uR R S r SSKJr SSKJr SSKJr SSKJr Sr " S S\R 5 r " S S
\R 5 r " S S \R 5 r
" S
S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S \R 5 r " S S \R 5 r " S S \R 5 r " S! S"\R 5 r " S# S$\R 5 r " S% S&\R 5 r " S' S(\R 5 r " S) S*\R 5 r " S+ S,\R 5 r " S- S.\R 5 r " S/ S0\R 5 r " S1 S2\R 5 r " S3 S4\R 5 r! " S5 S6\R 5 r" " S7 S8\R 5 r# " S9 S:\R 5 r$ " S; S<\R 5 r% " S= S>\R 5 r& " S? S@\R 5 r' " SA SB\R 5 r( " SC SD\R 5 r) " SE SF\R 5 r* " SG SH\R 5 r+ " SI SJ\R 5 r, " SK SL\R 5 r- " SM SN\R 5 r. " SO SP\R 5 r/ " SQ SR\R 5 r0 " SS ST\R 5 r1 " SU SV\R 5 r2 " SW SX\R 5 r3 " SY SZ\R 5 r4 " S[ S\\R 5 r5 " S] S^\R 5 r6 " S_ S`\R 5 r7 " Sa Sb\R 5 r8 " Sc Sd\R 5 r9 " Se Sf\R 5 r: " Sg Sh\R 5 r; " Si Sj\R 5 r< " Sk Sl\R 5 r= " Sm Sn\R 5 r> " So Sp\R 5 r? " Sq Sr\R 5 r@ " Ss St\R 5 rA " Su Sv\R 5 rB " Sw Sx\R 5 rC " Sy Sz\R 5 rD " S{ S|\R 5 rE " S} S~\R 5 rF " S S\R 5 rG " S S\R 5 rH " S S\R 5 rI " S S\R 5 rJ " S S\R 5 rK " S S\R 5 rL " S S\R 5 rM " S S\R 5 rN " S S\R 5 rO " S S\R 5 rP " S S\R 5 rQ " S S\R 5 rR " S S\R 5 rS " S S\R 5 rT " S S\R 5 rU " S S\R 5 rV " S S\R 5 rW " S S\R 5 rX " S S\R 5 rY " S S\R 5 rZ " S S\R 5 r[ " S S\R 5 r\ " S S\R 5 r] " S S\R 5 r^ " S S\R 5 r_ " S S\R 5 r` " S S\R 5 ra " S S\R 5 rb " S S\R 5 rc " S S\R 5 rd " S S\R 5 re " S S\R 5 rf " S S\R 5 rg " S S\R 5 rh " S S\R 5 ri " S S\R 5 rj " S S\R 5 rk " S S\R 5 rl " S S\R 5 rm " S S\R 5 rn " S S\R 5 ro " S S\R 5 rp " S S\R 5 rq " S S\R 5 rr " S S\R 5 rs " S S\R 5 rt " S S\R 5 ru " S S\R 5 rv " S S\R 5 rw " S S\R 5 rx " S S\R 5 ry " S S\R 5 rz " S S\R 5 r{ " S S\R 5 r| " S S\R 5 r} " S S\R 5 r~ " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S GS \R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS
\R 5 r " GS GS \R 5 r " GS
GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS \R 5 r " GS GS \R 5 r " GS GS \R 5 r " GS! GS"\R 5 r " GS# GS$\R 5 r " GS% GS&\R 5 r " GS' GS(\R 5 r " GS) GS*\R 5 r " GS+ GS,\R 5 r " GS- GS.\R 5 r " GS/ GS0\R 5 r " GS1 GS2\R 5 r " GS3 GS4\R 5 r " GS5 GS6\R 5 r " GS7 GS8\R 5 r " GS9 GS:\R 5 r " GS; GS<\R 5 r " GS= GS>\R 5 r " GS? GS@\R 5 r " GSA GSB\R 5 r " GSC GSD\R 5 r " GSE GSF\R 5 r " GSG GSH\R 5 r " GSI GSJ\R 5 r " GSK GSL\R 5 r " GSM GSN\R 5 r " GSO GSP\R 5 r " GSQ GSR\R 5 r " GSS GST\R 5 r " GSU GSV\R 5 r " GSW GSX\R 5 r " GSY GSZ\R 5 r " GS[ GS\\R 5 r " GS] GS^\R 5 r " GS_ GS`\R 5 r " GSa GSb\R 5 r " GSc GSd\R 5 r " GSe GSf\R 5 r " GSg GSh\R 5 r " GSi GSj\R 5 r " GSk GSl\R 5 r " GSm GSn\R 5 r " GSo GSp\R 5 r " GSq GSr\R 5 r " GSs GSt\R 5 r " GSu GSv\R 5 r " GSw GSx\R 5 r " GSy GSz\R 5 r " GS{ GS|\R 5 r " GS} GS~\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 r " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS \R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr
" GS GS\R 5 Gr " GS GS
\R 5 Gr " GS GS \R 5 Gr
" GS
GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS \R 5 Gr " GS GS \R 5 Gr " GS GS \R 5 Gr " GS! GS"\R 5 Gr " GS# GS$\R 5 Gr " GS% GS&\R 5 Gr " GS' GS(\R 5 Gr " GS) GS*\R 5 Gr " GS+ GS,\R 5 Gr " GS- GS.\R 5 Gr " GS/ GS0\R 5 Gr " GS1 GS2\R 5 Gr " GS3 GS4\R 5 Gr! " GS5 GS6\R 5 Gr" " GS7 GS8\R 5 Gr# " GS9 GS:\R 5 Gr$ " GS; GS<\R 5 Gr% " GS= GS>\R 5 Gr& " GS? GS@\R 5 Gr' " GSA GSB\R 5 Gr( " GSC GSD\R 5 Gr) " GSE GSF\R 5 Gr* " GSG GSH\R 5 Gr+ " GSI GSJ\R 5 Gr, " GSK GSL\R 5 Gr- " GSM GSN\R 5 Gr. " GSO GSP\R 5 Gr/ " GSQ GSR\R 5 Gr0 " GSS GST\R 5 Gr1 " GSU GSV\R 5 Gr2 " GSW GSX\R 5 Gr3 " GSY GSZ\R 5 Gr4 " GS[ GS\\R 5 Gr5 " GS] GS^\R 5 Gr6 " GS_ GS`\R 5 Gr7 " GSa GSb\R 5 Gr8 " GSc GSd\R 5 Gr9 " GSe GSf\R 5 Gr: " GSg GSh\R 5 Gr; " GSi GSj\R 5 Gr< " GSk GSl\R 5 Gr= " GSm GSn\R 5 Gr> " GSo GSp\R 5 Gr? " GSq GSr\R 5 Gr@ " GSs GSt\R 5 GrA " GSu GSv\R 5 GrB " GSw GSx\R 5 GrC " GSy GSz\R 5 GrD " GS{ GS|\R 5 GrE " GS} GS~\R 5 GrF " GS GS\R 5 GrG " GS GS\R 5 GrH " GS GS\R 5 GrI " GS GS\R 5 GrJ " GS GS\R 5 GrK " GS GS\R 5 GrL " GS GS\R 5 GrM " GS GS\R 5 GrN " GS GS\R 5 GrO " GS GS\R 5 GrP " GS GS\R 5 GrQ " GS GS\R 5 GrR " GS GS\R 5 GrS " GS GS\R 5 GrT " GS GS\R 5 GrU " GS GS\R 5 GrV " GS GS\R 5 GrW " GS GS\R 5 GrX " GS GS\R 5 GrY " GS GS\R 5 GrZ " GS GS\R 5 Gr[ " GS GS\R 5 Gr\ " GS GS\R 5 Gr] " GS GS\R 5 Gr^ " GS GS\R 5 Gr_ " GS GS\R 5 Gr` " GS GS\R 5 Gra " GS GS\R 5 Grb " GS GS\R 5 Grc " GS GS\R 5 Grd " GS GS\R 5 Gre " GS GS\R 5 Grf " GS GS\R 5 Grg " GS GS\R 5 Grh " GS GS\R 5 Gri " GS GS\R 5 Grj " GS GS\R 5 Grk " GS GS\R 5 Grl " GS GS\R 5 Grm " GS GS\R 5 Grn " GS GS\R 5 Gro " GS GS\R 5 Grp " GS GS\R 5 Grq " GS GS\R 5 Grr " GS GS\R 5 Grs " GS GS\R 5 Grt " GS GS\R 5 Gru " GS GS\R 5 Grv " GS GS\R 5 Grw " GS GS\R 5 Grx " GS GS\R 5 Gry " GS GS\R 5 Grz " GS GS\R 5 Gr{ " GS GS\R 5 Gr| " GS GS\R 5 Gr} " GS GS\R 5 Gr~ " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS \R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS
\R 5 Gr " GS GS \R 5 Gr " GS
GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS \R 5 Gr " GS GS \R 5 Gr " GS GS \R 5 Gr " GS! GS"\R 5 Gr " GS# GS$\R 5 Gr " GS% GS&\R 5 Gr " GS' GS(\R 5 Gr " GS) GS*\R 5 Gr " GS+ GS,\R 5 Gr " GS- GS.\R 5 Gr " GS/ GS0\R 5 Gr " GS1 GS2\R 5 Gr " GS3 GS4\R 5 Gr " GS5 GS6\R 5 Gr " GS7 GS8\R 5 Gr " GS9 GS:\R 5 Gr " GS; GS<\R 5 Gr " GS= GS>\R 5 Gr " GS? GS@\R 5 Gr " GSA GSB\R 5 Gr " GSC GSD\R 5 Gr " GSE GSF\R 5 Gr " GSG GSH\R 5 Gr " GSI GSJ\R 5 Gr " GSK GSL\R 5 Gr " GSM GSN\R 5 Gr " GSO GSP\R 5 Gr " GSQ GSR\R 5 Gr " GSS GST\R 5 Gr " GSU GSV\R 5 Gr " GSW GSX\R 5 Gr " GSY GSZ\R 5 Gr " GS[ GS\\R 5 Gr " GS] GS^\R 5 Gr " GS_ GS`\R 5 Gr " GSa GSb\R 5 Gr " GSc GSd\R 5 Gr " GSe GSf\R 5 Gr " GSg GSh\R 5 Gr " GSi GSj\R 5 Gr " GSk GSl\R 5 Gr " GSm GSn\R 5 Gr " GSo GSp\R 5 Gr " GSq GSr\R 5 Gr " GSs GSt\R 5 Gr " GSu GSv\R 5 Gr " GSw GSx\R 5 Gr " GSy GSz\R 5 Gr " GS{ GS|\R 5 Gr " GS} GS~\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr " GS GS\R 5 Gr\GR " G\GSGS5 \GR " G\GR GSGS5 \GR " G\GR GSGS5 Gg( zGenerated message classes for securitycenter version v2.
Security Command Center API provides access to temporal views of assets and
findings within an organization.
)absolute_import)messages)encoding) extra_typessecuritycenterc \ rS rSrSr\R " S5 r\R " SS5 r \R " S5 r
\R " S5 r \R " S5 r \R " S S
S S 9r
\R " S
5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 rSrg)Access
Represents an access event.
Fields:
callerIp: Caller's IP address, such as "1.1.1.1".
callerIpGeo: The caller IP's geolocation, which identifies where the call
came from.
methodName: The method that the service account called, e.g.
"SetIamPolicy".
principalEmail: Associated email, such as "foo@google.com". The email
address of the authenticated user or a service account acting on behalf
of a third party principal making the request. For third party identity
callers, the `principal_subject` field is populated instead of this
field. For privacy reasons, the principal email address is sometimes
redacted. For more information, see [Caller identities in audit
logs](https://cloud.google.com/logging/docs/audit#user-id).
principalSubject: A string that represents the principal_subject that is
associated with the identity. Unlike `principal_email`,
`principal_subject` supports principals that aren't associated with
email addresses, such as third party principals. For most identities,
the format is `principal://iam.googleapis.com/{identity pool
name}/subject/{subject}`. Some GKE identities, such as GKE_WORKLOAD,
FREEFORM, and GKE_HUB_WORKLOAD, still use the legacy format
`serviceAccount:{identity pool name}[{subject}]`.
serviceAccountDelegationInfo: The identity delegation history of an
authenticated service account that made the request. The
`serviceAccountDelegationInfo[]` object contains information about the
real authorities that try to access Google Cloud resources by delegating
on a service account. When multiple authorities are present, they are
guaranteed to be sorted based on the original ordering of the identity
delegation events.
serviceAccountKeyName: The name of the service account key that was used
to create or exchange credentials when authenticating the service
account that made the request. This is a scheme-less URI full resource
name. For example: "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAc
counts/{ACCOUNT}/keys/{key}".
serviceName: This is the API service that the service account made a call
to, e.g. "iam.googleapis.com"
userAgent: The caller's user agent string associated with the finding.
userAgentFamily: Type of user agent associated with the finding. For
example, an operating system shell or an embedded or standalone
application.
userName: A string that represents a username. The username provided
depends on the type of the finding and is likely not an IAM principal.
For example, this can be a system username if the finding is related to
a virtual machine, or it can be an application login username.
Geolocation ServiceAccountDelegationInfo Trepeated
N__name__
__module__ __qualname____firstlineno____doc__ _messages StringFieldcallerIp MessageField callerIpGeo
methodNameprincipalEmailprincipalSubject serviceAccountDelegationInfoserviceAccountKeyName serviceName userAgentuserAgentFamilyuserName__static_attributes__r Ylib/googlecloudsdk/generated_clients/apis/securitycenter/v2/securitycenter_v2_messages.pyr r s -^
"
"1
%(&&}a8+$$Q'* ((+. **1-!*!7!78VXYdh!i #//2%%a(+##A&) ))"-/
"
"2
&(r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
S
rg ) AccessReviewO 2 Conveys information about a Kubernetes access review (such as one
returned by a [`kubectl auth
can-i`](https://kubernetes.io/docs/reference/access-authn-
authz/authorization/#checking-api-access) command) that was involved in a
finding.
