DetectionRuleOrgConfiguration - Amazon GuardDuty
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

DetectionRuleOrgConfiguration

Contains the organization-level configuration for a custom detection rule.

Contents

createdAt

The timestamp when the organization configuration was created.

Type: Timestamp

Required: Yes

excludeAccountIds

A list of member account IDs excluded from the organization configuration. Mutually exclusive with IncludeAccountIds.

Type: Array of strings

Array Members: Minimum number of 0 items. Maximum number of 50000 items.

Length Constraints: Fixed length of 12.

Required: Yes

includeAccountIds

A list of member account IDs included in the organization configuration. Mutually exclusive with ExcludeAccountIds.

Type: Array of strings

Array Members: Minimum number of 0 items. Maximum number of 50000 items.

Length Constraints: Fixed length of 12.

Required: Yes

mode

The execution mode of the organization configuration. Valid values: LIVE | DRY_RUN.

Type: String

Valid Values: LIVE | DRY_RUN

Required: Yes

ruleId

The unique identifier for the custom detection rule.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 100.

Pattern: [a-z0-9]+(-[a-z0-9]+)*

Required: Yes

status

The configuration status. Valid values: ACTIVE | PROCESSING | FAILED.

Type: String

Valid Values: ACTIVE | PROCESSING | FAILED

Required: Yes

updatedAt

The timestamp when the organization configuration was last updated.

Type: Timestamp

Required: Yes

expiresAt

The timestamp when the organization configuration expires.

Type: Timestamp

Required: No

statusReason

The reason for the current configuration status.

Type: String

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: