Filter

Source: src/AWS/GuardDuty/Filter.ts

A GuardDuty findings filter — matches findings against criteria and either keeps (NOOP) or auto-archives (ARCHIVE) them. Identity is the (detectorId, name) pair; description, action, rank, and criteria are updatable in place.

Filtering Findings

Auto-archive low-severity findings

const detector = yield* AWS.GuardDuty.Detector("Detector", {});
const filter = yield* AWS.GuardDuty.Filter("LowSeverity", {
  detectorId: detector.detectorId,
  action: "ARCHIVE",
  rank: 1,
  findingCriteria: { Criterion: { severity: { LessThan: 4 } } },
});

Keep a named filter for the console

const filter = yield* AWS.GuardDuty.Filter("ProdOnly", {
  detectorId: detector.detectorId,
  name: "prod-only",
  description: "Findings on production resources",
  findingCriteria: {
    Criterion: { "resource.instanceDetails.tags.value": { Equals: ["prod"] } },
  },
});