aws-sdk-guardduty 1.107.0 → 1.109.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 854873401858e098e0ff72c0ae6ead8441db9dbc411cd9fcfcae7cb0509e630d
-  data.tar.gz: 64105ff6e676df62eb72baa459eff8b596ec430211850cd4d994faaff95dea64
+  metadata.gz: 4144b58fd8c227c46907bb8b9eb5e88b95e494b9fcb70b99aad1bb713d3883e0
+  data.tar.gz: c0409cefa3900a39acfb545a71dfe35d5cd6e55d8aa4a585708f4148d18ff697
 SHA512:
-  metadata.gz: b80fb4809cdbdcada212c8a6d224a09b54dbfa92f8a41302d03e876abe20ed9b7d303a0165ddf7223bde66cebc13627063705022ff2f7e4e36a99dc82cb39c84
-  data.tar.gz: 8ea2c700244d412f3856c6854b8c5980625730876a28a738afcaa961b0f0bf5648f89b1f0e4374eca9e6c62aa67b924a6d378d888a529cc6e1b9b31b534e9098
+  metadata.gz: 3cbb78cd0043cb6bae9d4019d9daa557f24cc428c9f6ee3f8838182b689c37af65e72aef8b98fae05208e19c4712b0e556bca0a498d3c9907bade325b630272e
+  data.tar.gz: 7c5ce7c8a2ad9a9704a04c089b8d19064e63a764d0034e9eb93f51f0e2834ce53dec7dc70ada2107fffe94d9db1d33da3cfa53f9a61f0d3afa7a22e8b8376a5e

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.109.0 (2024-12-12)
+------------------
+
+* Feature - Improved descriptions for certain APIs.
+
+1.108.0 (2024-12-02)
+------------------
+
+* Feature - Add new Multi Domain Correlation findings.
+
 1.107.0 (2024-11-18)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.107.0
+1.109.0

data/lib/aws-sdk-guardduty/client.rb

@@ -740,9 +740,11 @@ module Aws::GuardDuty
     #
     #     * **Medium**: `["4", "5", "6"]`
     #
-    #     * **High**: `["7", "8", "9"]`
-    #     For more information, see [Severity levels for GuardDuty
-    #     findings][2].
+    #     * **High**: `["7", "8"]`
+    #
+    #     * **Critical**: `["9", "10"]`
+    #     For more information, see [Findings severity levels][2] in the
+    #     *Amazon GuardDuty User Guide*.
     #
     #   * type
     #
@@ -933,7 +935,7 @@ module Aws::GuardDuty
     #
     #
     #   [1]: https://docs.aws.amazon.com/guardduty/latest/APIReference/API_FindingCriteria.html
-    #   [2]: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html#guardduty_findings-severity
+    #   [2]: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings-severity.html
     #
     # @option params [String] :client_token
     #   The idempotency token for the create request.
@@ -2877,6 +2879,117 @@ module Aws::GuardDuty
     #   resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].profile_subtype #=> String, one of "FREQUENT", "INFREQUENT", "UNSEEN", "RARE"
     #   resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].observations.text #=> Array
     #   resp.findings[0].service.detection.anomaly.unusual.behavior["String"]["String"].observations.text[0] #=> String
+    #   resp.findings[0].service.detection.sequence.uid #=> String
+    #   resp.findings[0].service.detection.sequence.description #=> String
+    #   resp.findings[0].service.detection.sequence.actors #=> Array
+    #   resp.findings[0].service.detection.sequence.actors[0].id #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.name #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.uid #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.type #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.credential_uid #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.account.uid #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].user.account.name #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].session.uid #=> String
+    #   resp.findings[0].service.detection.sequence.actors[0].session.mfa_status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.findings[0].service.detection.sequence.actors[0].session.created_time #=> Time
+    #   resp.findings[0].service.detection.sequence.actors[0].session.issuer #=> String
+    #   resp.findings[0].service.detection.sequence.resources #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].uid #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].name #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].account_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].resource_type #=> String, one of "EC2_INSTANCE", "EC2_NETWORK_INTERFACE", "S3_BUCKET", "S3_OBJECT", "ACCESS_KEY"
+    #   resp.findings[0].service.detection.sequence.resources[0].region #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].service #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].cloud_partition #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].tags #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].tags[0].key #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].tags[0].value #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.owner_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.created_at #=> Time
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.encryption_type #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.encryption_key_arn #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.effective_permission #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.public_read_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.public_write_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.account_public_access.public_acl_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.account_public_access.public_policy_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.account_public_access.public_acl_ignore_behavior #=> String, one of "IGNORED", "NOT_IGNORED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.account_public_access.public_bucket_restrict_behavior #=> String, one of "RESTRICTED", "NOT_RESTRICTED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.bucket_public_access.public_acl_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.bucket_public_access.public_policy_access #=> String, one of "BLOCKED", "ALLOWED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.bucket_public_access.public_acl_ignore_behavior #=> String, one of "IGNORED", "NOT_IGNORED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.bucket_public_access.public_bucket_restrict_behavior #=> String, one of "RESTRICTED", "NOT_RESTRICTED"
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.s3_object_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_bucket.s3_object_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.availability_zone #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.image_description #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.instance_state #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.iam_instance_profile.arn #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.iam_instance_profile.id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.instance_type #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.outpost_arn #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.platform #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.product_codes #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.product_codes[0].code #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.product_codes[0].product_type #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.ec2_network_interface_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_instance.ec2_network_interface_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.access_key.principal_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.access_key.user_name #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.access_key.user_type #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.ipv_6_addresses #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.ipv_6_addresses[0] #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.private_ip_addresses #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.private_ip_addresses[0].private_dns_name #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.private_ip_addresses[0].private_ip_address #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.public_ip #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.security_groups #=> Array
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.security_groups[0].group_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.security_groups[0].group_name #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.sub_net_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.ec2_network_interface.vpc_id #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_object.etag #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_object.key #=> String
+    #   resp.findings[0].service.detection.sequence.resources[0].data.s3_object.version_id #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints #=> Array
+    #   resp.findings[0].service.detection.sequence.endpoints[0].id #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].ip #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].domain #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].port #=> Integer
+    #   resp.findings[0].service.detection.sequence.endpoints[0].location.city #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].location.country #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].location.latitude #=> Float
+    #   resp.findings[0].service.detection.sequence.endpoints[0].location.longitude #=> Float
+    #   resp.findings[0].service.detection.sequence.endpoints[0].autonomous_system.name #=> String
+    #   resp.findings[0].service.detection.sequence.endpoints[0].autonomous_system.number #=> Integer
+    #   resp.findings[0].service.detection.sequence.endpoints[0].connection.direction #=> String, one of "INBOUND", "OUTBOUND"
+    #   resp.findings[0].service.detection.sequence.signals #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].uid #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].type #=> String, one of "FINDING", "CLOUD_TRAIL", "S3_DATA_EVENTS"
+    #   resp.findings[0].service.detection.sequence.signals[0].description #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].name #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].created_at #=> Time
+    #   resp.findings[0].service.detection.sequence.signals[0].updated_at #=> Time
+    #   resp.findings[0].service.detection.sequence.signals[0].first_seen_at #=> Time
+    #   resp.findings[0].service.detection.sequence.signals[0].last_seen_at #=> Time
+    #   resp.findings[0].service.detection.sequence.signals[0].severity #=> Float
+    #   resp.findings[0].service.detection.sequence.signals[0].count #=> Integer
+    #   resp.findings[0].service.detection.sequence.signals[0].resource_uids #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].resource_uids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].actor_ids #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].actor_ids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].endpoint_ids #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].endpoint_ids[0] #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].key #=> String, one of "SUSPICIOUS_USER_AGENT", "SUSPICIOUS_NETWORK", "MALICIOUS_IP", "TOR_IP", "ATTACK_TACTIC", "HIGH_RISK_API", "ATTACK_TECHNIQUE", "UNUSUAL_API_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_USER"
+    #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].values #=> Array
+    #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].values[0] #=> String
+    #   resp.findings[0].service.detection.sequence.signals[0].signal_indicators[0].title #=> String
+    #   resp.findings[0].service.detection.sequence.sequence_indicators #=> Array
+    #   resp.findings[0].service.detection.sequence.sequence_indicators[0].key #=> String, one of "SUSPICIOUS_USER_AGENT", "SUSPICIOUS_NETWORK", "MALICIOUS_IP", "TOR_IP", "ATTACK_TACTIC", "HIGH_RISK_API", "ATTACK_TECHNIQUE", "UNUSUAL_API_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_ACCOUNT", "UNUSUAL_ASN_FOR_USER"
+    #   resp.findings[0].service.detection.sequence.sequence_indicators[0].values #=> Array
+    #   resp.findings[0].service.detection.sequence.sequence_indicators[0].values[0] #=> String
+    #   resp.findings[0].service.detection.sequence.sequence_indicators[0].title #=> String
     #   resp.findings[0].service.malware_scan_details.threats #=> Array
     #   resp.findings[0].service.malware_scan_details.threats[0].name #=> String
     #   resp.findings[0].service.malware_scan_details.threats[0].source #=> String
@@ -2887,6 +3000,7 @@ module Aws::GuardDuty
     #   resp.findings[0].title #=> String
     #   resp.findings[0].type #=> String
     #   resp.findings[0].updated_at #=> String
+    #   resp.findings[0].associated_attack_sequence_arn #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/GetFindings AWS API Documentation
     #
@@ -5216,8 +5330,10 @@ module Aws::GuardDuty
     #   [1]: https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html
     #
     # @option params [Boolean] :auto_enable
-    #   Represents whether or not to automatically enable member accounts in
-    #   the organization.
+    #   Represents whether to automatically enable member accounts in the
+    #   organization. This applies to only new member accounts, not the
+    #   existing member accounts. When a new account joins the organization,
+    #   the chosen features will be enabled for them by default.
     #
     #   Even though this is still supported, we recommend using
     #   `AutoEnableOrganizationMembers` to achieve the similar results. You
@@ -5418,7 +5534,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.107.0'
+      context[:gem_version] = '1.109.0'
       Seahorse::Client::Request.new(handlers, context)
     end