@aws-sdk/client-guardduty 3.1122.0 → 3.1124.0

package/dist-types/models/models_0.d.ts

@@ -1,4 +1,4 @@
-import type { AdminStatus, AutoEnableMembers, CloudProvider, ClusterStatus, Confidence, ConfidenceLevel, ContentPolicyFilterAction, ContentPolicyFilterType, CoverageFilterCriterionKey, CoverageSortKey, CoverageStatisticsType, CoverageStatus, CriterionKey, DataSourceStatus, DestinationType, DetectorFeature, DetectorFeatureResult, DetectorStatus, EcsClusterStatus, EcsLaunchType, FeatureAdditionalConfiguration, FeatureStatus, FilterAction, FindingPublishingFrequency, FindingResourceType, FindingStatisticType, FreeTrialFeatureResult, GroupByType, GuardrailAction, GuardrailSource, IndicatorType, InvestigationStatus, IpSetFormat, IpSetStatus, KubernetesResourcesTypes, MalwareProtectionPlanStatus, MalwareProtectionPlanTaggingActionStatus, MalwareProtectionScanType, ManagementType, MfaStatus, NetworkDirection, OrderBy, OrgFeature, OrgFeatureAdditionalConfiguration, OrgFeatureStatus, ProfileSubtype, ProfileType, PublicAccessStatus, PublicAclIgnoreBehavior, PublicBucketRestrictBehavior, PublishingStatus, ResourceType, RiskLevel, ScanCategory, ScanResult, ScanStatus, ScanType, SignalType, ThreatEntitySetFormat, ThreatIntelSetFormat, TriggerType, TrustedEntitySetFormat } from "./enums";
+import type { AdminStatus, AssociationMode, AutoEnableMembers, CloudProvider, ClusterStatus, ConfidenceLevel, ContentPolicyFilterAction, ContentPolicyFilterType, CoverageFilterCriterionKey, CoverageSortKey, CoverageStatisticsType, CoverageStatus, CriterionKey, DataSourceStatus, DestinationType, DetectionRuleConfigurationStatus, DetectionRuleDataSource, DetectionRuleFilterCondition, DetectionRuleSeverity, DetectorFeature, DetectorFeatureResult, DetectorStatus, EcsClusterStatus, EcsLaunchType, FeatureAdditionalConfiguration, FeatureStatus, FilterAction, FilterFieldName, FindingPublishingFrequency, FindingResourceType, FreeTrialFeatureResult, GuardrailAction, GuardrailSource, IndicatorType, IpSetFormat, KubernetesResourcesTypes, MalwareProtectionPlanTaggingActionStatus, MalwareProtectionScanType, ManagementType, MfaStatus, NetworkDirection, OrderBy, OrgFeature, OrgFeatureAdditionalConfiguration, OrgFeatureStatus, ProfileSubtype, ProfileType, PublicAccessStatus, PublicAclIgnoreBehavior, PublicBucketRestrictBehavior, PublishingStatus, ResourceType, RuleLanguage, RuleSchema, ScanCategory, ScanResult, ScanStatus, ScanType, SignalType, ThreatEntitySetFormat, ThreatIntelSetFormat, TriggerType, TrustedEntitySetFormat } from "./enums";
 /**
  * @public
  */
@@ -1167,6 +1167,93 @@ export interface ArchiveFindingsRequest {
  */
 export interface ArchiveFindingsResponse {
 }
+/**
+ * <p>Contains the full details of a custom detection rule association.</p>
+ * @public
+ */
+export interface AssociationDetail {
+    /**
+     * <p>The unique identifier for the association.</p>
+     * @public
+     */
+    AssociationId: string | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the association.</p>
+     * @public
+     */
+    Arn: string | undefined;
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The Amazon Web Services account ID associated with this rule association.</p>
+     * @public
+     */
+    AccountId: string | undefined;
+    /**
+     * <p>The rule execution mode. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>The timestamp when the association was created.</p>
+     * @public
+     */
+    CreatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the association was last updated.</p>
+     * @public
+     */
+    UpdatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the association expires.</p>
+     * @public
+     */
+    ExpiresAt?: Date | undefined;
+}
+/**
+ * <p>Contains summary information about a custom detection rule association.</p>
+ * @public
+ */
+export interface AssociationSummary {
+    /**
+     * <p>The unique identifier for the association.</p>
+     * @public
+     */
+    AssociationId: string | undefined;
+    /**
+     * <p>The Amazon Resource Name (ARN) of the association.</p>
+     * @public
+     */
+    Arn: string | undefined;
