aws-sdk-guardduty 1.152.0 → 1.154.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d502c850ab12f48dc216cf03843b4abe72bb3b669c17d28143fd17fc541360ab
-  data.tar.gz: 0d4e8b59300ba19ff626e9181cacc80414dc7cc324e1a5000f71096892db5d2d
+  metadata.gz: 52bcf647e9275664f8705f5cf312175aea0f4de960cecb5e7be5e88cefb993f1
+  data.tar.gz: b707f5264aeec56481c7aefd48e6846f9847014a7cad5d9a05ba297ca9960f6b
 SHA512:
-  metadata.gz: 29e5f596e7279a277678b29755217884a14939f2689f5e0867e8844120c8ae6196dbbd45acae87e72fe9a025793d536a8d0b4eb8c5baa8d6e0cea848f171d74b
-  data.tar.gz: 01be69ae980d58697d77aeed318c8a4c9992ac716d2afe6263e3eb4f4e3fd3e0d1c1cdb163566c3573c27d3efd277742c1b220b2d9c3b61bc74ce41a8356ac06
+  metadata.gz: c9e426ff95aac71fd0f7847feb060d592115df28b7425dd70a46191c066aad140737f8fdd06adbd3c1a3d5f2fae02f82eeec3640b59e854f1562f2df716b5833
+  data.tar.gz: 16cc33db93b74f911e79dabbf60f4889a830140776502dbaf8fa2058cd061f92f8a2467c7e35564499db04a36660a45f875cb70f40004f5e0e737953f7908c22

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.154.0 (2026-06-04)
+------------------
+
+* Feature - Remove unsupported RDS field for filter
+
+1.153.0 (2026-06-02)
+------------------
+
+* Feature - Amazon GuardDuty Runtime Monitoring now supports 3 new SensitiveFileModified finding types (Persistence, PrivilegeEscalation, DefenseEvasion) that detect when security-sensitive system files are modified on EC2 instances or containers, indicating potential compromise through file tampering.
+
 1.152.0 (2026-05-26)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.152.0
+1.154.0

