aws-sdk-guardduty 1.166.0 → 1.168.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef87452799eef1c79df30e5bac135125b49efddf5c50eff2e209e6ccfcb7fea5
-  data.tar.gz: f6360e8b1d894cfb81a2b4ff3cfc48abfafd0043d92ac707db6b5b3813ad3656
+  metadata.gz: 4fc789bd70c1c224f66723b6fb055b16df2b5f89532f0d17df1dbe4f73ac8e1c
+  data.tar.gz: 3faeb5b6a9cf58b826e05774797067e7c733b9cf95eca103db839b0a2857846a
 SHA512:
-  metadata.gz: a22e487ba8e6bcc9aa1ce5f9be189c39a323f78b7d59a1c931619e773c14670cf4165504dac207c8139df591791ffd52d3dcf9fb3c49dbdeafa132f70cd2c6b4
-  data.tar.gz: 7e156981b0e5de48078a4eb20da121d960b8018fefc0d0029a5e3975a4108f149b6fdc720f330f6bb986dbc2cfda61a6500d0e8ab778992ee77e54b313cb94e4
+  metadata.gz: 1de4b48b0861710e6f2b969e5395d26133fb4e6c81daf8e8fc9a3c4f298723945710bc2d7be81ca5863b43e860c5be80b2f36bb20df21ab1ea3411e9cf0b8bb2
+  data.tar.gz: 9de7481b24bf4c4b219b24e45e652c202c293a36758dc282f21eafca1b31bec6ae1589cf5a289f71a4f6db0833a836b79e7af559c790c684f72cd06dfe687bd7

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.168.0 (2026-10-19)
+------------------
+
+* Feature - Adding a new Expected Bucket Owner optional field for GuardDuty publishing destination APIs
+
+1.167.0 (2026-10-14)
+------------------
+
+* Feature - Releasing support for Custom Detection Rule Runtime Monitoring
+
 1.166.0 (2026-10-08)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.166.0
+1.168.0

data/lib/aws-sdk-guardduty/client.rb

@@ -2593,6 +2593,7 @@ module Aws::GuardDuty
     #     destination_properties: { # required
     #       destination_arn: "String",
     #       kms_key_arn: "String",
+    #       expected_bucket_owner: "AccountId",
     #     },
     #     client_token: "ClientToken",
     #     tags: {
@@ -3570,6 +3571,7 @@ module Aws::GuardDuty
     #   resp.publishing_failure_start_timestamp #=> Integer
     #   resp.destination_properties.destination_arn #=> String
     #   resp.destination_properties.kms_key_arn #=> String
+    #   resp.destination_properties.expected_bucket_owner #=> String
     #   resp.tags #=> Hash
     #   resp.tags["TagKey"] #=> String
     #
@@ -3910,13 +3912,16 @@ module Aws::GuardDuty
     #   resp.rule.name #=> String
     #   resp.rule.description #=> String
     #   resp.rule.severity #=> String, one of "CRITICAL", "HIGH", "MEDIUM", "LOW"
-    #   resp.rule.data_source #=> String, one of "CloudTrailManagementEvent"
+    #   resp.rule.data_source #=> String, one of "CloudTrailManagementEvent", "RuntimeMonitoring"
     #   resp.rule.tactic #=> String
     #   resp.rule.technique #=> String
     #   resp.rule.service #=> String
     #   resp.rule.definition.expression #=> String
     #   resp.rule.language #=> String, one of "SQL"
     #   resp.rule.schema #=> String, one of "CloudTrail"
+    #   resp.rule.runtime_monitoring_details.platforms.eks.min_agent_version #=> String
+    #   resp.rule.runtime_monitoring_details.platforms.ec2.min_agent_version #=> String
+    #   resp.rule.runtime_monitoring_details.platforms.ecs_fargate.min_agent_version #=> String
     #   resp.rule.created_at #=> Time
     #   resp.rule.updated_at #=> Time
     #
@@ -4890,6 +4895,7 @@ module Aws::GuardDuty
     #   resp.findings[0].type #=> String
     #   resp.findings[0].updated_at #=> String
     #   resp.findings[0].associated_attack_sequence_arn #=> String
+    #   resp.findings[0].custom_detection_rule_name #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/GetFindings AWS API Documentation
     #
@@ -6236,7 +6242,7 @@ module Aws::GuardDuty
     #   resp.rules[0].name #=> String
     #   resp.rules[0].description #=> String
     #   resp.rules[0].severity #=> String, one of "CRITICAL", "HIGH", "MEDIUM", "LOW"
-    #   resp.rules[0].data_source #=> String, one of "CloudTrailManagementEvent"
+    #   resp.rules[0].data_source #=> String, one of "CloudTrailManagementEvent", "RuntimeMonitoring"
     #   resp.rules[0].tactic #=> String
     #   resp.rules[0].technique #=> String
     #   resp.rules[0].service #=> String
@@ -9538,6 +9544,7 @@ module Aws::GuardDuty
     #     destination_properties: {
     #       destination_arn: "String",
     #       kms_key_arn: "String",
+    #       expected_bucket_owner: "AccountId",
     #     },
     #   })
     #
@@ -9740,7 +9747,7 @@ module Aws::GuardDuty
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-guardduty'
-      context[:gem_version] = '1.166.0'
+      context[:gem_version] = '1.168.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-guardduty/client_api.rb