Fields:
group: The API group of the resource. "*" means all.
name: The name of the resource being requested. Empty means all.
ns: Namespace of the action being requested. Currently, there is no
distinction between no namespace and all namespaces. Both are
represented by "" (empty).
resource: The optional resource type requested. "*" means all.
subresource: The optional subresource type.
verb: A Kubernetes resource API verb, like get, list, watch, create,
update, delete, proxy. "*" means all.
version: The API version of the resource. "*" means all.
r r r r r r r r Nr r r r r! r" r# groupnamensresource subresourceverbversionr0 r r1 r2 r4 r4 O y &
"% q !$ Q "
"
"1
%(%%a(+ q !$ ! !! $'r1 r4 c < \ rS rSrSr\R " S5 rSrg)AdaptiveProtectionl Information about [Google Cloud Armor Adaptive
Protection](https://cloud.google.com/armor/docs/cloud-armor-overview#google-
cloud-armor-adaptive-protection).
Fields:
confidence: A score of 0 means that there is low confidence that the
detected event is an actual attack. A score of 1 means that there is
high confidence that the detected event is an attack. See the [Adaptive
Protection documentation](https://cloud.google.com/armor/docs/adaptive-
protection-overview#configure-alert-tuning) for further explanation.
r r N r r r r r! r"
FloatField
confidencer0 r r1 r2 rA rA l
##A&*r1 rA c < \ rS rSrSr\R " S5 rSrg)AffectedResources| tDetails about resources affected by this finding.
Fields:
count: The count of resources affected by the finding.
r r N r r r r r! r" IntegerFieldcountr0 r r1 r2 rI rI |
#%r1 rI c @ \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r \R " S5 r
\R " S 5 r\R " S
5 r\R " S 5 rS rg
)AiModel Contains information about the AI model associated with the finding.
Enums:
DeploymentPlatformValueValuesEnum: The platform on which the model is
deployed.
Fields:
deploymentPlatform: The platform on which the model is deployed.
displayName: The user defined display name of model. Ex. baseline-
classification-model
domain: The domain of the model, for example, "image-classification".
library: The name of the model library, for example, "transformers".
location: The region in which the model is used, for example, "us-
central1".
name: The name of the AI model, for example, "gemini:1.0.0".
publisher: The publisher of the model, for example, "google" or "nvidia".
c , \ rS rSrSrSrSrSrSrSr Sr
g )
)AiModel.DeploymentPlatformValueValuesEnum The platform on which the model is deployed.
Values:
DEPLOYMENT_PLATFORM_UNSPECIFIED: Unspecified deployment platform.
VERTEX_AI: Vertex AI.
GKE: Google Kubernetes Engine.
GCE: Google Compute Engine.
FINE_TUNED_MODEL: Fine tuned model.
r r r r r r N r r r r r! DEPLOYMENT_PLATFORM_UNSPECIFIED VERTEX_AIGKEGCEFINE_TUNED_MODELr0 r r1 r2 !DeploymentPlatformValueValuesEnumrU $ '(#I
C
Cr1 r^ r r r r r r r r Nr r r r r! r" Enumr^ EnumFielddeploymentPlatformr# displayNamedomainlibrarylocationr9 publisherr0 r r1 r2 rQ rQ $).. !**+NPQR%%a(+ #& ! !! $'
"
"1
%( q !$##A&)r1 rQ c < \ rS rSrSr\R " SSSS9rSrg) Allowed RAllowed IP rule.
Fields:
ipRules: Optional. Optional list of allowed IP rules.
IpRuler Tr r N r r r r r! r" r% ipRulesr0 r r1 r2 rk rk
" "8Q >'r1 rk c ` \ rS rSrSr\R " S5 r\R " S5 rSr g) Application aj Represents an application associated with a finding.
Fields:
baseUri: The base URI that identifies the network location of the
application in which the vulnerability was detected. For example,
`http://example.com`.
fullUri: The full URI with payload that can be used to reproduce the
vulnerability. For example, `http://example.com?p=aMmYgI6H`.
r r r N
r r r r r! r" r# baseUrifullUrir0 r r1 r2 rs rs )
! !! $' ! !! $'r1 rs c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " S5 r \R " S\R R S9r
\R " S5 rS rg
) Attack Information about DDoS attack volume and classification.
Fields:
classification: Type of attack, for example, 'SYN-flood', 'NTP-udp', or
'CHARGEN-udp'.
volumeBps: Total BPS (bytes per second) volume of attack. Deprecated -
refer to volume_bps_long instead.
volumeBpsLong: Total BPS (bytes per second) volume of attack.
volumePps: Total PPS (packets per second) volume of attack. Deprecated -
refer to volume_pps_long instead.
volumePpsLong: Total PPS (packets per second) volume of attack.
r r variantr r r r Nr r r r r! r" r# classificationrM VariantINT32 volumeBps
volumeBpsLong volumePps
volumePpsLongr0 r r1 r2 rz rz u ((+.$$Q 0A0A0G0GH)((+-$$Q 0A0A0G0GH)((+-r1 rz c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S\R R S9r
\R " S\R R S9r\R " S \R R S9r\R " S
5 r\R" " S 5 r\R& " SS 5 rS
rg)AttackExposure a An attack exposure contains the results of an attack path simulation
run.
Enums:
StateValueValuesEnum: What state this AttackExposure is in. This captures
whether or not an attack exposure has been calculated or not.
Fields:
attackExposureResult: The resource name of the attack path simulation
result that contains the details regarding this attack exposure score.
Example: `organizations/123/simulations/456/attackExposureResults/789`
exposedHighValueResourcesCount: The number of high value resources that
are exposed as a result of this finding.
exposedLowValueResourcesCount: The number of high value resources that are
exposed as a result of this finding.
exposedMediumValueResourcesCount: The number of medium value resources
that are exposed as a result of this finding.
latestCalculationTime: The most recent time the attack exposure was
updated on this finding.
score: A number between 0 (inclusive) and infinity that represents how
important this finding is to remediate. The higher the score, the more
important it is to remediate.
state: What state this AttackExposure is in. This captures whether or not
an attack exposure has been calculated or not.
c $ \ rS rSrSrSrSrSrSrg)#AttackExposure.StateValueValuesEnum a" What state this AttackExposure is in. This captures whether or not an
attack exposure has been calculated or not.
Values:
STATE_UNSPECIFIED: The state is not specified.
CALCULATED: The attack exposure has been calculated.
NOT_CALCULATED: The attack exposure has not been calculated.
r r r r N r r r r r! STATE_UNSPECIFIED
CALCULATEDNOT_CALCULATEDr0 r r1 r2 StateValueValuesEnumr JNr1 r r r r} r r r r r r Nr r r r r! r" ra r r# attackExposureResultrM r r exposedHighValueResourcesCount exposedLowValueResourcesCount exposedMediumValueResourcesCountlatestCalculationTimerE scorerb stater0 r r1 r2 r r s 4 Y^^ #..q1#,#9#9!YEVEVE\E\#] "+"8"8IDUDUD[D["\ %.%;%;AyGXGXG^G^%_"#//2
q
!%
4a
8%r1 r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " SS SS9r
S
r g )
AttackPathi a: A path that an attacker could take to reach an exposed resource.
Fields:
edges: A list of the edges between nodes in this attack path.
name: The attack path name, for example,
`organizations/12/simulations/34/valuedResources/56/attackPaths/78`
pathNodes: A list of nodes that exist in this attack path.
AttackPathEdger Tr r AttackPathNoder r N) r r r r r! r" r% edgesr# r9 pathNodesr0 r r1 r2 r r sC
!11t
D% q !$$$%5q4H)r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i zRepresents a connection between a source node and a destination node in
this attack path.
