aws-sdk-guardduty 1.166.0 → 1.167.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef87452799eef1c79df30e5bac135125b49efddf5c50eff2e209e6ccfcb7fea5
-  data.tar.gz: f6360e8b1d894cfb81a2b4ff3cfc48abfafd0043d92ac707db6b5b3813ad3656
+  metadata.gz: 9273fe81d5f44d79b8e37c12b5fdb1e993f1d7d9c0540ec0b2a6b97c043b28c9
+  data.tar.gz: 0ced319effb73a499326d49c3e4c15f0c756b2abcbfcb7748a0ccd9da2d7ea0c
 SHA512:
-  metadata.gz: a22e487ba8e6bcc9aa1ce5f9be189c39a323f78b7d59a1c931619e773c14670cf4165504dac207c8139df591791ffd52d3dcf9fb3c49dbdeafa132f70cd2c6b4
-  data.tar.gz: 7e156981b0e5de48078a4eb20da121d960b8018fefc0d0029a5e3975a4108f149b6fdc720f330f6bb986dbc2cfda61a6500d0e8ab778992ee77e54b313cb94e4
+  metadata.gz: ec8d0a708dc3effa62136d6427f8bd9951af1d3059273db41e65a71d4416cbb39112e72fc2acd1fd5c644c9290f9fa2c0f5ad97d8fd5b15cc50bdfae34036b56
+  data.tar.gz: 3965b330df0c2af43dd3d87b95f39e8618950f13c5227caafcd39750a70e23839f50d6b5b908aecec54b4a52297182f1b149a7ae4bbb888cace7b4b1f504748a

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.167.0 (2026-10-14)
+------------------
+
+* Feature - Releasing support for Custom Detection Rule Runtime Monitoring
+
 1.166.0 (2026-10-08)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.166.0
+1.167.0

data/lib/aws-sdk-guardduty/client.rb

@@ -3910,13 +3910,16 @@ module Aws::GuardDuty
     #   resp.rule.name #=> String
     #   resp.rule.description #=> String
     #   resp.rule.severity #=> String, one of "CRITICAL", "HIGH", "MEDIUM", "LOW"
-    #   resp.rule.data_source #=> String, one of "CloudTrailManagementEvent"
+    #   resp.rule.data_source #=> String, one of "CloudTrailManagementEvent", "RuntimeMonitoring"
     #   resp.rule.tactic #=> String
     #   resp.rule.technique #=> String
     #   resp.rule.service #=> String
     #   resp.rule.definition.expression #=> String
     #   resp.rule.language #=> String, one of "SQL"
     #   resp.rule.schema #=> String, one of "CloudTrail"
+    #   resp.rule.runtime_monitoring_details.platforms.eks.min_agent_version #=> String
+    #   resp.rule.runtime_monitoring_details.platforms.ec2.min_agent_version #=> String
+    #   resp.rule.runtime_monitoring_details.platforms.ecs_fargate.min_agent_version #=> String
     #   resp.rule.created_at #=> Time
     #   resp.rule.updated_at #=> Time
     #
@@ -4890,6 +4893,7 @@ module Aws::GuardDuty
     #   resp.findings[0].type #=> String
     #   resp.findings[0].updated_at #=> String
     #   resp.findings[0].associated_attack_sequence_arn #=> String
+    #   resp.findings[0].custom_detection_rule_name #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/GetFindings AWS API Documentation
     #
@@ -6236,7 +6240,7 @@ module Aws::GuardDuty
     #   resp.rules[0].name #=> String
     #   resp.rules[0].description #=> String
     #   resp.rules[0].severity #=> String, one of "CRITICAL", "HIGH", "MEDIUM", "LOW"
-    #   resp.rules[0].data_source #=> String, one of "CloudTrailManagementEvent"
+    #   resp.rules[0].data_source #=> String, one of "CloudTrailManagementEvent", "RuntimeMonitoring"
     #   resp.rules[0].tactic #=> String
     #   resp.rules[0].technique #=> String
     #   resp.rules[0].service #=> String
@@ -9740,7 +9744,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.166.0'
+      context[:gem_version] = '1.167.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -207,10 +207,14 @@ module Aws::GuardDuty
     Destinations = Shapes::ListShape.new(name: 'Destinations')
     Detection = Shapes::StructureShape.new(name: 'Detection')
     DetectionRuleAccountIds = Shapes::ListShape.new(name: 'DetectionRuleAccountIds')
+    DetectionRuleAgentVersion = Shapes::StringShape.new(name: 'DetectionRuleAgentVersion')
     DetectionRuleArn = Shapes::StringShape.new(name: 'DetectionRuleArn')
     DetectionRuleConfigurationStatus = Shapes::StringShape.new(name: 'DetectionRuleConfigurationStatus')
     DetectionRuleDataSource = Shapes::StringShape.new(name: 'DetectionRuleDataSource')
     DetectionRuleDescription = Shapes::StringShape.new(name: 'DetectionRuleDescription')
+    DetectionRuleEc2Requirements = Shapes::StructureShape.new(name: 'DetectionRuleEc2Requirements')
+    DetectionRuleEcsFargateRequirements = Shapes::StructureShape.new(name: 'DetectionRuleEcsFargateRequirements')
+    DetectionRuleEksRequirements = Shapes::StructureShape.new(name: 'DetectionRuleEksRequirements')
     DetectionRuleFilter = Shapes::StructureShape.new(name: 'DetectionRuleFilter')
     DetectionRuleFilterCondition = Shapes::StringShape.new(name: 'DetectionRuleFilterCondition')
     DetectionRuleFilterList = Shapes::ListShape.new(name: 'DetectionRuleFilterList')
@@ -220,6 +224,8 @@ module Aws::GuardDuty
     DetectionRuleOrgConfiguration = Shapes::StructureShape.new(name: 'DetectionRuleOrgConfiguration')
     DetectionRuleOrgConfigurationSummary = Shapes::StructureShape.new(name: 'DetectionRuleOrgConfigurationSummary')
     DetectionRuleOrgConfigurationSummaryList = Shapes::ListShape.new(name: 'DetectionRuleOrgConfigurationSummaryList')
+    DetectionRuleRuntimeMonitoringDetails = Shapes::StructureShape.new(name: 'DetectionRuleRuntimeMonitoringDetails')
+    DetectionRuleRuntimePlatforms = Shapes::StructureShape.new(name: 'DetectionRuleRuntimePlatforms')
     DetectionRuleServiceName = Shapes::StringShape.new(name: 'DetectionRuleServiceName')
     DetectionRuleSeverity = Shapes::StringShape.new(name: 'DetectionRuleSeverity')
     DetectionSource = Shapes::StringShape.new(name: 'DetectionSource')
@@ -1480,6 +1486,15 @@ module Aws::GuardDuty
 