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The rule execution mode. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>The timestamp when the association was created.</p>
+     * @public
+     */
+    CreatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the association was last updated.</p>
+     * @public
+     */
+    UpdatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the association expires.</p>
+     * @public
+     */
+    ExpiresAt?: Date | undefined;
+}
 /**
  * <p>Contains information about the Autonomous System (AS) associated with the network endpoints involved in an attack sequence.</p>
  * @public
@@ -1801,6 +1888,76 @@ export interface CoverageStatistics {
      */
     CountByCoverageStatus?: Partial<Record<CoverageStatus, number>> | undefined;
 }
+/**
+ * @public
+ */
+export interface CreateCustomDetectionRuleAssociationRequest {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The rule execution mode. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>A unique, case-sensitive identifier to ensure that the operation completes no more than one time. Maximum 64 characters.</p>
+     * @public
+     */
+    ClientToken?: string | undefined;
+    /**
+     * <p>The tags to be added to the new custom detection rule association resource.</p>
+     * @public
+     */
+    Tags?: Record<string, string> | undefined;
+}
+/**
+ * @public
+ */
+export interface CreateCustomDetectionRuleAssociationResponse {
+    /**
+     * <p>The details of the newly created custom detection rule association.</p>
+     * @public
+     */
+    RuleAssociation: AssociationDetail | undefined;
+}
+/**
+ * @public
+ */
+export interface CreateCustomDetectionRuleOrgConfigurationRequest {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The execution mode of the organization configuration. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>The account IDs to include in the organization configuration. Mutually exclusive with <code>ExcludeAccountIds</code>.</p>
+     * @public
+     */
+    IncludeAccountIds?: string[] | undefined;
+    /**
+     * <p>The account IDs to exclude from the organization configuration. Mutually exclusive with <code>IncludeAccountIds</code>.</p>
+     * @public
+     */
+    ExcludeAccountIds?: string[] | undefined;
+    /**
+     * <p>A unique, case-sensitive identifier to ensure that the operation completes no more than one time.</p>
+     * @public
+     */
+    ClientToken?: string | undefined;
+}
+/**
+ * @public
+ */
+export interface CreateCustomDetectionRuleOrgConfigurationResponse {
+}
 /**
  * <p>Describes whether Kubernetes audit logs are enabled as a data source.</p>
  * @public
@@ -2695,6 +2852,46 @@ export interface DefaultServerSideEncryption {
      */
     KmsMasterKeyArn?: string | undefined;
 }
+/**
+ * @public
+ */
+export interface DeleteCustomDetectionRuleAssociationRequest {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The unique identifier for the association to delete.</p>
+     * @public
+     */
+    AssociationId: string | undefined;
+}
+/**
+ * @public
+ */
+export interface DeleteCustomDetectionRuleAssociationResponse {
+}
+/**
+ * @public
+ */
+export interface DeleteCustomDetectionRuleOrgConfigurationRequest {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The execution mode of the organization configuration to delete. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+}
+/**
+ * @public
+ */
+export interface DeleteCustomDetectionRuleOrgConfigurationResponse {
+}
 /**
  * @public
  */
@@ -4200,6 +4397,119 @@ export interface Detection {
      */
     Sequence?: Sequence | undefined;
 }
+/**
+ * <p>Contains filter criteria for listing custom detection rules or associations.</p>
+ * @public
+ */
+export interface DetectionRuleFilter {
+    /**
+     * <p>The name of the field to filter by.</p>
+     * @public
+     */
+    Name: FilterFieldName | undefined;
+    /**
+     * <p>The values to match against the specified filter name.</p>
+     * @public
+     */
+    Values: string[] | undefined;
+    /**
+     * <p>The condition to apply to the filter. For example, <code>EQUALS</code> or <code>CONTAINS</code>.</p>
+     * @public
+     */
+    Condition?: DetectionRuleFilterCondition | undefined;
+}
+/**