@@ -207,10 +207,14 @@ module Aws::GuardDuty
     Destinations = Shapes::ListShape.new(name: 'Destinations')
     Detection = Shapes::StructureShape.new(name: 'Detection')
     DetectionRuleAccountIds = Shapes::ListShape.new(name: 'DetectionRuleAccountIds')
+    DetectionRuleAgentVersion = Shapes::StringShape.new(name: 'DetectionRuleAgentVersion')
     DetectionRuleArn = Shapes::StringShape.new(name: 'DetectionRuleArn')
     DetectionRuleConfigurationStatus = Shapes::StringShape.new(name: 'DetectionRuleConfigurationStatus')
     DetectionRuleDataSource = Shapes::StringShape.new(name: 'DetectionRuleDataSource')
     DetectionRuleDescription = Shapes::StringShape.new(name: 'DetectionRuleDescription')
+    DetectionRuleEc2Requirements = Shapes::StructureShape.new(name: 'DetectionRuleEc2Requirements')
+    DetectionRuleEcsFargateRequirements = Shapes::StructureShape.new(name: 'DetectionRuleEcsFargateRequirements')
+    DetectionRuleEksRequirements = Shapes::StructureShape.new(name: 'DetectionRuleEksRequirements')
     DetectionRuleFilter = Shapes::StructureShape.new(name: 'DetectionRuleFilter')
     DetectionRuleFilterCondition = Shapes::StringShape.new(name: 'DetectionRuleFilterCondition')
     DetectionRuleFilterList = Shapes::ListShape.new(name: 'DetectionRuleFilterList')
@@ -220,6 +224,8 @@ module Aws::GuardDuty
     DetectionRuleOrgConfiguration = Shapes::StructureShape.new(name: 'DetectionRuleOrgConfiguration')
     DetectionRuleOrgConfigurationSummary = Shapes::StructureShape.new(name: 'DetectionRuleOrgConfigurationSummary')
     DetectionRuleOrgConfigurationSummaryList = Shapes::ListShape.new(name: 'DetectionRuleOrgConfigurationSummaryList')
+    DetectionRuleRuntimeMonitoringDetails = Shapes::StructureShape.new(name: 'DetectionRuleRuntimeMonitoringDetails')
+    DetectionRuleRuntimePlatforms = Shapes::StructureShape.new(name: 'DetectionRuleRuntimePlatforms')
     DetectionRuleServiceName = Shapes::StringShape.new(name: 'DetectionRuleServiceName')
     DetectionRuleSeverity = Shapes::StringShape.new(name: 'DetectionRuleSeverity')
     DetectionSource = Shapes::StringShape.new(name: 'DetectionSource')
@@ -1470,6 +1476,7 @@ module Aws::GuardDuty
 