     DetectionRuleAccountIds.member = Shapes::ShapeRef.new(shape: AccountId)
 
+    DetectionRuleEc2Requirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEc2Requirements.struct_class = Types::DetectionRuleEc2Requirements
+
+    DetectionRuleEcsFargateRequirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEcsFargateRequirements.struct_class = Types::DetectionRuleEcsFargateRequirements
+
+    DetectionRuleEksRequirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEksRequirements.struct_class = Types::DetectionRuleEksRequirements
+
     DetectionRuleFilter.add_member(:name, Shapes::ShapeRef.new(shape: FilterFieldName, required: true, location_name: "name"))
     DetectionRuleFilter.add_member(:values, Shapes::ShapeRef.new(shape: DetectionRuleFilterValues, required: true, location_name: "values"))
     DetectionRuleFilter.add_member(:condition, Shapes::ShapeRef.new(shape: DetectionRuleFilterCondition, location_name: "condition"))
@@ -1511,6 +1526,14 @@ module Aws::GuardDuty
 
     DetectionRuleOrgConfigurationSummaryList.member = Shapes::ShapeRef.new(shape: DetectionRuleOrgConfigurationSummary)
 
+    DetectionRuleRuntimeMonitoringDetails.add_member(:platforms, Shapes::ShapeRef.new(shape: DetectionRuleRuntimePlatforms, location_name: "platforms"))
+    DetectionRuleRuntimeMonitoringDetails.struct_class = Types::DetectionRuleRuntimeMonitoringDetails
+
+    DetectionRuleRuntimePlatforms.add_member(:eks, Shapes::ShapeRef.new(shape: DetectionRuleEksRequirements, location_name: "eks"))
+    DetectionRuleRuntimePlatforms.add_member(:ec2, Shapes::ShapeRef.new(shape: DetectionRuleEc2Requirements, location_name: "ec2"))
+    DetectionRuleRuntimePlatforms.add_member(:ecs_fargate, Shapes::ShapeRef.new(shape: DetectionRuleEcsFargateRequirements, location_name: "ecsFargate"))
+    DetectionRuleRuntimePlatforms.struct_class = Types::DetectionRuleRuntimePlatforms
+
     DetectorAdditionalConfiguration.add_member(:name, Shapes::ShapeRef.new(shape: FeatureAdditionalConfiguration, location_name: "name"))
     DetectorAdditionalConfiguration.add_member(:status, Shapes::ShapeRef.new(shape: FeatureStatus, location_name: "status"))
     DetectorAdditionalConfiguration.struct_class = Types::DetectorAdditionalConfiguration
@@ -1734,6 +1757,7 @@ module Aws::GuardDuty
     Finding.add_member(:type, Shapes::ShapeRef.new(shape: FindingType, required: true, location_name: "type"))
     Finding.add_member(:updated_at, Shapes::ShapeRef.new(shape: String, required: true, location_name: "updatedAt"))
     Finding.add_member(:associated_attack_sequence_arn, Shapes::ShapeRef.new(shape: String, location_name: "associatedAttackSequenceArn"))
+    Finding.add_member(:custom_detection_rule_name, Shapes::ShapeRef.new(shape: String, location_name: "customDetectionRuleName"))
     Finding.struct_class = Types::Finding
 
     FindingCriteria.add_member(:criterion, Shapes::ShapeRef.new(shape: Criterion, location_name: "criterion"))
@@ -2930,6 +2954,7 @@ module Aws::GuardDuty
     RuleDetail.add_member(:definition, Shapes::ShapeRef.new(shape: RuleDefinition, required: true, location_name: "definition"))
     RuleDetail.add_member(:language, Shapes::ShapeRef.new(shape: RuleLanguage, location_name: "language"))
     RuleDetail.add_member(:schema, Shapes::ShapeRef.new(shape: RuleSchema, location_name: "schema"))
+    RuleDetail.add_member(:runtime_monitoring_details, Shapes::ShapeRef.new(shape: DetectionRuleRuntimeMonitoringDetails, location_name: "runtimeMonitoringDetails"))
     RuleDetail.add_member(:created_at, Shapes::ShapeRef.new(shape: Timestamp, required: true, location_name: "createdAt"))
     RuleDetail.add_member(:updated_at, Shapes::ShapeRef.new(shape: Timestamp, location_name: "updatedAt"))
     RuleDetail.struct_class = Types::RuleDetail

data/lib/aws-sdk-guardduty/types.rb

@@ -4738,6 +4738,54 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon EC2.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon EC2.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEc2Requirements AWS API Documentation
+    #