Fields:
destination: The attack node uuid of the destination node.
source: The attack node uuid of the source node.
r r r N)
r r r r r! r" r# destinationsourcer0 r r1 r2 r r s) %%a(+ #&r1 r c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S 5 r
\R " S
5 r \R " S 5 r \R " S 5 r
S
rg)r i- a Represents one point that an attacker passes through in this attack
path.
Fields:
associatedFindings: The findings associated with this node in the attack
path.
attackSteps: A list of attack step nodes that exist in this attack path
node.
displayName: Human-readable name of this resource.
resource: The name of the resource at this point in the attack path. The
format of the name follows the Cloud Asset Inventory [resource name
format](https://cloud.google.com/asset-inventory/docs/resource-name-
format)
resourceType: The [supported resource
type](https://cloud.google.com/asset-inventory/docs/supported-asset-
types)
uuid: Unique id of the attack path node.
PathNodeAssociatedFindingr Tr AttackStepNoder r r r r r N)r r r r r! r" r% associatedFindings attackStepsr# rd r; resourceTypeuuidr0 r r1 r2 r r - su & !--.I1W[\&&'7TJ+%%a(+
"
"1
%(&&q), q !$r1 r c N \ rS rSrSr " S S\R 5 r\R " S5 " S S\R 5 5 r \R " S5 r
\R " S 5 r\R " SS
5 r\R" " SS 5 r\R " S 5 rS
rg)r iI a Detailed steps the attack can take between path nodes.
Enums:
TypeValueValuesEnum: Attack step type. Can be either AND, OR or DEFENSE
Messages:
LabelsValue: Attack step labels for metadata
Fields:
description: Attack step description
displayName: User friendly name of the attack step
labels: Attack step labels for metadata
type: Attack step type. Can be either AND, OR or DEFENSE
uuid: Unique ID for one Node
c , \ rS rSrSrSrSrSrSrSr Sr
g )
"AttackStepNode.TypeValueValuesEnumiZ a" Attack step type. Can be either AND, OR or DEFENSE
Values:
NODE_TYPE_UNSPECIFIED: Type not specified
NODE_TYPE_AND: Incoming edge joined with AND
NODE_TYPE_OR: Incoming edge joined with OR
NODE_TYPE_DEFENSE: Incoming edge is defense
NODE_TYPE_ATTACKER: Incoming edge is attacker
r r r r r r N) r r r r r! NODE_TYPE_UNSPECIFIED
NODE_TYPE_AND NODE_TYPE_ORNODE_TYPE_DEFENSENODE_TYPE_ATTACKERr0 r r1 r2 TypeValueValuesEnumr Z s% MLr1 r additionalPropertiesc f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
AttackStepNode.LabelsValueij zAttack step labels for metadata
Messages:
AdditionalProperty: An additional property for a LabelsValue object.
Fields:
additionalProperties: Additional properties of type LabelsValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)-AttackStepNode.LabelsValue.AdditionalPropertyiu zAn additional property for a LabelsValue object.
Fields:
key: Name of the additional property.
value: A string attribute.
r r r N
r r r r r! r" r# keyvaluer0 r r1 r2 AdditionalPropertyr u )
! !! $c##A&er1 r r Tr r N r r r r r! r" Messager r% r r0 r r1 r2 LabelsValuer j s2 'Y . . ' %112FTXYr1 r r r r r r r N)r r r r r! r" ra r r MapUnrecognizedFieldsr r r# descriptionrd r% labelsrb typer r0 r r1 r2 r r I s INN !!"89ZI%% Z :Z. %%a(+%%a(+ ! !- 3& 2A 6$ q !$r1 r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
AuditConfigi aw Specifies the audit configuration for a service. The configuration
determines which permission types are logged, and what identities, if any,
are exempted from logging. An AuditConfig must have one or more
AuditLogConfigs. If there are AuditConfigs for both `allServices` and a
specific service, the union of the two AuditConfigs is used for that
service: the log_types specified in each AuditConfig are enabled, and the
exempted_members in each AuditLogConfig are exempted. Example Policy with
multiple AuditConfigs: { "audit_configs": [ { "service": "allServices",
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type":
"ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com",
"audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type":
"DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For
sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
logging. It also exempts `jose@example.com` from DATA_READ logging, and
`aliya@example.com` from DATA_WRITE logging.
Fields:
auditLogConfigs: The configuration for logging of each type of permission.
service: Specifies a service that will be enabled for audit logging. For
example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
`allServices` is a special value that covers all services.
AuditLogConfigr Tr r r N) r r r r r! r" r% auditLogConfigsr# servicer0 r r1 r2 r r s. 0 **+;QN/ ! !! $'r1 r c \ rS rSrSr " S S\R 5 r\R " SSS9r \R " SS5 r S r g
) r i aR Provides the configuration for logging a type of permissions. Example: {
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables
'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from
DATA_READ logging.
Enums:
LogTypeValueValuesEnum: The log type that this config enables.
Fields:
exemptedMembers: Specifies the identities that do not cause logging for
this type of permission. Follows the same format of Binding.members.
logType: The log type that this config enables.
c ( \ rS rSrSrSrSrSrSrSr g) %AuditLogConfig.LogTypeValueValuesEnumi a The log type that this config enables.
Values:
LOG_TYPE_UNSPECIFIED: Default case. Should never be this.
ADMIN_READ: Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE: Data writes. Example: CloudSQL Users create
DATA_READ: Data reads. Example: CloudSQL Users list
r r r r r N)
r r r r r! LOG_TYPE_UNSPECIFIED
ADMIN_READ
DATA_WRITE DATA_READr0 r r1 r2 LogTypeValueValuesEnumr s JJIr1 r r Tr r r N)
r r r r r! r" ra r r# exemptedMembersrb logTyper0 r r1 r2 r r s>
y~~ ))!d;/ 8! <'r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)
AwsAccounti An AWS account that is a member of an organization.
Fields:
id: The unique identifier (ID) of the account, containing exactly 12
digits.
name: The friendly name of this account.
r r r N
r r r r r! r" r# idr9 r0 r r1 r2 r r ) Q " q !$r1 r c \ rS rSrSr\R " SS5 r\R " SS5 r\R " SSS S
9r S r
g )
AwsMetadatai AWS metadata associated with the resource, only applicable if the
finding's cloud provider is Amazon Web Services.
Fields:
account: The AWS account associated with the resource.
organization: The AWS organization associated with the resource.
organizationalUnits: A list of AWS organizational units associated with
the resource, ordered from lowest level (closest to the account) to
highest level.
r r AwsOrganizationr AwsOrganizationalUnitr Tr r N r r r r r! r" r% account organizationorganizationalUnitsr0 r r1 r2 r r sE
" "< 3'''(91=,!../FTXYr1 r c < \ rS rSrSr\R " S5 rSrg)r i An organization is a collection of accounts that are centrally managed
together using consolidated billing, organized hierarchically with
organizational units (OUs), and controlled with policies.
Fields:
id: The unique identifier (ID) for the organization. The regex pattern for
an organization ID string requires "o-" followed by from 10 to 32
lowercase letters or digits.
r r N r r r r r! r" r# r r0 r r1 r2 r r Q "r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i g An Organizational Unit (OU) is a container of AWS accounts within a root
of an organization. Policies that are attached to an OU apply to all
accounts contained in that OU and in any child OUs.
