Table: aws_guardduty_detector

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3.

Examples

Basic info

select
  detector_id,
  arn,
  created_at,
  status,
  service_role
from
  aws_guardduty_detector;

List enabled detectors

select
  detector_id,
  created_at,
  status
from
  aws_guardduty_detector
where
  status = 'ENABLED';

Get data source status info for each detector

select
  detector_id,
  status as detector_status,
  data_sources -> 'CloudTrail' ->> 'Status' as cloud_trail_status,
  data_sources -> 'DNSLogs' ->> 'Status' as dns_logs_status,
  data_sources -> 'FlowLogs' ->> 'Status' as flow_logs_status
from
  aws_guardduty_detector;

Get information about the master account relationship

select
  detector_id,
  master_account ->> 'AccountId' as master_account_id,
  master_account ->> 'InvitationId' as invitation_id,
  master_account ->> 'RelationshipStatus' as relationship_status
from
  aws_guardduty_detector
where
  master_account is not null;

Query examples

guardduty_detectors_for_iam_role

Control examples

.inspect aws_guardduty_detector

AWS GuardDuty Detector

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) specifying the detector.
created_at	timestamp with time zone	The timestamp of when the detector was created.
data_sources	jsonb	Describes which data sources are enabled for the detector.
detector_id	text	The ID of the detector.
finding_publishing_frequency	text	The publishing frequency of the finding.
master_account	jsonb	Contains information about the administrator account and invitation.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
service_role	text	The GuardDuty service role.
status	text	The detector status.
tags	jsonb	A map of tags for the resource.
title	text	Title of the resource.
updated_at	timestamp with time zone	The last-updated timestamp for the detector.

turbot/aws