+    class DetectionRuleEc2Requirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon ECS with the Fargate launch type.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon ECS with the Fargate launch type.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEcsFargateRequirements AWS API Documentation
+    #
+    class DetectionRuleEcsFargateRequirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon EKS.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon EKS.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEksRequirements AWS API Documentation
+    #
+    class DetectionRuleEksRequirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains filter criteria for listing custom detection rules or
     # associations.
     #
@@ -4868,6 +4916,53 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains Runtime Monitoring-specific details for a custom detection
+    # rule.
+    #
+    # @!attribute [rw] platforms
+    #   The platforms on which the rule can run. The presence of a platform
+    #   member indicates that the rule is supported on that platform; the
+    #   absence of a member indicates that the rule cannot run on that
+    #   platform at any agent version.
+    #   @return [Types::DetectionRuleRuntimePlatforms]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleRuntimeMonitoringDetails AWS API Documentation
+    #
+    class DetectionRuleRuntimeMonitoringDetails < Struct.new(
+      :platforms)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The platforms on which a Runtime Monitoring custom detection rule can
+    # run. A member's presence is the support statement: when present, the
+    # rule runs on that platform and `minAgentVersion` is the minimum
+    # GuardDuty agent version required there. When absent, the rule cannot
+    # run on that platform at any agent version.
+    #
+    # @!attribute [rw] eks
+    #   The requirements for running the rule on Amazon EKS.
+    #   @return [Types::DetectionRuleEksRequirements]
+    #
+    # @!attribute [rw] ec2
+    #   The requirements for running the rule on Amazon EC2.
+    #   @return [Types::DetectionRuleEc2Requirements]
+    #
+    # @!attribute [rw] ecs_fargate
+    #   The requirements for running the rule on Amazon ECS with the Fargate
+    #   launch type.
+    #   @return [Types::DetectionRuleEcsFargateRequirements]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleRuntimePlatforms AWS API Documentation
+    #
+    class DetectionRuleRuntimePlatforms < Struct.new(
+      :eks,
+      :ec2,
+      :ecs_fargate)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Information about the additional configuration for a feature in your
     # GuardDuty account.
     #
@@ -5888,6 +5983,10 @@ module Aws::GuardDuty
     #   finding.
     #   @return [String]
     #
+    # @!attribute [rw] custom_detection_rule_name
+    #   The name of the custom detection rule that generated this finding.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Finding AWS API Documentation
     #
     class Finding < Struct.new(
@@ -5906,7 +6005,8 @@ module Aws::GuardDuty
       :title,
       :type,
       :updated_at,
-      :associated_attack_sequence_arn)
+      :associated_attack_sequence_arn,
+      :custom_detection_rule_name)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -11804,6 +11904,12 @@ module Aws::GuardDuty
     #   The schema version used by the rule definition.
     #   @return [String]
     #
+    # @!attribute [rw] runtime_monitoring_details
+    #   Runtime Monitoring-specific details for the rule, including the
+    #   platforms on which the rule can run and the minimum GuardDuty agent
+    #   version required on each.
+    #   @return [Types::DetectionRuleRuntimeMonitoringDetails]
+    #
     # @!attribute [rw] created_at
     #   The timestamp when the rule was created.
     #   @return [Time]
@@ -11827,6 +11933,7 @@ module Aws::GuardDuty
       :definition,
       :language,
       :schema,
+      :runtime_monitoring_details,
       :created_at,
       :updated_at)
       SENSITIVE = []