     DestinationProperties.add_member(:destination_arn, Shapes::ShapeRef.new(shape: String, location_name: "destinationArn"))
     DestinationProperties.add_member(:kms_key_arn, Shapes::ShapeRef.new(shape: String, location_name: "kmsKeyArn"))
+    DestinationProperties.add_member(:expected_bucket_owner, Shapes::ShapeRef.new(shape: AccountId, location_name: "expectedBucketOwner"))
     DestinationProperties.struct_class = Types::DestinationProperties
 
     Destinations.member = Shapes::ShapeRef.new(shape: Destination)
@@ -1480,6 +1487,15 @@ module Aws::GuardDuty
 
     DetectionRuleAccountIds.member = Shapes::ShapeRef.new(shape: AccountId)
 
+    DetectionRuleEc2Requirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEc2Requirements.struct_class = Types::DetectionRuleEc2Requirements
+
+    DetectionRuleEcsFargateRequirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEcsFargateRequirements.struct_class = Types::DetectionRuleEcsFargateRequirements
+
+    DetectionRuleEksRequirements.add_member(:min_agent_version, Shapes::ShapeRef.new(shape: DetectionRuleAgentVersion, location_name: "minAgentVersion"))
+    DetectionRuleEksRequirements.struct_class = Types::DetectionRuleEksRequirements
+
     DetectionRuleFilter.add_member(:name, Shapes::ShapeRef.new(shape: FilterFieldName, required: true, location_name: "name"))
     DetectionRuleFilter.add_member(:values, Shapes::ShapeRef.new(shape: DetectionRuleFilterValues, required: true, location_name: "values"))
     DetectionRuleFilter.add_member(:condition, Shapes::ShapeRef.new(shape: DetectionRuleFilterCondition, location_name: "condition"))
@@ -1511,6 +1527,14 @@ module Aws::GuardDuty
 
     DetectionRuleOrgConfigurationSummaryList.member = Shapes::ShapeRef.new(shape: DetectionRuleOrgConfigurationSummary)
 
+    DetectionRuleRuntimeMonitoringDetails.add_member(:platforms, Shapes::ShapeRef.new(shape: DetectionRuleRuntimePlatforms, location_name: "platforms"))
+    DetectionRuleRuntimeMonitoringDetails.struct_class = Types::DetectionRuleRuntimeMonitoringDetails
+
+    DetectionRuleRuntimePlatforms.add_member(:eks, Shapes::ShapeRef.new(shape: DetectionRuleEksRequirements, location_name: "eks"))
+    DetectionRuleRuntimePlatforms.add_member(:ec2, Shapes::ShapeRef.new(shape: DetectionRuleEc2Requirements, location_name: "ec2"))
+    DetectionRuleRuntimePlatforms.add_member(:ecs_fargate, Shapes::ShapeRef.new(shape: DetectionRuleEcsFargateRequirements, location_name: "ecsFargate"))
+    DetectionRuleRuntimePlatforms.struct_class = Types::DetectionRuleRuntimePlatforms
+
     DetectorAdditionalConfiguration.add_member(:name, Shapes::ShapeRef.new(shape: FeatureAdditionalConfiguration, location_name: "name"))
     DetectorAdditionalConfiguration.add_member(:status, Shapes::ShapeRef.new(shape: FeatureStatus, location_name: "status"))
     DetectorAdditionalConfiguration.struct_class = Types::DetectorAdditionalConfiguration
@@ -1734,6 +1758,7 @@ module Aws::GuardDuty
     Finding.add_member(:type, Shapes::ShapeRef.new(shape: FindingType, required: true, location_name: "type"))
     Finding.add_member(:updated_at, Shapes::ShapeRef.new(shape: String, required: true, location_name: "updatedAt"))
     Finding.add_member(:associated_attack_sequence_arn, Shapes::ShapeRef.new(shape: String, location_name: "associatedAttackSequenceArn"))
+    Finding.add_member(:custom_detection_rule_name, Shapes::ShapeRef.new(shape: String, location_name: "customDetectionRuleName"))
     Finding.struct_class = Types::Finding
 
