/security-profiles/{securityProfileName}

Creates a Device Defender security profile.

Requires permission to access the CreateSecurityProfile action.

curl --location -g --request POST 'https://api.iotwireless.{region}.amazonaws.com/security-profiles/' \ --header 'Content-Type: application/json' \ --data-raw '{ "securityProfileDescription": "string", "behaviors": [ { "name": "string", "metric": "string", "metricDimension": { "dimensionName": "string", "operator": "IN" }, "criteria": { "comparisonOperator": "less-than", "value": { "count": 0, "cidrs": [], "ports": [], "number": 0, "numbers": [], "strings": [] }, "durationSeconds": 0, "consecutiveDatapointsToAlarm": 0, "consecutiveDatapointsToClear": 0, "statisticalThreshold": { "statistic": "string" }, "mlDetectionConfig": { "confidenceLevel": "LOW" } }, "suppressAlerts": true } ], "alertTargets": { "property1": { "alertTargetArn": "string", "roleArn": "string" } }, "additionalMetricsToRetain": [ "string" ], "additionalMetricsToRetainV2": [ { "metric": "string", "metricDimension": {} } ], "tags": [ { "Key": "string", "Value": "string" } ] }'

Request

Path Params

securityProfileName

string

required

The name you are giving to the security profile.

Body Params application/json

securityProfileDescription

string

optional

A description of the security profile.

<= 1000 characters

Match pattern:

[\p{Graph}\x20]*

behaviors

array[object (Behavior) {5}]

optional

Specifies the behaviors that, when violated by a device (thing), cause an alert.

<= 100 items

name

string

required

The name you've given to the behavior.

>= 1 characters<= 128 characters

Match pattern:

[a-zA-Z0-9:_-]+

metric

string

optional

What is measured by the behavior.

metricDimension

object

optional

The dimension for a metric in your behavior. For example, using a TOPIC_FILTER dimension, you can narrow down the scope of the metric to only MQTT topics where the name matches the pattern specified in the dimension. This can't be used with custom metrics.

criteria

object

optional

The criteria that determine if a device is behaving normally in regard to the metric.

suppressAlerts

boolean

optional

Suppresses alerts.

alertTargets

object

optional

Specifies the destinations to which alerts are sent. (Alerts are always sent to the console.) Alerts are generated when a device (thing) violates a behavior.

Additional properties

object (AlertTarget)

optional

A structure containing the alert target ARN and the role ARN.

additionalMetricsToRetain

array[string]

optional

Please use CreateSecurityProfileRequest$additionalMetricsToRetainV2 instead.

A list of metrics whose data is retained (stored). By default, data is retained for any metric used in the profile's behaviors, but it is also retained for any metric specified here. Can be used with custom metrics; cannot be used with dimensions.

additionalMetricsToRetainV2

array[object (MetricToRetain) {2}]

optional

metric

string

required

What is measured by the behavior.

metricDimension

object

optional

The dimension of a metric. This can't be used with custom metrics.

/security-profiles/{securityProfileName}

Request

Responses