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.166.0'
+  GEM_VERSION = '1.167.0'
 
 end
 

data/sig/types.rbs

@@ -876,6 +876,21 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class DetectionRuleEc2Requirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
+    class DetectionRuleEcsFargateRequirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
+    class DetectionRuleEksRequirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
     class DetectionRuleFilter
       attr_accessor name: ("name" | "description" | "dataSource" | "severity" | "tactic" | "technique" | "service")
       attr_accessor values: ::Array[::String]
@@ -907,6 +922,18 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class DetectionRuleRuntimeMonitoringDetails
+      attr_accessor platforms: Types::DetectionRuleRuntimePlatforms
+      SENSITIVE: []
+    end
+
+    class DetectionRuleRuntimePlatforms
+      attr_accessor eks: Types::DetectionRuleEksRequirements
+      attr_accessor ec2: Types::DetectionRuleEc2Requirements
+      attr_accessor ecs_fargate: Types::DetectionRuleEcsFargateRequirements
+      SENSITIVE: []
+    end
+
     class DetectorAdditionalConfiguration
       attr_accessor name: ("EKS_ADDON_MANAGEMENT" | "ECS_FARGATE_AGENT_MANAGEMENT" | "EC2_AGENT_MANAGEMENT" | "RDS_DATA_RISK")
       attr_accessor status: ("ENABLED" | "DISABLED")
@@ -1177,6 +1204,7 @@ module Aws::GuardDuty
       attr_accessor type: ::String
       attr_accessor updated_at: ::String
       attr_accessor associated_attack_sequence_arn: ::String
+      attr_accessor custom_detection_rule_name: ::String
       SENSITIVE: []
     end
 
@@ -2657,13 +2685,14 @@ module Aws::GuardDuty
       attr_accessor name: ::String
       attr_accessor description: ::String
       attr_accessor severity: ("CRITICAL" | "HIGH" | "MEDIUM" | "LOW")
-      attr_accessor data_source: ("CloudTrailManagementEvent")
+      attr_accessor data_source: ("CloudTrailManagementEvent" | "RuntimeMonitoring")
       attr_accessor tactic: ::String
       attr_accessor technique: ::String
       attr_accessor service: ::String
       attr_accessor definition: Types::RuleDefinition
       attr_accessor language: ("SQL")
       attr_accessor schema: ("CloudTrail")
+      attr_accessor runtime_monitoring_details: Types::DetectionRuleRuntimeMonitoringDetails
       attr_accessor created_at: ::Time
       attr_accessor updated_at: ::Time
       SENSITIVE: []
@@ -2675,7 +2704,7 @@ module Aws::GuardDuty
       attr_accessor name: ::String
       attr_accessor description: ::String
       attr_accessor severity: ("CRITICAL" | "HIGH" | "MEDIUM" | "LOW")
-      attr_accessor data_source: ("CloudTrailManagementEvent")
+      attr_accessor data_source: ("CloudTrailManagementEvent" | "RuntimeMonitoring")
       attr_accessor tactic: ::String
       attr_accessor technique: ::String
       attr_accessor service: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.166.0
+  version: 1.167.0
 platform: ruby
 authors:
 - Amazon Web Services