+ * <p>Contains the organization-level configuration for a custom detection rule.</p>
+ * @public
+ */
+export interface DetectionRuleOrgConfiguration {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The execution mode of the organization configuration. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>The configuration status. Valid values: <code>ACTIVE</code> | <code>PROCESSING</code> | <code>FAILED</code>.</p>
+     * @public
+     */
+    Status: DetectionRuleConfigurationStatus | undefined;
+    /**
+     * <p>The reason for the current configuration status.</p>
+     * @public
+     */
+    StatusReason?: string | undefined;
+    /**
+     * <p>A list of member account IDs included in the organization configuration. Mutually exclusive with <code>ExcludeAccountIds</code>.</p>
+     * @public
+     */
+    IncludeAccountIds: string[] | undefined;
+    /**
+     * <p>A list of member account IDs excluded from the organization configuration. Mutually exclusive with <code>IncludeAccountIds</code>.</p>
+     * @public
+     */
+    ExcludeAccountIds: string[] | undefined;
+    /**
+     * <p>The timestamp when the organization configuration was created.</p>
+     * @public
+     */
+    CreatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the organization configuration was last updated.</p>
+     * @public
+     */
+    UpdatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the organization configuration expires.</p>
+     * @public
+     */
+    ExpiresAt?: Date | undefined;
+}
+/**
+ * <p>Contains summary information about an organization-level configuration for a custom detection rule.</p>
+ * @public
+ */
+export interface DetectionRuleOrgConfigurationSummary {
+    /**
+     * <p>The unique identifier for the custom detection rule.</p>
+     * @public
+     */
+    RuleId: string | undefined;
+    /**
+     * <p>The rule execution mode.</p>
+     * @public
+     */
+    Mode: AssociationMode | undefined;
+    /**
+     * <p>The configuration status.</p>
+     * @public
+     */
+    Status: DetectionRuleConfigurationStatus | undefined;
+    /**
+     * <p>The reason for the current configuration status.</p>
+     * @public
+     */
+    StatusReason?: string | undefined;
+    /**
+     * <p>The timestamp when the organization configuration was created.</p>
+     * @public
+     */
+    CreatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the organization configuration was last updated.</p>
+     * @public
+     */
+    UpdatedAt: Date | undefined;
+    /**
+     * <p>The timestamp when the organization configuration expires.</p>
+     * @public
+     */
+    ExpiresAt?: Date | undefined;
+}
 /**
  * <p>Information about the additional configuration.</p>
  * @public
@@ -6260,520 +6570,219 @@ export interface GetCoverageStatisticsResponse {
 /**
  * @public
  */
-export interface GetDetectorRequest {
+export interface GetCustomDetectionRuleRequest {
     /**
-     * <p>The unique ID of the detector that you want to get.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The unique identifier for the custom detection rule.</p>
      * @public
      */
-    DetectorId: string | undefined;
+    RuleId: string | undefined;
 }
 /**
+ * <p>Contains the detection logic for a custom detection rule.</p>
  * @public
  */
-export interface GetDetectorResponse {
+export interface RuleDefinition {
     /**
-     * <p>The timestamp of when the detector was created.</p>
+     * <p>The detection logic expression for the rule.</p>
      * @public
      */
-    CreatedAt?: string | undefined;
-    /**
-     * <p>The publishing frequency of the finding.</p>
-     * @public
-     */
-    FindingPublishingFrequency?: FindingPublishingFrequency | undefined;
-    /**
-     * <p>The GuardDuty service role.</p>
-     * @public
-     */
-    ServiceRole: string | undefined;
-    /**
-     * <p>The detector status.</p>
-     * @public
-     */
-    Status: DetectorStatus | undefined;
-    /**
-     * <p>The last-updated timestamp for the detector.</p>
-     * @public
-     */
-    UpdatedAt?: string | undefined;
-    /**
-     * <p>Describes which data sources are enabled for the detector.</p>
-     *
-     * @deprecated This parameter is deprecated, use Features instead.