data/lib/aws-sdk-guardduty/client.rb

@@ -764,8 +764,6 @@ module Aws::GuardDuty
     #
     #     Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000
     #
-    #   * description
-    #
     #   * id
     #
     #   * partition
@@ -1100,10 +1098,6 @@ module Aws::GuardDuty
     #
     #   * resource.rdsDbInstanceDetails.publiclyAccessible
     #
-    #   * resource.rdsDbInstanceDetails.tags.key
-    #
-    #   * resource.rdsDbInstanceDetails.tags.value
-    #
     #   * resource.rdsDbInstanceDetails.vpcId
     #
     #   * resource.rdsDbInstanceDetails.vpcSecurityGroups.status
@@ -1202,8 +1196,6 @@ module Aws::GuardDuty
     #
     #   * service.action.actionType
     #
-    #   * service.action.awsApiCallAction.affectedResources
-    #
     #   * service.action.awsApiCallAction.api
     #
     #   * service.action.awsApiCallAction.callerType
@@ -1492,10 +1484,6 @@ module Aws::GuardDuty
     #
     #   * service.count
     #
-    #   * service.detection.anomaly.profiles
-    #
-    #   * service.detection.anomaly.unusual.behavior
-    #
     #   * service.detection.sequence.actors.id
     #
     #   * service.detection.sequence.actors.process.name
@@ -2069,8 +2057,6 @@ module Aws::GuardDuty
     #     For more information, see [Findings severity levels][2] in the
     #     *Amazon GuardDuty User Guide*.
     #
-    #   * title
-    #
     #   * type
     #
     #   * updatedAt
@@ -4303,6 +4289,10 @@ module Aws::GuardDuty
     #   resp.findings[0].service.runtime_details.context.service_name #=> String
     #   resp.findings[0].service.runtime_details.context.command_line_example #=> String
     #   resp.findings[0].service.runtime_details.context.threat_file_path #=> String
+    #   resp.findings[0].service.runtime_details.context.file_operation #=> String
+    #   resp.findings[0].service.runtime_details.context.file_path #=> String
+    #   resp.findings[0].service.runtime_details.context.related_file_paths #=> Array
+    #   resp.findings[0].service.runtime_details.context.related_file_paths[0] #=> String
     #   resp.findings[0].service.detection.anomaly.profiles #=> Hash
     #   resp.findings[0].service.detection.anomaly.profiles["String"] #=> Hash
     #   resp.findings[0].service.detection.anomaly.profiles["String"]["String"] #=> Array
@@ -6945,8 +6935,6 @@ module Aws::GuardDuty
     #
     #     Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000
     #
-    #   * description
-    #
     #   * id
     #
     #   * partition
@@ -7281,10 +7269,6 @@ module Aws::GuardDuty
     #
     #   * resource.rdsDbInstanceDetails.publiclyAccessible
     #
-    #   * resource.rdsDbInstanceDetails.tags.key
-    #
-    #   * resource.rdsDbInstanceDetails.tags.value
-    #
     #   * resource.rdsDbInstanceDetails.vpcId
     #
     #   * resource.rdsDbInstanceDetails.vpcSecurityGroups.status
@@ -7383,8 +7367,6 @@ module Aws::GuardDuty
     #
     #   * service.action.actionType
     #
-    #   * service.action.awsApiCallAction.affectedResources
-    #
     #   * service.action.awsApiCallAction.api
     #
     #   * service.action.awsApiCallAction.callerType
@@ -7673,10 +7655,6 @@ module Aws::GuardDuty
     #
     #   * service.count
     #
-    #   * service.detection.anomaly.profiles
-    #
-    #   * service.detection.anomaly.unusual.behavior
-    #
     #   * service.detection.sequence.actors.id
     #
     #   * service.detection.sequence.actors.process.name
@@ -8250,8 +8228,6 @@ module Aws::GuardDuty
     #     For more information, see [Findings severity levels][2] in the
     #     *Amazon GuardDuty User Guide*.
     #
-    #   * title
-    #
     #   * type
     #
     #   * updatedAt
@@ -8968,7 +8944,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.152.0'
+      context[:gem_version] = '1.154.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -510,6 +510,7 @@ module Aws::GuardDuty
     RdsLoginAttemptAction = Shapes::StructureShape.new(name: 'RdsLoginAttemptAction')
     RecoveryPoint = Shapes::StructureShape.new(name: 'RecoveryPoint')
     RecoveryPointDetails = Shapes::StructureShape.new(name: 'RecoveryPointDetails')
+    RelatedFilePathsList = Shapes::ListShape.new(name: 'RelatedFilePathsList')
     RemoteAccountDetails = Shapes::StructureShape.new(name: 'RemoteAccountDetails')
     RemoteIpDetails = Shapes::StructureShape.new(name: 'RemoteIpDetails')
     RemotePortDetails = Shapes::StructureShape.new(name: 'RemotePortDetails')
@@ -2456,6 +2457,8 @@ module Aws::GuardDuty
     RecoveryPointDetails.add_member(:backup_vault_name, Shapes::ShapeRef.new(shape: String, location_name: "backupVaultName"))
     RecoveryPointDetails.struct_class = Types::RecoveryPointDetails
 
+    RelatedFilePathsList.member = Shapes::ShapeRef.new(shape: String)
+
     RemoteAccountDetails.add_member(:account_id, Shapes::ShapeRef.new(shape: String, location_name: "accountId"))
     RemoteAccountDetails.add_member(:affiliated, Shapes::ShapeRef.new(shape: Boolean, location_name: "affiliated"))
     RemoteAccountDetails.struct_class = Types::RemoteAccountDetails
@@ -2564,6 +2567,9 @@ module Aws::GuardDuty
     RuntimeContext.add_member(:service_name, Shapes::ShapeRef.new(shape: String, location_name: "serviceName"))
     RuntimeContext.add_member(:command_line_example, Shapes::ShapeRef.new(shape: String, location_name: "commandLineExample"))
     RuntimeContext.add_member(:threat_file_path, Shapes::ShapeRef.new(shape: String, location_name: "threatFilePath"))
+    RuntimeContext.add_member(:file_operation, Shapes::ShapeRef.new(shape: String, location_name: "fileOperation"))
+    RuntimeContext.add_member(:file_path, Shapes::ShapeRef.new(shape: String, location_name: "filePath"))
+    RuntimeContext.add_member(:related_file_paths, Shapes::ShapeRef.new(shape: RelatedFilePathsList, location_name: "relatedFilePaths"))
     RuntimeContext.struct_class = Types::RuntimeContext
 
