Skip to content

Update Member Detectors

guardduty_update_member_detectors R Documentation

Contains information on member accounts to be updated

Description

Contains information on member accounts to be updated.

Specifying both EKS Runtime Monitoring (EKS_RUNTIME_MONITORING) and Runtime Monitoring (RUNTIME_MONITORING) will cause an error. You can add only one of these two features because Runtime Monitoring already includes the threat detection for Amazon EKS resources. For more information, see Runtime Monitoring.

There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.

Usage

guardduty_update_member_detectors(DetectorId, AccountIds, DataSources,
  Features)

Arguments

DetectorId

[required] The detector ID of the administrator account.

AccountIds

[required] A list of member account IDs to be updated.

DataSources

Describes which data sources will be updated.

Features

A list of features that will be updated for the specified member accounts.

Value

A list with the following syntax:

list(
  UnprocessedAccounts = list(
    list(
      AccountId = "string",
      Result = "string"
    )
  )
)

Request syntax

svc$update_member_detectors(
  DetectorId = "string",
  AccountIds = list(
    "string"
  ),
  DataSources = list(
    S3Logs = list(
      Enable = TRUE|FALSE
    ),
    Kubernetes = list(
      AuditLogs = list(
        Enable = TRUE|FALSE
      )
    ),
    MalwareProtection = list(
      ScanEc2InstanceWithFindings = list(
        EbsVolumes = TRUE|FALSE
      )
    )
  ),
  Features = list(
    list(
      Name = "S3_DATA_EVENTS"|"EKS_AUDIT_LOGS"|"EBS_MALWARE_PROTECTION"|"RDS_LOGIN_EVENTS"|"EKS_RUNTIME_MONITORING"|"LAMBDA_NETWORK_LOGS"|"RUNTIME_MONITORING",
      Status = "ENABLED"|"DISABLED",
      AdditionalConfiguration = list(
        list(
          Name = "EKS_ADDON_MANAGEMENT"|"ECS_FARGATE_AGENT_MANAGEMENT"|"EC2_AGENT_MANAGEMENT",
          Status = "ENABLED"|"DISABLED"
        )
      )
    )
  )
)