Answers: <p><sup>Here's the answer I got from AWS Support, slightly edited. (I would downvote them, if I could).</sup></p>
  
  <p>By design, CloudWatch events do not support ranges, so you need to explicitly set the values that are in that range. Additionally, the console has an issue that we are currently addressing, regarding the <strong>.0</strong> values. </p>
  
  <p>So, the way to achieve this at the moment is only via the <a href="https://aws.amazon.com/cli/" rel="nofollow noreferrer">CLI</a>. For more information regarding the CLI command, you can read <a href="https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_cloudwatch_example" rel="nofollow noreferrer">this documentation</a>.</p>
  
  <p>The workaround is this: </p>
  
  <ol>
  <li>Create the rule through the console by selecting as a service name : Guard Duty and as an Event type: Gard duty finding.</li>
  <li>Add the targets</li>
  <li>Configure details</li>
  <li>Use the AWS CLI to run the following command. I took the initiative and added all the values in the range you mentioned. You can change it if needed:</li>
  </ol>
  
  <p><code>aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9]}}"</code></p>
  
  <p><sup>In case you need further assistance regarding the above please let me know.</sup></p>
  
  <p><sup>Best regards,</sup></p>
  
  <p><sup>Amazon Web Services</sup></p>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-14T13:22:24.980Z
Answers: I actually managed to enter it from the console. It changes 7.0 to 7, but that does not affect functionality.
Answers: Danny Schoemann
Answers: CC BY-SA 3.0
Answers: 2018-03-14T12:00:03.470Z
Answers: 2018-03-14T12:00:03.470Z
Answers: Danny Schoemann
Answers: <p>I used this post to get our Guard Duty alerts working, thanks!  But a recent change at AWS caused us to stop getting any alerts.  Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:</p>
  
  <p><code>aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"</code></p>
  
  <p>Note the "<code>7</code>" and "<code>8</code>" at the end.  Alerts are working again.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-08-07T15:42:36.763Z
Answers: 2018-08-13T05:45:08.297Z
Answers: 2018-08-13T05:45:08.297Z
Answers: Gregory Rupp
Body: <p>I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the <em>High severy</em> range, defined by AWS as <code>the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range</code>.</p>
  
  <p>The sample Event Pattern in the documentation  only shows how to create a trigger for severities 5 and 8 as follows:</p>
  
  <pre><code>{
    "source": [ "aws.guardduty" ],
    "detail-type": [ "GuardDuty Finding" ],
    "detail": {  "severity": [ 5, 8 ]  }
  }
  </code></pre>
  
  <p>How do I change this  <code>{  "severity": [ 5, 8 ]  }</code> to be a range between 7.0 to 8.9?</p>
  
Comments: CC BY-SA 3.0
Comments: 2018-03-13T15:55:13.217Z
Comments: I'm looking through the docks, and I can't seem to find any example of using a "range", which is odd because it's a float value. You would think that because it's a float value, a range would be necessary....
Comments: Preston Martin
Tags: <amazon-cloudwatch><amazon-guardduty>
Title: CloudWatch trigger for a range of GuardDuty severities
UserDisplayName: Danny Schoemann
ThreadText: # CloudWatch trigger for a range of GuardDuty severities
  
  (Asked by: username_0 on 2018-03-13)
  
  I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the *High severy* range, defined by AWS as `the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range`.
  
  The sample Event Pattern in the documentation only shows how to create a trigger for severities 5 and 8 as follows:
  
  ```
  {
    "source": [ "aws.guardduty" ],
    "detail-type": [ "GuardDuty Finding" ],
    "detail": {  "severity": [ 5, 8 ]  }
  }
  
  ```
  
  How do I change this `{ "severity": [ 5, 8 ] }` to be a range between 7.0 to 8.9?
  
  **Tags:** amazon-cloudwatch, amazon-guardduty
  
  > **Comments:**
  > **username_1**: I'm looking through the docks, and I can't seem to find any example of using a "range", which is odd because it's a float value. You would think that because it's a float value, a range would be necessary....  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2018-08-07. Score: 3 | Accepted answer
  
  I used this post to get our Guard Duty alerts working, thanks! But a recent change at AWS caused us to stop getting any alerts. Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:
  
  `aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"`
  
  Note the "`7`" and "`8`" at the end. Alerts are working again.
  
  
  ---
  
  ### Answer by username_0 on 2018-03-14. Score: 2
  
  Here's the answer I got from AWS Support, slightly edited. (I would downvote them, if I could).
  
  By design, CloudWatch events do not support ranges, so you need to explicitly set the values that are in that range. Additionally, the console has an issue that we are currently addressing, regarding the **.0** values.
  
  So, the way to achieve this at the moment is only via the [CLI](https://aws.amazon.com/cli/). For more information regarding the CLI command, you can read [this documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_cloudwatch_example).
  
  The workaround is this:
  
  1. Create the rule through the console by selecting as a service name : Guard Duty and as an Event type: Gard duty finding.
  2. Add the targets
  3. Configure details
  4. Use the AWS CLI to run the following command. I took the initiative and added all the values in the range you mentioned. You can change it if needed:
  
  `aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9]}}"`
  
  In case you need further assistance regarding the above please let me know.
  
  Best regards,
  
  Amazon Web Services
  
  > **Comments:**
  > **username_0**: I actually managed to enter it from the console. It changes 7.0 to 7, but that does not affect functionality.  
  
  ---
  
  