     FindingCriteria.add_member(:criterion, Shapes::ShapeRef.new(shape: Criterion, location_name: "criterion"))
@@ -2930,6 +2955,7 @@ module Aws::GuardDuty
     RuleDetail.add_member(:definition, Shapes::ShapeRef.new(shape: RuleDefinition, required: true, location_name: "definition"))
     RuleDetail.add_member(:language, Shapes::ShapeRef.new(shape: RuleLanguage, location_name: "language"))
     RuleDetail.add_member(:schema, Shapes::ShapeRef.new(shape: RuleSchema, location_name: "schema"))
+    RuleDetail.add_member(:runtime_monitoring_details, Shapes::ShapeRef.new(shape: DetectionRuleRuntimeMonitoringDetails, location_name: "runtimeMonitoringDetails"))
     RuleDetail.add_member(:created_at, Shapes::ShapeRef.new(shape: Timestamp, required: true, location_name: "createdAt"))
     RuleDetail.add_member(:updated_at, Shapes::ShapeRef.new(shape: Timestamp, location_name: "updatedAt"))
     RuleDetail.struct_class = Types::RuleDetail

data/lib/aws-sdk-guardduty/types.rb

@@ -4709,11 +4709,40 @@ module Aws::GuardDuty
     #   The ARN of the KMS key to use for encryption.
     #   @return [String]
     #
+    # @!attribute [rw] expected_bucket_owner
+    #   The 12-digit Amazon Web Services account ID of the account that owns
+    #   the Amazon S3 bucket specified in the `DestinationArn` parameter.
+    #
+    #   When you provide this value, GuardDuty verifies that the specified
+    #   account owns the bucket before it exports findings. If the account
+    #   ID doesn't match the actual owner of the bucket, GuardDuty doesn't
+    #   export findings to that bucket. This helps prevent GuardDuty from
+    #   exporting your findings to a bucket that a different Amazon Web
+    #   Services account owns (for example, if the original bucket was
+    #   deleted and its name was later claimed by another account). If you
+    #   don't specify this value, GuardDuty doesn't perform this
+    #   verification. GuardDuty strongly recommends that you provide the
+    #   expected bucket owner when possible.
+    #
+    #   When you update a publishing destination, omitting this field leaves
+    #   the currently stored value unchanged. This field appears in the
+    #   response only if it was provided when the publishing destination was
+    #   created or updated.
+    #
+    #   For more information, see [Verifying the Amazon S3 bucket owner][1]
+    #   in the *Amazon GuardDuty User Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html#guardduty-exportfindings-expected-bucket-owner
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DestinationProperties AWS API Documentation
     #
     class DestinationProperties < Struct.new(
       :destination_arn,
-      :kms_key_arn)
+      :kms_key_arn,
+      :expected_bucket_owner)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4738,6 +4767,54 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon EC2.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon EC2.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEc2Requirements AWS API Documentation
+    #
+    class DetectionRuleEc2Requirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon ECS with the Fargate launch type.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon ECS with the Fargate launch type.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEcsFargateRequirements AWS API Documentation
+    #
+    class DetectionRuleEcsFargateRequirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The requirements for running a Runtime Monitoring custom detection
+    # rule on Amazon EKS.
+    #
+    # @!attribute [rw] min_agent_version
+    #   The minimum GuardDuty agent version required to run the rule on
+    #   Amazon EKS.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleEksRequirements AWS API Documentation
+    #
+    class DetectionRuleEksRequirements < Struct.new(
+      :min_agent_version)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains filter criteria for listing custom detection rules or
     # associations.
     #
@@ -4868,6 +4945,53 @@ module Aws::GuardDuty
       include Aws::Structure
     end
 