Fields:
id: The unique identifier (ID) associated with this OU. The regex pattern
for an organizational unit ID string requires "ou-" followed by from 4
to 32 lowercase letters or digits (the ID of the root that contains the
OU). This string is followed by a second "-" dash and from 8 to 32
additional lowercase letters or digits. For example, "ou-ab12-cd34ef56".
name: The friendly name of the OU.
r r r Nr r r1 r2 r r ) Q " q !$r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)AzureManagementGroupi Represents an Azure management group.
Fields:
displayName: The display name of the Azure management group.
id: The UUID of the Azure management group, for example,
`20000000-0001-0000-0000-000000000000`.
r r r N
r r r r r! r" r# rd r r0 r r1 r2 r r ) %%a(+ Q "r1 r c \ rS rSrSr\R " SSSS9r\R " SS5 r\R " S S
5 r \R " S S 5 r
S
r g)
AzureMetadatai Azure metadata associated with the resource, only applicable if the
finding's cloud provider is Microsoft Azure.
Fields:
managementGroups: A list of Azure management groups associated with the
resource, ordered from lowest level (closest to the subscription) to
highest level.
resourceGroup: The Azure resource group associated with the resource.
subscription: The Azure subscription associated with the resource.
tenant: The Azure Entra tenant associated with the resource.
r r Tr AzureResourceGroupr AzureSubscriptionr AzureTenantr r N r r r r r! r" r% managementGroups
resourceGroup subscriptiontenantr0 r r1 r2 r r sX
++,BAPTU(()=qA-''(;Q?, ! !- 3&r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i& Represents an Azure resource group.
Fields:
id: The ID of the Azure resource group.
name: The name of the Azure resource group. This is not a UUID.
r r r Nr r r1 r2 r r & ) Q " q !$r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i2 Represents an Azure subscription.
Fields:
displayName: The display name of the Azure subscription.
id: The UUID of the Azure subscription, for example,
`291bba3f-e0a5-47bc-a099-3bdcb2a50a05`.
r r r Nr r r1 r2 r r 2 r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i? Represents a Microsoft Entra tenant.
Fields:
displayName: The display name of the Azure tenant.
id: The ID of the Microsoft Entra tenant, for example,
"a11aaa11-aa11-1aa1-11aa-1aaa11a".
r r r Nr r r1 r2 r r ? r r1 r c z \ rS rSrSr\R " S5 r\R " SSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S SS9r
\R " S SS9r\R " S
5 r\R " S5 rSrg)BackupDisasterRecoveryiL
Information related to Google Cloud Backup and DR Service findings.
Fields:
appliance: The name of the Backup and DR appliance that captures, moves,
and manages the lifecycle of backup data. For example, `backup-
server-57137`.
applications: The names of Backup and DR applications. An application is a
VM, database, or file system on a managed host monitored by a backup and
recovery appliance. For example, `centos7-01-vol00`, `centos7-01-vol01`,
`centos7-01-vol02`.
backupCreateTime: The timestamp at which the Backup and DR backup was
created.
backupTemplate: The name of a Backup and DR template which comprises one
or more backup policies. See the [Backup and DR
documentation](https://cloud.google.com/backup-disaster-
recovery/docs/concepts/backup-plan#temp) for more information. For
example, `snap-ov`.
backupType: The backup type of the Backup and DR image. For example,
`Snapshot`, `Remote Snapshot`, `OnVault`.
host: The name of a Backup and DR host, which is managed by the backup and
recovery appliance and known to the management console. The host can be
of type Generic (for example, Compute Engine, SQL Server, Oracle DB, SMB
file system, etc.), vCenter, or an ESX server. See the [Backup and DR
documentation on hosts](https://cloud.google.com/backup-disaster-
recovery/docs/configuration/manage-hosts-and-their-applications) for
more information. For example, `centos7-01`.
policies: The names of Backup and DR policies that are associated with a
template and that define when to run a backup, how frequently to run a
backup, and how long to retain the backup image. For example,
`onvaults`.
policyOptions: The names of Backup and DR advanced policy options of a
policy applying to an application. See the [Backup and DR documentation
on policy options](https://cloud.google.com/backup-disaster-
recovery/docs/create-plan/policy-settings). For example,
`skipofflineappsincongrp, nounmap`.
profile: The name of the Backup and DR resource profile that specifies the
storage media for backups of application and VM data. See the [Backup
and DR documentation on profiles](https://cloud.google.com/backup-
disaster-recovery/docs/concepts/backup-plan#profile). For example,
`GCP`.
storagePool: The name of the Backup and DR storage pool that the backup
and recovery appliance is storing data in. The storage pool could be of
type Cloud, Primary, Snapshot, or OnVault. See the [Backup and DR
documentation on storage pools](https://cloud.google.com/backup-
disaster-recovery/docs/concepts/storage-pools). For example,
`DiskPoolOne`.
r r Tr r r r r r r r r r Nr r r r r! r" r# appliance applicationsbackupCreateTimebackupTemplate
backupTypehostpolicies
policyOptionsprofile storagePoolr0 r r1 r2 r r L .` ##A&)&&q48, **1- ((+.$$Q'* q !$
"
"1t
4(''D9- ! !! $'%%b)+r1 r c < \ rS rSrSr\R " SSSS9rSrg) &BatchCreateResourceValueConfigsRequesti zRequest message to create multiple resource value configs
Fields:
requests: Required. The resource value configs to be created.
CreateResourceValueConfigRequestr Tr r N) r r r r r! r" r% requestsr0 r r1 r2 r r s
#
#$FTX
Y(r1 r c < \ rS rSrSr\R " SSSS9rSrg) 'BatchCreateResourceValueConfigsResponsei zyResponse message for BatchCreateResourceValueConfigs
Fields:
resourceValueConfigs: The resource value configs created
.GoogleCloudSecuritycenterV2ResourceValueConfigr Tr r N) r r r r r! r" r% resourceValueConfigsr0 r r1 r2 r r s! #//0`bcnrsr1 r c < \ rS rSrSr\R " S5 rSrg)BigQueryDestinationi zThe destination BigQuery dataset to export findings to.
Fields:
dataset: Required. The relative resource name of the destination dataset,
in the form projects/{projectId}/datasets/{datasetId}.
r r N) r r r r r! r" r# datasetr0 r r1 r2 r r s
! !! $'r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) Bindingi at Associates `members`, or principals, with a `role`.