     RuntimeDetails.add_member(:process, Shapes::ShapeRef.new(shape: ProcessDetails, location_name: "process"))

data/lib/aws-sdk-guardduty/types.rb

@@ -1552,8 +1552,6 @@ module Aws::GuardDuty
     #     Type: Timestamp in Unix Epoch millisecond format. Ex:
     #     1486685375000
     #
-    #   * description
-    #
     #   * id
     #
     #   * partition
@@ -1893,10 +1891,6 @@ module Aws::GuardDuty
     #
     #   * resource.rdsDbInstanceDetails.publiclyAccessible
     #
-    #   * resource.rdsDbInstanceDetails.tags.key
-    #
-    #   * resource.rdsDbInstanceDetails.tags.value
-    #
     #   * resource.rdsDbInstanceDetails.vpcId
     #
     #   * resource.rdsDbInstanceDetails.vpcSecurityGroups.status
@@ -1996,8 +1990,6 @@ module Aws::GuardDuty
     #
     #   * service.action.actionType
     #
-    #   * service.action.awsApiCallAction.affectedResources
-    #
     #   * service.action.awsApiCallAction.api
     #
     #   * service.action.awsApiCallAction.callerType
@@ -2286,10 +2278,6 @@ module Aws::GuardDuty
     #
     #   * service.count
     #
-    #   * service.detection.anomaly.profiles
-    #
-    #   * service.detection.anomaly.unusual.behavior
-    #
     #   * service.detection.sequence.actors.id
     #
     #   * service.detection.sequence.actors.process.name
@@ -2882,8 +2870,6 @@ module Aws::GuardDuty
     #     For more information, see [Findings severity levels][2] in the
     #     *Amazon GuardDuty User Guide*.
     #
-    #   * title
-    #
     #   * type
     #
     #   * updatedAt
@@ -10654,6 +10640,22 @@ module Aws::GuardDuty
     #   were found.
     #   @return [String]
     #
+    # @!attribute [rw] file_operation
+    #   Represents the type of file operation that triggered the finding,
+    #   such as Write, Delete, Rename, Link, or Symlink.
+    #   @return [String]
+    #
+    # @!attribute [rw] file_path
+    #   The path of the sensitive file that was modified. Modification
+    #   includes write, delete, rename, link, or symlink operations. This
+    #   field is indexed for filtering.
+    #   @return [String]
+    #
+    # @!attribute [rw] related_file_paths
+    #   All file paths modified by the same process that triggered the
+    #   finding, up to a maximum of 25 paths.
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/RuntimeContext AWS API Documentation
     #
     class RuntimeContext < Struct.new(
@@ -10681,7 +10683,10 @@ module Aws::GuardDuty
       :tool_category,
       :service_name,
       :command_line_example,
-      :threat_file_path)
+      :threat_file_path,
+      :file_operation,
+      :file_path,
+      :related_file_paths)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -12399,8 +12404,6 @@ module Aws::GuardDuty
     #     Type: Timestamp in Unix Epoch millisecond format. Ex:
     #     1486685375000
     #
-    #   * description
-    #
     #   * id
     #
     #   * partition
@@ -12740,10 +12743,6 @@ module Aws::GuardDuty
     #
     #   * resource.rdsDbInstanceDetails.publiclyAccessible
     #
-    #   * resource.rdsDbInstanceDetails.tags.key
-    #
-    #   * resource.rdsDbInstanceDetails.tags.value
-    #
     #   * resource.rdsDbInstanceDetails.vpcId
     #
     #   * resource.rdsDbInstanceDetails.vpcSecurityGroups.status
@@ -12843,8 +12842,6 @@ module Aws::GuardDuty
     #
     #   * service.action.actionType
     #
-    #   * service.action.awsApiCallAction.affectedResources
-    #
     #   * service.action.awsApiCallAction.api
     #
     #   * service.action.awsApiCallAction.callerType
@@ -13133,10 +13130,6 @@ module Aws::GuardDuty
     #
     #   * service.count
     #
-    #   * service.detection.anomaly.profiles
-    #
-    #   * service.detection.anomaly.unusual.behavior
-    #
     #   * service.detection.sequence.actors.id
     #
     #   * service.detection.sequence.actors.process.name
@@ -13729,8 +13722,6 @@ module Aws::GuardDuty
     #     For more information, see [Findings severity levels][2] in the
     #     *Amazon GuardDuty User Guide*.
     #
-    #   * title
-    #
     #   * type
     #
     #   * updatedAt

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.152.0'
+  GEM_VERSION = '1.154.0'
 
 end
 

data/sig/types.rbs

@@ -2348,6 +2348,9 @@ module Aws::GuardDuty
       attr_accessor service_name: ::String
       attr_accessor command_line_example: ::String
       attr_accessor threat_file_path: ::String
+      attr_accessor file_operation: ::String
+      attr_accessor file_path: ::String
+      attr_accessor related_file_paths: ::Array[::String]
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.152.0
+  version: 1.154.0
 platform: ruby
 authors:
 - Amazon Web Services