+    # Contains Runtime Monitoring-specific details for a custom detection
+    # rule.
+    #
+    # @!attribute [rw] platforms
+    #   The platforms on which the rule can run. The presence of a platform
+    #   member indicates that the rule is supported on that platform; the
+    #   absence of a member indicates that the rule cannot run on that
+    #   platform at any agent version.
+    #   @return [Types::DetectionRuleRuntimePlatforms]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleRuntimeMonitoringDetails AWS API Documentation
+    #
+    class DetectionRuleRuntimeMonitoringDetails < Struct.new(
+      :platforms)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The platforms on which a Runtime Monitoring custom detection rule can
+    # run. A member's presence is the support statement: when present, the
+    # rule runs on that platform and `minAgentVersion` is the minimum
+    # GuardDuty agent version required there. When absent, the rule cannot
+    # run on that platform at any agent version.
+    #
+    # @!attribute [rw] eks
+    #   The requirements for running the rule on Amazon EKS.
+    #   @return [Types::DetectionRuleEksRequirements]
+    #
+    # @!attribute [rw] ec2
+    #   The requirements for running the rule on Amazon EC2.
+    #   @return [Types::DetectionRuleEc2Requirements]
+    #
+    # @!attribute [rw] ecs_fargate
+    #   The requirements for running the rule on Amazon ECS with the Fargate
+    #   launch type.
+    #   @return [Types::DetectionRuleEcsFargateRequirements]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/DetectionRuleRuntimePlatforms AWS API Documentation
+    #
+    class DetectionRuleRuntimePlatforms < Struct.new(
+      :eks,
+      :ec2,
+      :ecs_fargate)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Information about the additional configuration for a feature in your
     # GuardDuty account.
     #
@@ -5888,6 +6012,10 @@ module Aws::GuardDuty
     #   finding.
     #   @return [String]
     #
+    # @!attribute [rw] custom_detection_rule_name
+    #   The name of the custom detection rule that generated this finding.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/guardduty-2017-11-28/Finding AWS API Documentation
     #
     class Finding < Struct.new(
@@ -5906,7 +6034,8 @@ module Aws::GuardDuty
       :title,
       :type,
       :updated_at,
-      :associated_attack_sequence_arn)
+      :associated_attack_sequence_arn,
+      :custom_detection_rule_name)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -11804,6 +11933,12 @@ module Aws::GuardDuty
     #   The schema version used by the rule definition.
     #   @return [String]
     #
+    # @!attribute [rw] runtime_monitoring_details
+    #   Runtime Monitoring-specific details for the rule, including the
+    #   platforms on which the rule can run and the minimum GuardDuty agent
+    #   version required on each.
+    #   @return [Types::DetectionRuleRuntimeMonitoringDetails]
+    #
     # @!attribute [rw] created_at
     #   The timestamp when the rule was created.
     #   @return [Time]
@@ -11827,6 +11962,7 @@ module Aws::GuardDuty
       :definition,
       :language,
       :schema,
+      :runtime_monitoring_details,
       :created_at,
       :updated_at)
       SENSITIVE = []

data/lib/aws-sdk-guardduty.rb

@@ -54,7 +54,7 @@ module Aws::GuardDuty
   autoload :EndpointProvider, 'aws-sdk-guardduty/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-guardduty/endpoints'
 
-  GEM_VERSION = '1.166.0'
+  GEM_VERSION = '1.168.0'
 
 end
 

data/sig/client.rbs

@@ -249,7 +249,8 @@ module Aws
                                            destination_type: ("S3"),
                                            destination_properties: {
                                              destination_arn: ::String?,
-                                             kms_key_arn: ::String?
+                                             kms_key_arn: ::String?,
+                                             expected_bucket_owner: ::String?
                                            },
                                            ?client_token: ::String,
                                            ?tags: Hash[::String, ::String]
@@ -1468,7 +1469,8 @@ module Aws
                                            destination_id: ::String,
                                            ?destination_properties: {
                                              destination_arn: ::String?,
-                                             kms_key_arn: ::String?
+                                             kms_key_arn: ::String?,
+                                             expected_bucket_owner: ::String?
                                            }
                                          ) -> _UpdatePublishingDestinationResponseSuccess
                                        | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdatePublishingDestinationResponseSuccess

data/sig/errors.rbs

@@ -11,23 +11,23 @@ module Aws
       class ServiceError < ::Aws::Errors::ServiceError
       end
 