-     * @public
-     */
-    DataSources?: DataSourceConfigurationsResult | undefined;
-    /**
-     * <p>The tags of the detector resource.</p>
-     * @public
-     */
-    Tags?: Record<string, string> | undefined;
-    /**
-     * <p>Describes the features that have been enabled for the detector.</p>
-     * @public
-     */
-    Features?: DetectorFeatureConfigurationResult[] | undefined;
+    Expression: string | undefined;
 }
 /**
+ * <p>Contains the full details of a custom detection rule, including its detection logic.</p>
  * @public
  */
-export interface GetFilterRequest {
+export interface RuleDetail {
     /**
-     * <p>The unique ID of the detector that is associated with this filter.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The unique identifier for the rule.</p>
      * @public
      */
-    DetectorId: string | undefined;
+    RuleId: string | undefined;
     /**
-     * <p>The name of the filter you want to get.</p>
+     * <p>The Amazon Resource Name (ARN) of the rule.</p>
      * @public
      */
-    FilterName: string | undefined;
-}
-/**
- * @public
- */
-export interface GetFilterResponse {
+    Arn: string | undefined;
     /**
-     * <p>The name of the filter.</p>
+     * <p>The display name of the rule.</p>
      * @public
      */
     Name: string | undefined;
     /**
-     * <p>The description of the filter.</p>
-     * @public
-     */
-    Description?: string | undefined;
-    /**
-     * <p>Specifies the action that is to be applied to the findings that match the filter.</p>
-     * @public
-     */
-    Action: FilterAction | undefined;
-    /**
-     * <p>Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.</p>
-     * @public
-     */
-    Rank?: number | undefined;
-    /**
-     * <p>Represents the criteria to be used in the filter for querying findings.</p>
-     * @public
-     */
-    FindingCriteria: FindingCriteria | undefined;
-    /**
-     * <p>The tags of the filter resource.</p>
-     * @public
-     */
-    Tags?: Record<string, string> | undefined;
-    /**
-     * <p>The timestamp when the filter was created. This field is not available for filters that were created before the lifecycle metadata feature was enabled (legacy filters).</p>
+     * <p>A description of what the rule detects.</p>
      * @public
      */
-    CreatedAt?: Date | undefined;
+    Description: string | undefined;
     /**
-     * <p>The timestamp when the filter was last updated. For legacy filters, this field is present only after the filter has been updated at least once since the lifecycle metadata feature was enabled.</p>
+     * <p>The severity level assigned to findings generated by this rule.</p>
      * @public
      */
-    UpdatedAt?: Date | undefined;
+    Severity: DetectionRuleSeverity | undefined;
     /**
-     * <p>The version of the filter. Every time the filter is updated, the version increments by 1. This field is not available for legacy filters that were created before the lifecycle metadata feature was enabled.</p>
+     * <p>The data source that the rule analyzes.</p>
      * @public
      */
-    Version?: number | undefined;
-}
-/**
- * @public
- */
-export interface GetFindingsRequest {
+    DataSource: DetectionRuleDataSource | undefined;
     /**
-     * <p>The ID of the detector that specifies the GuardDuty service whose findings you want to retrieve.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The MITRE ATT&amp;CK tactic associated with the rule.</p>
      * @public
      */
-    DetectorId: string | undefined;
+    Tactic: string | undefined;
     /**
-     * <p>The IDs of the findings that you want to retrieve.</p>
+     * <p>The MITRE ATT&amp;CK technique associated with the rule.</p>
      * @public
      */
-    FindingIds: string[] | undefined;
+    Technique: string | undefined;
     /**
-     * <p>Represents the criteria used for sorting findings.</p>
+     * <p>The Amazon Web Services service associated with the rule.</p>
      * @public
      */
-    SortCriteria?: SortCriteria | undefined;
-}
-/**
- * @public
- */
-export interface GetFindingsResponse {
+    Service: string | undefined;
     /**
-     * <p>A list of findings.</p>
+     * <p>The detection logic definition for the rule.</p>
      * @public
      */
-    Findings: Finding[] | undefined;
-}
-/**
- * @public
- */
-export interface GetFindingsStatisticsRequest {
+    Definition: RuleDefinition | undefined;
     /**
-     * <p>The ID of the detector whose findings statistics you want to retrieve.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The language used for the detection logic expression.</p>
      * @public
      */
-    DetectorId: string | undefined;
+    Language?: RuleLanguage | undefined;
     /**
-     * <p>The types of finding statistics to retrieve.</p>
-     *
-     * @deprecated This parameter is deprecated, please use GroupBy instead.
