awsdocs / amazon-guardduty-user-guide

The open source version of the Amazon GuardDuty documentation. You can provide feedback & requests for changes by submitting issues in this repo or by making proposed changes & submitting a pull request.

NOTICE

This repository is archived, read-only, and no longer updated. For more information, read the announcement on the AWS News Blog.

You can find up-to-date AWS technical documentation on the AWS Documentation website, where you can also submit feedback and suggestions for improvement.

amazon-guardduty-user-guide's Issues

documentation mistake

Stealth:IAMUser/PasswordPolicyChange is a Low priority in the docs, but a high priority in the console

Documentation - Eventbridge URL is incorrect

Documentation https://github.com/awsdocs/amazon-guardduty-user-guide/blame/main/doc_source/guardduty_settingup.md#L185 is inaccurate. URL link to eventbridge is incorrect

Currently is:

1. Open the EventBridge console at https://console.aws.amazon.com/eventsy/.

Needs to be

1. Open the EventBridge console at https://console.aws.amazon.com/events/.

Improving the organization of current and archived finding types

I would appreciate any ideas on how to better structure and present a rather large list of GuardDuty finding types. Some (the majority) are current. Some are archived. The archived ones might become current at some point. New types will be added in months and years to come. The list is expected to grow. Having it all in one topic is not longer the best or most readable/user-friendly option.

I would love to hear your thoughts and ideas.

ProxyCommand not working in sample_findings.md

The ProxyCommand used for connecting to the tester instance no longer works with the instances created via CloudFormation. ProxyCommand with NetCat results in an error. Using the "-W" switch with OpenSSH corrects the issue.

disable-organization-admin-account arguments use Unicode dashes instead of ASCII

Currently:
aws guardduty disable-organization-admin-account ‐‐admin-account-id "123456789012"

Should be:
aws guardduty disable-organization-admin-account --admin-account-id "123456789012"

I realize these look identical to the eye, but the difference causes the command not to recognize the parameter name.

documentation mistake

The last two examples on https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html are round the wrong way, ie the parsed example should come last