-      class AccessDeniedException < ::Aws::Errors::ServiceError
+      class AccessDeniedException < ServiceError
         def message: () -> ::String
         def type: () -> ::String
       end
-      class BadRequestException < ::Aws::Errors::ServiceError
+      class BadRequestException < ServiceError
         def message: () -> ::String
         def type: () -> ::String
       end
-      class ConflictException < ::Aws::Errors::ServiceError
+      class ConflictException < ServiceError
         def message: () -> ::String
         def type: () -> ::String
       end
-      class InternalServerErrorException < ::Aws::Errors::ServiceError
+      class InternalServerErrorException < ServiceError
         def message: () -> ::String
         def type: () -> ::String
       end
-      class ResourceNotFoundException < ::Aws::Errors::ServiceError
+      class ResourceNotFoundException < ServiceError
         def message: () -> ::String
         def type: () -> ::String
       end

data/sig/types.rbs

@@ -867,6 +867,7 @@ module Aws::GuardDuty
     class DestinationProperties
       attr_accessor destination_arn: ::String
       attr_accessor kms_key_arn: ::String
+      attr_accessor expected_bucket_owner: ::String
       SENSITIVE: []
     end
 
@@ -876,6 +877,21 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class DetectionRuleEc2Requirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
+    class DetectionRuleEcsFargateRequirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
+    class DetectionRuleEksRequirements
+      attr_accessor min_agent_version: ::String
+      SENSITIVE: []
+    end
+
     class DetectionRuleFilter
       attr_accessor name: ("name" | "description" | "dataSource" | "severity" | "tactic" | "technique" | "service")
       attr_accessor values: ::Array[::String]
@@ -907,6 +923,18 @@ module Aws::GuardDuty
       SENSITIVE: []
     end
 
+    class DetectionRuleRuntimeMonitoringDetails
+      attr_accessor platforms: Types::DetectionRuleRuntimePlatforms
+      SENSITIVE: []
+    end
+
+    class DetectionRuleRuntimePlatforms
+      attr_accessor eks: Types::DetectionRuleEksRequirements
+      attr_accessor ec2: Types::DetectionRuleEc2Requirements
+      attr_accessor ecs_fargate: Types::DetectionRuleEcsFargateRequirements
+      SENSITIVE: []
+    end
+
     class DetectorAdditionalConfiguration
       attr_accessor name: ("EKS_ADDON_MANAGEMENT" | "ECS_FARGATE_AGENT_MANAGEMENT" | "EC2_AGENT_MANAGEMENT" | "RDS_DATA_RISK")
       attr_accessor status: ("ENABLED" | "DISABLED")
@@ -1177,6 +1205,7 @@ module Aws::GuardDuty
       attr_accessor type: ::String
       attr_accessor updated_at: ::String
       attr_accessor associated_attack_sequence_arn: ::String
+      attr_accessor custom_detection_rule_name: ::String
       SENSITIVE: []
     end
 
@@ -2657,13 +2686,14 @@ module Aws::GuardDuty
       attr_accessor name: ::String
       attr_accessor description: ::String
       attr_accessor severity: ("CRITICAL" | "HIGH" | "MEDIUM" | "LOW")
-      attr_accessor data_source: ("CloudTrailManagementEvent")
+      attr_accessor data_source: ("CloudTrailManagementEvent" | "RuntimeMonitoring")
       attr_accessor tactic: ::String
       attr_accessor technique: ::String
       attr_accessor service: ::String
       attr_accessor definition: Types::RuleDefinition
       attr_accessor language: ("SQL")
       attr_accessor schema: ("CloudTrail")
+      attr_accessor runtime_monitoring_details: Types::DetectionRuleRuntimeMonitoringDetails
       attr_accessor created_at: ::Time
       attr_accessor updated_at: ::Time
       SENSITIVE: []
@@ -2675,7 +2705,7 @@ module Aws::GuardDuty
       attr_accessor name: ::String
       attr_accessor description: ::String
       attr_accessor severity: ("CRITICAL" | "HIGH" | "MEDIUM" | "LOW")
-      attr_accessor data_source: ("CloudTrailManagementEvent")
+      attr_accessor data_source: ("CloudTrailManagementEvent" | "RuntimeMonitoring")
       attr_accessor tactic: ::String
       attr_accessor technique: ::String
       attr_accessor service: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-guardduty
 version: !ruby/object:Gem::Version
-  version: 1.166.0
+  version: 1.168.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.256.0
+        version: 3.258.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.256.0
+        version: 3.258.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement