create_threat_intel_set ¶

def create_threat_intel_set(
    self,
    detector_id: "capo_guardduty.types.detector_id.DetectorId",
    *,
    config_overrides: Optional[GuardDutyClientConfig] = None,
    name: Optional["capo_guardduty.types.name.Name"] = None,
    format: Optional[
        "capo_guardduty.types.threat_intel_set_format.ThreatIntelSetFormat"
    ] = None,
    location: Optional["capo_guardduty.types.location.Location"] = None,
    activate: Optional["capo_guardduty.types.boolean.Boolean"] = None,
    client_token: Optional["capo_guardduty.types.client_token.ClientToken"] = None,
    tags: Optional["capo_guardduty.types.tag_map.TagMap"] = None,
    expected_bucket_owner: Optional[
        "capo_guardduty.types.account_id.AccountId"
    ] = None,
) -> "capo_guardduty.types.create_threat_intel_set_response.CreateThreatIntelSetResponse":
    """<p>Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.</p>

    Args:
        detector_id: <p>The unique ID of the detector of the GuardDuty account for which you want to create a <code>threatIntelSet</code>.</p> <p>To find the <code>detectorId</code> in the current Region, see the Settings page in the GuardDuty console, or run the <a href="https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html">ListDetectors</a> API.</p>
        name: <p>A user-friendly ThreatIntelSet name displayed in all findings that are generated by activity that involves IP addresses included in this ThreatIntelSet.</p>
        format: <p>The format of the file that contains the ThreatIntelSet.</p>
        location: <p>The URI of the file that contains the ThreatIntelSet. </p>
        activate: <p>A Boolean value that indicates whether GuardDuty is to start using the uploaded ThreatIntelSet.</p>
        client_token: <p>The idempotency token for the create request.</p>
        tags: <p>The tags to be added to a new threat list resource.</p>
        expected_bucket_owner: <p>The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the <b>location</b> parameter.</p>

    Raises:
        capo_guardduty.errors.access_denied_exception.AccessDeniedException: <p>An access denied exception object.</p>
        capo_guardduty.errors.bad_request_exception.BadRequestException: <p>A bad request exception object.</p>
        capo_guardduty.errors.internal_server_error_exception.InternalServerErrorException: <p>An internal server error exception object.</p>
        capo_guardduty.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_guardduty.types.create_threat_intel_set_request.CreateThreatIntelSetRequest]",
    ) -> OperationResponse[
        "capo_guardduty.types.create_threat_intel_set_response.CreateThreatIntelSetResponse"
    ]:
        import capo_guardduty._operations.guard_duty_api_service.create_threat_intel_set

        output, http_response = (
            capo_guardduty._operations.guard_duty_api_service.create_threat_intel_set.create_threat_intel_set(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateThreatIntelSet")
    )
    input_: capo_guardduty.types.create_threat_intel_set_request.CreateThreatIntelSetRequest = {
        "detector_id": detector_id
    }
    if name is not None:
        input_["name"] = name
    if format is not None:
        input_["format"] = format
    if location is not None:
        input_["location"] = location
    if activate is not None:
        input_["activate"] = activate
    if client_token is None:
        client_token = str(uuid.uuid4())
    input_["client_token"] = client_token
    if tags is not None:
        input_["tags"] = tags
    if expected_bucket_owner is not None:
        input_["expected_bucket_owner"] = expected_bucket_owner

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output