Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-1467438317.3 KB

Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.

post/detector/{detectorId}/threatintelset

Path parameters

detectorIdstring required

The unique ID of the detector of the GuardDuty account that you want to create a threatIntelSet for.

Request body

namestring required

A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.

format'TXT' | 'STIX' | 'OTX_CSV' | 'ALIEN_VAULT' | 'PROOF_POINT' | 'FIRE_EYE' required

The format of the file that contains the ThreatIntelSet.

locationstring required

The URI of the file that contains the ThreatIntelSet.

activateboolean required

A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.

clientTokenstring

The idempotency token for the create request.

tagsobject

The tags to be added to a new threat list resource.

Response

Success

ThreatIntelSetIdstring required

The ID of the ThreatIntelSet resource.