan, error)
	DeleteMalwareProtectionPlan(planID string) error
	GetMalwareProtectionPlan(planID string) (*MalwareProtectionPlan, error)
	ListMalwareProtectionPlans() []*MalwareProtectionPlan
	UpdateMalwareProtectionPlan(planID, role string, protectedResource, actions map[string]any) error
	SendObjectMalwareScan(s3ObjectDetails map[string]any) (string, error)

	// Threat entity sets
	CreateThreatEntitySet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
		expectedBucketOwner string,
	) (*ThreatEntitySet, error)
	GetThreatEntitySet(detectorID, setID string) (*ThreatEntitySet, error)
	ListThreatEntitySets(detectorID string) ([]string, error)
	UpdateThreatEntitySet(detectorID, setID, name, location string, activate *bool, expectedBucketOwner string) error
	DeleteThreatEntitySet(detectorID, setID string) error

	// Trusted entity sets
	CreateTrustedEntitySet(
		detectorID, name, format, location string,
		activate bool,
		tags map[string]string,
		expectedBucketOwner string,
	) (*TrustedEntitySet, error)
	GetTrustedEntitySet(detectorID, setID string) (*TrustedEntitySet, error)
	ListTrustedEntitySets(detectorID string) ([]string, error)
	UpdateTrustedEntitySet(detectorID, setID, name, location string, activate *bool, expectedBucketOwner string) error
	DeleteTrustedEntitySet(detectorID, setID string) error

	// Investigations (GuardDuty Extended Threat Detection)
	CreateInvestigation(detectorID, triggerPrompt string) (*Investigation, error)
	GetInvestigation(detectorID, investigationID string) (*Investigation, error)
	ListInvestigations(
		detectorID string, q InvestigationsQuery,
	) (investigations []*Investigation, nextToken string, err error)

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for GuardDuty storage operations.

type ThreatEntitySet 

type ThreatEntitySet struct {
	CreatedAt           time.Time         `json:"createdAt"`
	UpdatedAt           time.Time         `json:"updatedAt"`
	Tags                map[string]string `json:"tags,omitempty"`
	ThreatEntitySetID   string            `json:"threatEntitySetId"`
	DetectorID          string            `json:"-"`
	Name                string            `json:"name"`
	Format              string            `json:"format"`
	Location            string            `json:"location"`
	Status              string            `json:"status"`
	ExpectedBucketOwner string            `json:"expectedBucketOwner,omitempty"`
}

ThreatEntitySet represents a GuardDuty threat entity set.

type ThreatIntelSet 

type ThreatIntelSet struct {
	CreatedAt        time.Time         `json:"createdAt"`
	UpdatedAt        time.Time         `json:"updatedAt"`
	ThreatIntelSetID string            `json:"threatIntelSetId"`
	Name             string            `json:"name"`
	Format           string            `json:"format"`
	Location         string            `json:"location"`
	Status           string            `json:"status"`
	Tags             map[string]string `json:"tags,omitempty"`
	DetectorID       string            `json:"-"`
}

ThreatIntelSet represents a GuardDuty threat intelligence set.

type TrustedEntitySet 

type TrustedEntitySet struct {
	CreatedAt           time.Time         `json:"createdAt"`
	UpdatedAt           time.Time         `json:"updatedAt"`
	Tags                map[string]string `json:"tags,omitempty"`
	TrustedEntitySetID  string            `json:"trustedEntitySetId"`
	DetectorID          string            `json:"-"`
	Name                string            `json:"name"`
	Format              string            `json:"format"`
	Location            string            `json:"location"`
	Status              string            `json:"status"`
	ExpectedBucketOwner string            `json:"expectedBucketOwner,omitempty"`
}

TrustedEntitySet represents a GuardDuty trusted entity set.

type UpdateProtectedResourceInput added in v1.2.0 

type UpdateProtectedResourceInput struct {
	S3Bucket *UpdateS3BucketResourceInput `json:"s3Bucket,omitempty"`
}

UpdateProtectedResourceInput mirrors types.UpdateProtectedResource. Unlike the create shape, its S3Bucket has no bucketName -- a plan's protected bucket can't be renamed after creation, only its object prefixes updated.

type UpdateS3BucketResourceInput added in v1.2.0 

type UpdateS3BucketResourceInput struct {
	ObjectPrefixes []string `json:"objectPrefixes,omitempty"`
}

UpdateS3BucketResourceInput mirrors types.UpdateS3BucketResource.

type UsageQuery added in v1.2.0 

type UsageQuery struct {
	StatisticType string
	Unit          string
	AccountIDs    []string
	Features      []string
}

UsageQuery holds the optional criteria/type parameters for GetUsageStatistics, mirroring types.GetUsageStatisticsInput's UsageCriteria, UsageStatisticType, and Unit fields.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.