ThreatIntelSet

Source: src/AWS/GuardDuty/ThreatIntelSet.ts

A GuardDuty threat intelligence set — an S3-hosted list of known malicious IP addresses that GuardDuty generates findings for. The list file must exist in S3 before activation; name, location, and activation are updatable in place, while format changes replace the set.

Custom Threat Intelligence

const detector = yield* AWS.GuardDuty.Detector("Detector", {});
const threats = yield* AWS.GuardDuty.ThreatIntelSet("BadIPs", {
  detectorId: detector.detectorId,
  format: "TXT",
  location: "https://s3.amazonaws.com/my-security-bucket/threats.txt",
});