Write Action
guardduty.call
ActionAmazon Web Servicesconnection required
Calls the AWS guardduty API (SigV4).
Run one of 56 write actions on GuardDuty.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- Amazon GuardDuty
- Secret shape
- {"access_key_id", "secret_access_key"}
- Config it needs
- region
- Resolved by
- config.connection_id, else node.connection_id
Configuration
3 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
region AWS region (overrides the connection). | string | No | — | — | — |
action Which write action to run. | string | Yes | — | one of "AcceptAdministratorInvitation", "AcceptInvitation", "ArchiveFindings", "CreateCustomDetectionRuleAssociation", "CreateCustomDetectionRuleOrgConfiguration", "CreateDetector", "CreateFilter", "CreateIPSet", "CreateInvestigation", "CreateMalwareProtectionPlan", "CreateMembers", "CreatePublishingDestination", "CreateSampleFindings", "CreateThreatEntitySet", "CreateThreatIntelSet", "CreateTrustedEntitySet", "DeclineInvitations", "DeleteCustomDetectionRuleAssociation", "DeleteCustomDetectionRuleOrgConfiguration", "DeleteDetector", "DeleteFilter", "DeleteIPSet", "DeleteInvitations", "DeleteMalwareProtectionPlan", "DeleteMembers", "DeletePublishingDestination", "DeleteThreatEntitySet", "DeleteThreatIntelSet", "DeleteTrustedEntitySet", "DisableOrganizationAdminAccount", "DisassociateFromAdministratorAccount", "DisassociateFromMasterAccount", "DisassociateMembers", "EnableOrganizationAdminAccount", "InviteMembers", "SendObjectMalwareScan", "StartMalwareScan", "StartMonitoringMembers", "StopMonitoringMembers", "TagResource", "UnarchiveFindings", "UntagResource", "UpdateCustomDetectionRuleAssociation", "UpdateCustomDetectionRuleOrgConfiguration", "UpdateDetector", "UpdateFilter", "UpdateFindingsFeedback", "UpdateIPSet", "UpdateMalwareProtectionPlan", "UpdateMalwareScanSettings", "UpdateMemberDetectors", "UpdateOrganizationConfiguration", "UpdatePublishingDestination", "UpdateThreatEntitySet", "UpdateThreatIntelSet", "UpdateTrustedEntitySet" | — |
request The action's input, as AWS documents it. | object | No | — | — | — |
Output
One shape.
result
The AWS response for the operation you named, as returned.
Extra keys beyond the ones listed can appear.
{}Notes
- This performs a real change in the account. Dry runs stub it, like every other external node.
Related Amazon GuardDuty nodes
See Write Action run in a workflow.
In a technical demo we add the Amazon GuardDuty connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.