<p><sup>Here's the answer I got from AWS Support, slightly edited. (I would downvote them, if I could).</sup></p>

<p>By design, CloudWatch events do not support ranges, so you need to explicitly set the values that are in that range. Additionally, the console has an issue that we are currently addressing, regarding the <strong>.0</strong> values. </p>

<p>So, the way to achieve this at the moment is only via the <a href="https://aws.amazon.com/cli/" rel="nofollow noreferrer">CLI</a>. For more information regarding the CLI command, you can read <a href="https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_cloudwatch_example" rel="nofollow noreferrer">this documentation</a>.</p>

<p>The workaround is this: </p>

<ol>
<li>Create the rule through the console by selecting as a service name : Guard Duty and as an Event type: Gard duty finding.</li>
<li>Add the targets</li>
<li>Configure details</li>
<li>Use the AWS CLI to run the following command. I took the initiative and added all the values in the range you mentioned. You can change it if needed:</li>
</ol>

<p><code>aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9]}}"</code></p>

<p><sup>In case you need further assistance regarding the above please let me know.</sup></p>

<p><sup>Best regards,</sup></p>

<p><sup>Amazon Web Services</sup></p>

CC BY-SA 3.0
2018-03-14T13:22:24.980Z
I actually managed to enter it from the console. It changes 7.0 to 7, but that does not affect functionality.
Danny Schoemann
CC BY-SA 3.0
2018-03-14T12:00:03.470Z
2018-03-14T12:00:03.470Z
Danny Schoemann
<p>I used this post to get our Guard Duty alerts working, thanks!  But a recent change at AWS caused us to stop getting any alerts.  Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:</p>

<p><code>aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"</code></p>

<p>Note the "<code>7</code>" and "<code>8</code>" at the end.  Alerts are working again.</p>

CC BY-SA 4.0
2018-08-07T15:42:36.763Z
2018-08-13T05:45:08.297Z
2018-08-13T05:45:08.297Z
Gregory Rupp
<p>I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the <em>High severy</em> range, defined by AWS as <code>the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range</code>.</p>

<p>The sample Event Pattern in the documentation  only shows how to create a trigger for severities 5 and 8 as follows:</p>

<pre><code>{
  "source": [ "aws.guardduty" ],
  "detail-type": [ "GuardDuty Finding" ],
  "detail": {  "severity": [ 5, 8 ]  }
}
</code></pre>

<p>How do I change this  <code>{  "severity": [ 5, 8 ]  }</code> to be a range between 7.0 to 8.9?</p>

CC BY-SA 3.0
2018-03-13T15:55:13.217Z
I'm looking through the docks, and I can't seem to find any example of using a "range", which is odd because it's a float value. You would think that because it's a float value, a range would be necessary....
Preston Martin
<amazon-cloudwatch><amazon-guardduty>
CloudWatch trigger for a range of GuardDuty severities
Danny Schoemann
# CloudWatch trigger for a range of GuardDuty severities

(Asked by: username_0 on 2018-03-13)

I want to edit my CloudWatch rule so that it only triggers an SNS topic for "GuardDuty findings" that fall in the High severy range, defined by AWS as the value of the severity parameter in the GetFindings response falls within the 7.0 to 8.9 range.
The sample Event Pattern in the documentation  only shows how to create a trigger for severities 5 and 8 as follows:
{
  "source": [ "aws.guardduty" ],
  "detail-type": [ "GuardDuty Finding" ],
  "detail": {  "severity": [ 5, 8 ]  }
}

How do I change this  {  "severity": [ 5, 8 ]  } to be a range between 7.0 to 8.9?

**Tags:** amazon-cloudwatch, amazon-guardduty

> **Comments:**
> **username_1**: I'm looking through the docks, and I can't seem to find any example of using a "range", which is odd because it's a float value. You would think that because it's a float value, a range would be necessary....  

---

## 2 answers

### Answer by username_2 on 2018-08-07. Score: 3 | Accepted answer

I used this post to get our Guard Duty alerts working, thanks! But a recent change at AWS caused us to stop getting any alerts. Turns out we needed to add the integer values along with floating point numbers. We used a CLI command like the following to do that:

`aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9,7,8]}}"`

Note the "`7`" and "`8`" at the end. Alerts are working again.


---

### Answer by username_0 on 2018-03-14. Score: 2

Here's the answer I got from AWS Support, slightly edited. (I would downvote them, if I could).

By design, CloudWatch events do not support ranges, so you need to explicitly set the values that are in that range. Additionally, the console has an issue that we are currently addressing, regarding the **.0** values.

So, the way to achieve this at the moment is only via the [CLI](https://aws.amazon.com/cli/). For more information regarding the CLI command, you can read [this documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_cloudwatch_example).

The workaround is this:

1. Create the rule through the console by selecting as a service name : Guard Duty and as an Event type: Gard duty finding.
2. Add the targets
3. Configure details
4. Use the AWS CLI to run the following command. I took the initiative and added all the values in the range you mentioned. You can change it if needed:

`aws events put-rule --name Test --event-pattern "{\"source\":[\"aws.guardduty\"],\"detail-type\":[\"GuardDuty Finding\"],\"detail\":{\"severity\":[7.0,7.1,7.2,7.3,7.4,7.5,7.6,7.7,7.8,7.9,8.0,8.1,8.2,8.3,8.4,8.5,8.6,8.7,8.8,8.9]}}"`

In case you need further assistance regarding the above please let me know.

Best regards,

Amazon Web Services

> **Comments:**
> **username_0**: I actually managed to enter it from the console. It changes 7.0 to 7, but that does not affect functionality.  

---

