POST

/detector/{detectorId}/threatintelset

http://guardduty.{region}.amazonaws.com/detector/{detectorId}/threatintelset

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

Access Token Required: API Key

Path Parameters

detectorIdstringrequired

The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.

Body Params

namestringrequired

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

tagsobject

The tags to be added to a new threat list resource.

formatstringrequired

The format of the file that contains the ThreatIntelSet.

activatebooleanrequired

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

locationstringrequired

The URI of the file that contains the ThreatIntelSet.

clientTokenstring

The idempotency token for the create request.

Responses

{
  "success": true,
  "data": {
    "id": "abc123",
    "created_at": "2025-01-01T00:00:00Z"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request parameters"
  }
}

Language

CredentialsAPI KEY

API Key

Enter token below to save for later

cURL Request

1curl --request POST \
2     --url 'http://guardduty.{region}.amazonaws.com/detector/{detectorId}/threatintelset' \
3     --header 'accept: application/json' \
4     --header 'content-type: application/json'

Response

1{
2  "success": true,
3  "data": {
4    "id": "abc123",
5    "created_at": "2025-01-01T00:00:00Z"
6  }
7}