Fields:
condition: The condition that is associated with this binding. If the
condition evaluates to `true`, then this binding applies to the current
request. If the condition evaluates to `false`, then this binding does
not apply to the current request. However, a different role binding
might grant the same role to one or more of the principals in this
binding. To learn which resources support conditions in their IAM
policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
members: Specifies the principals requesting access for a Google Cloud
resource. `members` can have the following values: * `allUsers`: A
special identifier that represents anyone who is on the internet; with
or without a Google account. * `allAuthenticatedUsers`: A special
identifier that represents anyone who is authenticated with a Google
account or a service account. Does not include identities that come from
external identity providers (IdPs) through identity federation. *
`user:{emailid}`: An email address that represents a specific Google
account. For example, `alice@example.com` . *
`serviceAccount:{emailid}`: An email address that represents a Google
service account. For example, `my-other-
app@appspot.gserviceaccount.com`. *
`serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`:
An identifier for a [Kubernetes service
account](https://cloud.google.com/kubernetes-engine/docs/how-
to/kubernetes-service-accounts). For example, `my-
project.svc.id.goog[my-namespace/my-kubernetes-sa]`. *
`group:{emailid}`: An email address that represents a Google group. For
example, `admins@example.com`. * `domain:{domain}`: The G Suite domain
(primary) that represents all the users of that domain. For example,
`google.com` or `example.com`. * `principal://iam.googleapis.com/locatio
ns/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A
single identity in a workforce identity pool. * `principalSet://iam.goog
leapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
All workforce identities in a group. * `principalSet://iam.googleapis.co
m/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{
attribute_value}`: All workforce identities with a specific attribute
value. * `principalSet://iam.googleapis.com/locations/global/workforcePo
ols/{pool_id}/*`: All identities in a workforce identity pool. * `princi
pal://iam.googleapis.com/projects/{project_number}/locations/global/work
loadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single
identity in a workload identity pool. * `principalSet://iam.googleapis.c
om/projects/{project_number}/locations/global/workloadIdentityPools/{poo
l_id}/group/{group_id}`: A workload identity pool group. * `principalSet
://iam.googleapis.com/projects/{project_number}/locations/global/workloa
dIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
All identities in a workload identity pool with a certain attribute. * `
principalSet://iam.googleapis.com/projects/{project_number}/locations/gl
obal/workloadIdentityPools/{pool_id}/*`: All identities in a workload
identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email
address (plus unique identifier) representing a user that has been
recently deleted. For example,
`alice@example.com?uid=123456789012345678901`. If the user is recovered,
this value reverts to `user:{emailid}` and the recovered user retains
the role in the binding. *
`deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address
(plus unique identifier) representing a service account that has been
recently deleted. For example, `my-other-
app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the
service account is undeleted, this value reverts to
`serviceAccount:{emailid}` and the undeleted service account retains the
role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An
email address (plus unique identifier) representing a Google group that
has been recently deleted. For example,
`admins@example.com?uid=123456789012345678901`. If the group is
recovered, this value reverts to `group:{emailid}` and the recovered
group retains the role in the binding. * `deleted:principal://iam.google
apis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attr
ibute_value}`: Deleted single identity in a workforce identity pool. For
example, `deleted:principal://iam.googleapis.com/locations/global/workfo
rcePools/my-pool-id/subject/my-subject-attribute-value`.
role: Role that is assigned to the list of `members`, or principals. For
example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an
overview of the IAM roles and permissions, see the [IAM
documentation](https://cloud.google.com/iam/docs/roles-overview). For a
list of the available pre-defined roles, see
[here](https://cloud.google.com/iam/docs/understanding-roles).
Exprr r Tr r r N) r r r r r! r" r% conditionr# membersroler0 r r1 r2 r r s? Ob $$VQ/) ! !!d 3' q !$r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) BulkMuteFindingsRequesti a Request message for bulk findings update. Note: 1. If multiple bulk
update requests match the same resource, the order in which they get
executed is not defined. 2. Once a bulk operation is started, there is no
way to stop it.
Enums:
MuteStateValueValuesEnum: Optional. All findings matching the given filter
will have their mute state set to this value. The default value is
`MUTED`. Setting this to `UNDEFINED` will clear the mute state on all
matching findings.
Fields:
filter: Expression that identifies findings that should be updated. The
expression is a list of zero or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. The fields map to those
defined in the corresponding resource. The supported operators are: *
`=` for all value types. * `>`, `<`, `>=`, `<=` for integer values. *
`:`, meaning substring matching, for strings. The supported value types
are: * string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes.
muteState: Optional. All findings matching the given filter will have
their mute state set to this value. The default value is `MUTED`.
Setting this to `UNDEFINED` will clear the mute state on all matching
findings.
c $ \ rS rSrSrSrSrSrSrg)0BulkMuteFindingsRequest.MuteStateValueValuesEnumi ao Optional. All findings matching the given filter will have their mute
state set to this value. The default value is `MUTED`. Setting this to
`UNDEFINED` will clear the mute state on all matching findings.
Values:
MUTE_STATE_UNSPECIFIED: Unused.
MUTED: Matching findings will be muted (default).
UNDEFINED: Matching findings will have their mute state cleared.
r r r r N) r r r r r! MUTE_STATE_UNSPECIFIEDMUTED UNDEFINEDr0 r r1 r2 MuteStateValueValuesEnumr% s
EIr1 r) r r r N)
r r r r r! r" ra r) r# filterrb muteStater0 r r1 r2 r# r# s< 8 #&!!" instance.status == 'RUNNING' &&
'public' in instance.tags.items - name: firewall resource_type:
compute.googleapis.com/Firewall filter: > firewall.direction == 'INGRESS' &&
!firewall.disabled && firewall.allowed.exists(rule,
rule.IPProtocol.upperAscii() in ['TCP', 'ALL'] && rule.ports.exists(port,
network.portsInRange(port, '11-256'))) rule: match: - predicate: >
instance.networkInterfaces.exists(net, firewall.network == net.network)
output: > {'message': 'Compute instance with publicly accessible ports',
'instance': instance.name} Users are able to join resource types together
using the exact format as Kubernetes Validating Admission policies.
Fields:
spec: The CEL policy to evaluate to produce findings. A finding is
generated when the policy validation evaluates to false.
r r N) r r r r r! r" r# specr0 r r1 r2 r- r- . s ,
q !$r1 r- c : \ rS rSrSr\R " SSS9rSrg)
ChokepointiH Contains details about a chokepoint, which is a resource or resource
group where high-risk attack paths converge, based on [attack path
simulations] (https://cloud.google.com/security-command-center/docs/attack-
exposure-learn#attack_path_simulations).
Fields:
relatedFindings: List of resource names of findings associated with this
chokepoint. For example, organizations/123/sources/456/findings/789.
This list will have at most 100 findings.
r Tr r N r r r r r! r" r# relatedFindingsr0 r r1 r2 r0 r0 H ))!d;/r1 r0 c \ rS rSrSr\R " SS5 r\R " SS5 r\R " S5 r
\R " SS 5 r \R " S
S 5 r \R " S 5 r
S
rg)
CloudArmoriW Fields related to Google Cloud Armor findings.
Fields:
adaptiveProtection: Information about potential Layer 7 DDoS attacks
identified by [Google Cloud Armor Adaptive
Protection](https://cloud.google.com/armor/docs/adaptive-protection-
overview).
attack: Information about DDoS attack volume and classification.
duration: Duration of attack from the start until the current moment
(updated every 5 minutes).
requests: Information about incoming requests evaluated by [Google Cloud
Armor security policies](https://cloud.google.com/armor/docs/security-
policy-overview).
securityPolicy: Information about the [Google Cloud Armor security
policy](https://cloud.google.com/armor/docs/security-policy-overview)
relevant to the finding.
threatVector: Distinguish between volumetric & protocol DDoS attack and
application layer attacks. For example, "L3_4" for Layer 3 and Layer 4
DDoS attacks, or "L_7" for Layer 7 DDoS attacks.
rA r rz r r Requestsr SecurityPolicyr r r Nr r r r r! r" r% adaptiveProtectionattackr# durationr securityPolicy threatVectorr0 r r1 r2 r6 r6 W st * !--.BAF ! !(A .&
"
"1
%(
#
#J
2( ))*:A>.&&q),r1 r6 c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r \R " S\R R S 9rS
rg ) CloudControliu ( CloudControl associated with the finding.