+     * <p>The schema version used by the rule definition.</p>
      * @public
      */
-    FindingStatisticTypes?: FindingStatisticType[] | undefined;
+    Schema?: RuleSchema | undefined;
     /**
-     * <p>Represents the criteria that is used for querying findings.</p>
+     * <p>The timestamp when the rule was created.</p>
      * @public
      */
-    FindingCriteria?: FindingCriteria | undefined;
-    /**
-     * <p>Displays the findings statistics grouped by one of the listed valid values.</p>
-     * @public
-     */
-    GroupBy?: GroupByType | undefined;
-    /**
-     * <p>Displays the sorted findings in the requested order. The default value of <code>orderBy</code> is <code>DESC</code>.</p> <p>You can use this parameter only with the <code>groupBy</code> parameter.</p>
-     * @public
-     */
-    OrderBy?: OrderBy | undefined;
-    /**
-     * <p>The maximum number of results to be returned in the response. The default value is 25.</p> <p>You can use this parameter only with the <code>groupBy</code> parameter.</p>
-     * @public
-     */
-    MaxResults?: number | undefined;
-}
-/**
- * @public
- */
-export interface GetFindingsStatisticsResponse {
-    /**
-     * <p>The finding statistics object.</p>
-     * @public
-     */
-    FindingStatistics: FindingStatistics | undefined;
+    CreatedAt: Date | undefined;
     /**
-     * <p>The pagination parameter to be used on the next list operation to retrieve more items.</p> <p>This parameter is currently not supported.</p>
+     * <p>The timestamp when the rule was last updated.</p>
      * @public
      */
-    NextToken?: string | undefined;
+    UpdatedAt?: Date | undefined;
 }
 /**
  * @public
  */
-export interface GetInvestigationRequest {
+export interface GetCustomDetectionRuleResponse {
     /**
-     * <p>The unique ID of the GuardDuty detector associated with the investigation.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The details of the custom detection rule.</p>
      * @public
      */
-    DetectorId: string | undefined;
-    /**
-     * <p>The unique identifier of the investigation to retrieve.</p>
-     * @public
-     */
-    InvestigationId: string | undefined;
+    Rule: RuleDetail | undefined;
 }
 /**
- * <p>Contains information about the product that produced an investigation.</p>
  * @public
  */
-export interface Product {
+export interface GetCustomDetectionRuleAssociationRequest {
     /**
-     * <p>The name of the product.</p>
+     * <p>The unique identifier for the custom detection rule.</p>
      * @public
      */
-    Name: string | undefined;
+    RuleId: string | undefined;
     /**
-     * <p>The specific feature within the product that produced the investigation.</p>
+     * <p>The unique identifier for the association.</p>
      * @public
      */
-    Feature?: string | undefined;
+    AssociationId: string | undefined;
 }
 /**
- * <p>Contains metadata about the product and version that produced an investigation.</p>
  * @public
  */
-export interface InvestigationMetadata {
+export interface GetCustomDetectionRuleAssociationResponse {
     /**
-     * <p>The version of the investigation engine that produced the results.</p>
+     * <p>The details of the custom detection rule association.</p>
      * @public
      */
-    Version: string | undefined;
+    RuleAssociation: AssociationDetail | undefined;
     /**
-     * <p>Information about the product that produced the investigation.</p>
+     * <p>The tags associated with the custom detection rule association resource.</p>
      * @public
      */
-    Product: Product | undefined;
+    Tags?: Record<string, string> | undefined;
 }
 /**
- * <p>Contains the details and results of a GuardDuty investigation.</p>
  * @public
  */
-export interface Investigation {
-    /**
-     * <p>The unique identifier of the investigation.</p>
-     * @public
-     */
-    InvestigationId: string | undefined;
-    /**
-     * <p>The current status of the investigation. Possible values are <code>RUNNING</code>, <code>COMPLETED</code>, and <code>FAILED</code>.</p>
-     * @public
-     */
-    Status: InvestigationStatus | undefined;
-    /**
-     * <p>The natural-language prompt that initiated this investigation.</p>
-     * @public
-     */
-    TriggerPrompt: string | undefined;
+export interface GetCustomDetectionRuleOrgConfigurationRequest {
     /**
-     * <p>The account that initiated the investigation.</p>
+     * <p>The unique identifier for the custom detection rule.</p>
      * @public
      */
-    TriggeredBy: string | undefined;
+    RuleId: string | undefined;
     /**
