---
title: "POST /detector/{detectorId}/malware-scan-settings"
method: POST
path: "/detector/{detectorId}/malware-scan-settings"
---

# POST /detector/{detectorId}/malware-scan-settings

`POST /detector/{detectorId}/malware-scan-settings`

Updates the malware scan settings.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see [Regions and endpoints](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_regions.html).

## Path parameters

- `detectorId` string, required

## Request body

- object
  - `scanResourceCriteria` object — Contains information about criteria used to filter resources before triggering malware scan.
    - `Include` object — Represents condition that when matched will allow a malware scan for a certain resource.
    - `Exclude` object — Represents condition that when matched will prevent a malware scan for a certain resource.
  - `ebsSnapshotPreservation` 'NO_RETENTION' | 'RETENTION_WITH_FINDING' — An enum value representing possible snapshot preservation settings.

## Response `200`

Success

- UpdateMalwareScanSettingsResponse

## Other responses

- `480` — BadRequestException
- `481` — InternalServerErrorException

---

[API](https://skmtc.net/aws/apis/guardduty.md) · [All operations](https://skmtc.net/aws/apis/guardduty/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/guardduty/versions/d35ef49b25a3/schema)