Enums:
TypeValueValuesEnum: Type of cloud control.
Fields:
cloudControlName: Name of the CloudControl associated with the finding.
policyType: Policy type of the CloudControl
type: Type of cloud control.
version: Version of the Cloud Control
c $ \ rS rSrSrSrSrSrSrg) CloudControl.TypeValueValuesEnumi Type of cloud control.
Values:
CLOUD_CONTROL_TYPE_UNSPECIFIED: Unspecified.
BUILT_IN: Built in Cloud Control.
CUSTOM: Custom Cloud Control.
r r r r N r r r r r! CLOUD_CONTROL_TYPE_UNSPECIFIEDBUILT_INCUSTOMr0 r r1 r2 r rD &'"H
Fr1 r r r r r r} r Nr r r r r! r" ra r r# cloudControlName
policyTyperb r rM r r r> r0 r r1 r2 rA rA u k
INN
**1-$$Q'* 2A 6$ " "1i.?.?.E.E F'r1 rA c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SSSS 9r \R " SS
5 r
S rg )
CloudDlpDataProfilei + The [data profile](https://cloud.google.com/dlp/docs/data-profiles)
associated with the finding.
Enums:
ParentTypeValueValuesEnum: The resource hierarchy level at which the data
profile was generated.
Fields:
dataProfile: Name of the data profile, for example,
`projects/123/locations/europe/tableProfiles/8383929`.
infoTypes: Type of information detected by SDP. Info type includes name,
version and sensitivity of the detected information type.
parentType: The resource hierarchy level at which the data profile was
generated.
c $ \ rS rSrSrSrSrSrSrg)-CloudDlpDataProfile.ParentTypeValueValuesEnumi The resource hierarchy level at which the data profile was generated.
Values:
PARENT_TYPE_UNSPECIFIED: Unspecified parent type.
ORGANIZATION: Organization-level configurations.
PROJECT: Project-level configurations.
r r r r N r r r r r! PARENT_TYPE_UNSPECIFIED ORGANIZATIONPROJECTr0 r r1 r2 ParentTypeValueValuesEnumrS LGr1 rY r InfoTyper Tr r r Nr r r r r! r" ra rY r# dataProfiler% infoTypesrb
parentTyper0 r r1 r2 rP rP sP
)..
%%a(+$$ZTB)""#>B*r1 rP c \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r \R " S5 r Sr
g) CloudDlpInspectioni } Details about the Cloud Data Loss Prevention (Cloud DLP) [inspection
job](https://cloud.google.com/dlp/docs/concepts-job-triggers) that produced
the finding.
Fields:
fullScan: Whether Cloud DLP scanned the complete resource or a sampled
subset.
infoType: The type of information (or
*[infoType](https://cloud.google.com/dlp/docs/infotypes-reference)*)
found, for example, `EMAIL_ADDRESS` or `STREET_ADDRESS`.
infoTypeCount: The number of times Cloud DLP found this infoType within
this job and resource.
inspectJob: Name of the inspection job, for example,
`projects/123/locations/europe/dlpJobs/i-8383929`.
r r r r r Nr r r r r! r" BooleanFieldfullScanr# infoTyperM
infoTypeCount
inspectJobr0 r r1 r2 ra ra I
#
#A
&(
"
"1
%(((+-$$Q'*r1 ra c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) CloudLoggingEntryi a Metadata taken from a [Cloud Logging LogEntry](https://cloud.google.com/
logging/docs/reference/v2/rest/v2/LogEntry)
Fields:
insertId: A unique identifier for the log entry.
logId: The type of the log (part of `log_name`. `log_name` is the resource
name of the log to which this log entry belongs). For example:
`cloudresourcemanager.googleapis.com/activity`. Note that this field is
not URL-encoded, unlike the `LOG_ID` field in `LogEntry`.
resourceContainer: The organization, folder, or project of the monitored
resource that produced this log entry.
timestamp: The time the event described by the log entry occurred.
r r r r r N r r r r r! r" r# insertIdlogIdresourceContainer timestampr0 r r1 r2 rk rk J
"
"1
%(
"% ++A.##A&)r1 rk c \ rS rSrSr\R " SSS9r\R " S5 r\R " S5 r Sr
g )
Compliancei N Contains compliance information about a security standard indicating
unmet recommendations.
Fields:
ids: Policies within the standard or benchmark, for example, A.12.4.1
standard: Industry-wide compliance standards or benchmarks, such as CIS,
PCI, and OWASP.
version: Version of the standard or benchmark, for example, 1.1
r Tr r r r N r r r r r! r" r# idsstandardr> r0 r r1 r2 rs rs ; a$/#
"
"1
%( ! !! $'r1 rs c \ rS rSrSr\R " SS5 r\R " SSS9r \R " SS SS9r
S
r g ) ComplianceDetailsi n Compliance Details associated with the finding.
Fields:
cloudControl: CloudControl associated with the finding
cloudControlDeploymentNames: Cloud Control Deployments associated with the
finding. For example, organizations/123/locations/global/cloudControlDep
loyments/deploymentIdentifier
frameworks: Details of Frameworks associated with the finding
rA r r Tr Frameworkr r N r r r r r! r" r% cloudControlr# cloudControlDeploymentNames
frameworksr0 r r1 r2 rz rz sB '':, ) 5 5a$ G %%k1tD*r1 rz c D \ rS rSrSr " S S\R 5 r\R " S5 r \R " S\R R S9r
\R " SS5 r\R " S 5 r\R " S
\R R S9rS rg )
Connectioni Contains information about the IP connection associated with the
finding.
Enums:
ProtocolValueValuesEnum: IANA Internet Protocol Number such as TCP(6) and
UDP(17).
Fields:
destinationIp: Destination IP address. Not present for sockets that are
listening and not connected.
destinationPort: Destination port. Not present for sockets that are
listening and not connected.
protocol: IANA Internet Protocol Number such as TCP(6) and UDP(17).
sourceIp: Source IP address.
sourcePort: Source port.
c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) "Connection.ProtocolValueValuesEnumi 3 IANA Internet Protocol Number such as TCP(6) and UDP(17).
Values:
PROTOCOL_UNSPECIFIED: Unspecified protocol (not HOPOPT).
ICMP: Internet Control Message Protocol.
TCP: Transmission Control Protocol.
UDP: User Datagram Protocol.
GRE: Generic Routing Encapsulation.
ESP: Encap Security Payload.
r r r r r r r N r r r r r! PROTOCOL_UNSPECIFIEDICMPTCPUDPGREESPr0 r r1 r2 ProtocolValueValuesEnumr ( D
C
C
C
Cr1 r r r r} r r r r Nr r r r r! r" ra r r#
destinationIprM r r destinationPortrb protocolsourceIp
sourcePortr0 r r1 r2 r r " $ ''*- **1i6G6G6M6MN/
!:A
>(
"
"1
%(%%a1B1B1H1HI*r1 r c < \ rS rSrSr\R " S5 rSrg)Contacti- lThe email address of a contact.