-     * <p>Metadata about the product and version that produced the investigation.</p>
+     * <p>The execution mode of the organization configuration to retrieve. Valid values: <code>LIVE</code> | <code>DRY_RUN</code>.</p>
      * @public
      */
-    Metadata?: InvestigationMetadata | undefined;
-    /**
-     * <p>Details about the cloud environment in which the investigation was performed, including the provider, region, and account.</p>
-     * @public
-     */
-    Cloud?: CloudDetails | undefined;
-    /**
-     * <p>The assessed risk level of the investigated threat. Possible values are <code>Info</code>, <code>Low</code>, <code>Medium</code>, <code>High</code>, and <code>Critical</code>.</p>
-     * @public
-     */
-    RiskLevel?: RiskLevel | undefined;
-    /**
-     * <p>A human-readable description of the assessed risk.</p>
-     * @public
-     */
-    Risk?: string | undefined;
-    /**
-     * <p>The confidence level of the investigation's assessment. Possible values are <code>Unknown</code>, <code>Low</code>, <code>Medium</code>, and <code>High</code>.</p>
-     * @public
-     */
-    Confidence?: Confidence | undefined;
-    /**
-     * <p>A structured summary of the investigation findings, including affected resources, threat assessment, and recommended remediation steps.</p>
-     * @public
-     */
-    Summary?: string | undefined;
-    /**
-     * <p>The timestamp at which the investigation started.</p>
-     * @public
-     */
-    StartTime?: Date | undefined;
-    /**
-     * <p>The timestamp at which the investigation completed.</p>
-     * @public
-     */
-    EndTime?: Date | undefined;
-    /**
-     * <p>Details about the error if the investigation status is <code>FAILED</code>.</p>
-     * @public
-     */
-    Error?: string | undefined;
+    Mode: AssociationMode | undefined;
 }
 /**
  * @public
  */
-export interface GetInvestigationResponse {
+export interface GetCustomDetectionRuleOrgConfigurationResponse {
     /**
-     * <p>The details and results of the requested investigation.</p>
+     * <p>The details of the organization configuration.</p>
      * @public
      */
-    Investigation: Investigation | undefined;
+    Configuration: DetectionRuleOrgConfiguration | undefined;
 }
 /**
  * @public
  */
-export interface GetInvitationsCountRequest {
-}
-/**
- * @public
- */
-export interface GetInvitationsCountResponse {
-    /**
-     * <p>The number of received invitations.</p>
-     * @public
-     */
-    InvitationsCount?: number | undefined;
-}
-/**
- * @public
- */
-export interface GetIPSetRequest {
+export interface GetDetectorRequest {
     /**
-     * <p>The unique ID of the detector that is associated with the IPSet.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
+     * <p>The unique ID of the detector that you want to get.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
      * @public
      */
     DetectorId: string | undefined;
-    /**
-     * <p>The unique ID of the IPSet to retrieve.</p>
-     * @public
-     */
-    IpSetId: string | undefined;
 }
 /**
  * @public
  */
-export interface GetIPSetResponse {
-    /**
-     * <p>The user-friendly name for the IPSet.</p>
-     * @public
-     */
-    Name: string | undefined;
-    /**
-     * <p>The format of the file that contains the IPSet.</p>
-     * @public
-     */
-    Format: IpSetFormat | undefined;
-    /**
-     * <p>The URI of the file that contains the IPSet.</p>
-     * @public
-     */
-    Location: string | undefined;
-    /**
-     * <p>The status of IPSet file that was uploaded.</p>
-     * @public
-     */
-    Status: IpSetStatus | undefined;
-    /**
-     * <p>The tags of the IPSet resource.</p>
-     * @public
-     */
-    Tags?: Record<string, string> | undefined;
-    /**
-     * <p>The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the <b>location</b> parameter. This field appears in the response only if it was provided during IPSet creation or update.</p>
-     * @public
-     */
-    ExpectedBucketOwner?: string | undefined;
-}
-/**
- * @public
- */
-export interface GetMalwareProtectionPlanRequest {
-    /**
-     * <p>A unique identifier associated with Malware Protection plan resource.</p>
-     * @public
-     */
-    MalwareProtectionPlanId: string | undefined;
-}
-/**
- * <p>Information about the issue code and message associated to the status of your Malware Protection plan.</p>
- * @public
- */
-export interface MalwareProtectionPlanStatusReason {
-    /**
-     * <p>Issue code.</p>
-     * @public
-     */
-    Code?: string | undefined;
-    /**
-     * <p>Issue message that specifies the reason. For information about potential troubleshooting steps, see <a href="https://docs.aws.amazon.com/guardduty/latest/ug/troubleshoot-s3-malware-protection-status-errors.html">Troubleshooting Malware Protection for S3 status issues</a> in the <i>Amazon GuardDuty User Guide</i>.</p>
-     * @public
-     */
-    Message?: string | undefined;
-}
-/**
- * @public
- */
-export interface GetMalwareProtectionPlanResponse {
-    /**
-     * <p>Amazon Resource Name (ARN) of the protected resource.</p>
-     * @public
-     */
-    Arn?: string | undefined;
+export interface GetDetectorResponse {
     /**
-     * <p>Amazon Resource Name (ARN) of the IAM role that includes the permissions to scan and add tags to the associated protected resource.</p>
+     * <p>The timestamp of when the detector was created.</p>
      * @public
      */
-    Role?: string | undefined;
+    CreatedAt?: string | undefined;
     /**
-     * <p>Information about the protected resource that is associated with the created Malware Protection plan. Presently, <code>S3Bucket</code> is the only supported protected resource.</p>
+     * <p>The publishing frequency of the finding.</p>
      * @public
      */
-    ProtectedResource?: CreateProtectedResource | undefined;
+    FindingPublishingFrequency?: FindingPublishingFrequency | undefined;
     /**
-     * <p>Information about whether the tags will be added to the S3 object after scanning.</p>
+     * <p>The GuardDuty service role.</p>
      * @public
      */
-    Actions?: MalwareProtectionPlanActions | undefined;
+    ServiceRole: string | undefined;
     /**
-     * <p>The timestamp when the Malware Protection plan resource was created.</p>
+     * <p>The detector status.</p>
      * @public
      */
-    CreatedAt?: Date | undefined;
+    Status: DetectorStatus | undefined;
     /**
-     * <p>Malware Protection plan status.</p>
+     * <p>The last-updated timestamp for the detector.</p>
      * @public
      */
-    Status?: MalwareProtectionPlanStatus | undefined;
+    UpdatedAt?: string | undefined;
     /**
-     * <p>Information about the issue code and message associated to the status of your Malware Protection plan.</p>
+     * <p>Describes which data sources are enabled for the detector.</p>
+     *
+     * @deprecated This parameter is deprecated, use Features instead.
      * @public
      */
-    StatusReasons?: MalwareProtectionPlanStatusReason[] | undefined;
+    DataSources?: DataSourceConfigurationsResult | undefined;
     /**
-     * <p>Tags added to the Malware Protection plan resource.</p>
+     * <p>The tags of the detector resource.</p>
      * @public
      */
     Tags?: Record<string, string> | undefined;
-}
-/**
- * @public
- */
-export interface GetMalwareScanRequest {
     /**
-     * <p>A unique identifier that gets generated when you invoke the API without any error. Each malware scan has a corresponding scan ID. Using this scan ID, you can monitor the status of your malware scan.</p>
-     * @public
-     */
-    ScanId: string | undefined;
-}
-/**
- * <p>Contains information about the recovery point configuration used in the scan.</p>
- * @public
- */
-export interface ScanConfigurationRecoveryPoint {
-    /**
-     * <p>The name of the Amazon Web Services Backup vault that contains the recovery point for the scanned.</p>
-     * @public
-     */
-    BackupVaultName?: string | undefined;
-    /**
-     * <p>The time range within the continuous backup in Amazon Web Services Backup that was scanned for a point-in-time recovery resource.</p>
-     * @public
-     */
-    ContinuousScanDetails?: ScanConfigurationContinuousScanDetails | undefined;
-}
-/**
- * <p>Contains information about the configuration used for the malware scan.</p>
- * @public
- */
-export interface ScanConfiguration {
-    /**
-     * <p>Amazon Resource Name (ARN) of the IAM role that should contain the required permissions for the scan.</p>
-     * @public
-     */
-    Role?: string | undefined;
-    /**
-     * <p>Information about the entity that triggered the malware scan.</p>
-     * @public
-     */
-    TriggerDetails?: TriggerDetails | undefined;
-    /**
-     * <p>Information about the incremental scan configuration, if applicable.</p>
-     * @public
-     */
-    IncrementalScanDetails?: IncrementalScanDetails | undefined;
-    /**
-     * <p>Information about the recovery point configuration used for the scan, if applicable.</p>
+     * <p>Describes the features that have been enabled for the detector.</p>
      * @public
      */
-    RecoveryPoint?: ScanConfigurationRecoveryPoint | undefined;
+    Features?: DetectorFeatureConfigurationResult[] | undefined;
 }