Fields:
email: An email address. For example, "`person123@company.com`".
r r N r r r r r! r" r# emailr0 r r1 r2 r r -
"%r1 r c < \ rS rSrSr\R " SSSS9rSrg) ContactDetailsi7 HDetails about specific contacts
Fields:
contacts: A list of contacts
r r Tr r N r r r r r! r" r% contactsr0 r r1 r2 r r 7 s
#
#Iq4
@(r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " SSSS9r
\R " S 5 r \R " S
5 r S r
g )
ContaineriA Container associated with the finding.
Fields:
createTime: The time that the container was created.
imageId: Optional container image ID, if provided by the container
runtime. Uniquely identifies the container image launched using a
container image digest.
labels: Container labels, as provided by the container runtime.
name: Name of the container.
uri: Container image URI provided when configuring a pod or container.
This string can identify a container image version using mutable tags.
r r Labelr Tr r r r Nr r r r r! r" r#
createTimeimageIdr% r r9 urir0 r r1 r2 r r A s] $$Q'* ! !! $' ! !'1t <& q !$ a #r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)ControliV Compliance control associated with the finding.
Fields:
controlName: Name of the Control
displayName: Display name of the control. For example, AU-02.
r r r N
r r r r r! r" r# controlNamerd r0 r r1 r2 r r V ) %%a(+%%a(+r1 r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)r ib zRequest message to create single resource value config
Fields:
parent: Required. Resource name of the new ResourceValueConfig's parent.
resourceValueConfig: Required. The resource value config being created.
r r r r N) r r r r r! r" r# parentr% resourceValueConfigr0 r r1 r2 r r b s. #&!../_abcr1 r c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " S 5 r \R " SS
5 r\R " S 5 r\R " S 5 r\R " SS
5 r\R$ " S5 r\R " SSSS9r\R$ " S5 r\R$ " S5 rSrg)Cvein CVE stands for Common Vulnerabilities and Exposures. Information from
the [CVE record](https://www.cve.org/ResourcesSupport/Glossary) that
describes this vulnerability.
Enums:
ExploitationActivityValueValuesEnum: The exploitation activity of the
vulnerability in the wild.
ImpactValueValuesEnum: The potential impact of the vulnerability if it was
to be exploited.
Fields:
cvssv3: Describe Common Vulnerability Scoring System specified at
https://www.first.org/cvss/v3.1/specification-document
exploitReleaseDate: Date the first publicly available exploit or PoC was
released.
exploitationActivity: The exploitation activity of the vulnerability in
the wild.
firstExploitationDate: Date of the earliest known exploitation.
id: The unique identifier for the vulnerability. e.g. CVE-2021-34527
impact: The potential impact of the vulnerability if it was to be
exploited.
observedInTheWild: Whether or not the vulnerability has been observed in
the wild.
references: Additional information about the CVE. e.g.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527
upstreamFixAvailable: Whether upstream fix is available for the CVE.
zeroDay: Whether or not the vulnerability was zero day when the finding
was published.
c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) 'Cve.ExploitationActivityValueValuesEnumi The exploitation activity of the vulnerability in the wild.
Values:
EXPLOITATION_ACTIVITY_UNSPECIFIED: Invalid or empty value.
WIDE: Exploitation has been reported or confirmed to widely occur.
CONFIRMED: Limited reported or confirmed exploitation activities.
AVAILABLE: Exploit is publicly available.
ANTICIPATED: No known exploitation activity, but has a high potential
for exploitation.
NO_KNOWN: No known exploitation activity.
r r r r r r r N r r r r r! !EXPLOITATION_ACTIVITY_UNSPECIFIEDWIDE CONFIRMED AVAILABLE ANTICIPATEDNO_KNOWNr0 r r1 r2 #ExploitationActivityValueValuesEnumr (
)*% DIIKHr1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
Cve.ImpactValueValuesEnumi The potential impact of the vulnerability if it was to be exploited.
Values:
RISK_RATING_UNSPECIFIED: Invalid or empty value.
LOW: Exploitation would have little to no security impact.
MEDIUM: Exploitation would enable attackers to perform activities, or
could allow attackers to have a direct impact, but would require
additional steps.
HIGH: Exploitation would enable attackers to have a notable direct
impact without needing to overcome any major mitigating factors.
CRITICAL: Exploitation would fundamentally undermine the security of
affected systems, enable actors to perform significant attacks with
minimal effort, with little to no mitigating factors to overcome.
r r r r r r N r r r r r! RISK_RATING_UNSPECIFIEDLOWMEDIUMHIGHCRITICALr0 r r1 r2 ImpactValueValuesEnumr #
C
F DHr1 r Cvssv3r r r r r r r Referencer Tr r r r Nr r r r r! r" ra r r r% cvssv3r# exploitReleaseDaterb exploitationActivityfirstExploitationDater impactrd observedInTheWild
referencesupstreamFixAvailablezeroDayr0 r r1 r2 r r n s <INN &inn * ! !(A .& ,,Q/",,-RTUV#//2 Q " 6 :& ,,Q/%%k1tD*"//2 " "2 &'r1 r c \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S
\R 5 r
" S S \R 5 r " S
S\R 5 r " S S\R 5 r
" S S\R 5 r\R " SS5 r\R " SS5 r\R " SS5 r\R& " S5 r\R " S
S5 r\R " S S5 r\R " SS5 r\R " SS5 r\R " SS5 rS rg ) r i y Common Vulnerability Scoring System version 3.
Enums:
AttackComplexityValueValuesEnum: This metric describes the conditions
beyond the attacker's control that must exist in order to exploit the
vulnerability.
AttackVectorValueValuesEnum: Base Metrics Represents the intrinsic
characteristics of a vulnerability that are constant over time and
across user environments. This metric reflects the context by which
vulnerability exploitation is possible.
AvailabilityImpactValueValuesEnum: This metric measures the impact to the
availability of the impacted component resulting from a successfully
exploited vulnerability.
ConfidentialityImpactValueValuesEnum: This metric measures the impact to
the confidentiality of the information resources managed by a software
component due to a successfully exploited vulnerability.
IntegrityImpactValueValuesEnum: This metric measures the impact to
integrity of a successfully exploited vulnerability.
PrivilegesRequiredValueValuesEnum: This metric describes the level of
privileges an attacker must possess before successfully exploiting the
vulnerability.
ScopeValueValuesEnum: The Scope metric captures whether a vulnerability in
one vulnerable component impacts resources in components beyond its
security scope.
UserInteractionValueValuesEnum: This metric captures the requirement for a
human user, other than the attacker, to participate in the successful
compromise of the vulnerable component.
Fields:
attackComplexity: This metric describes the conditions beyond the
attacker's control that must exist in order to exploit the
vulnerability.
attackVector: Base Metrics Represents the intrinsic characteristics of a
vulnerability that are constant over time and across user environments.
This metric reflects the context by which vulnerability exploitation is
possible.
availabilityImpact: This metric measures the impact to the availability of
the impacted component resulting from a successfully exploited
vulnerability.
baseScore: The base score is a function of the base metric scores.
confidentialityImpact: This metric measures the impact to the
confidentiality of the information resources managed by a software
component due to a successfully exploited vulnerability.
integrityImpact: This metric measures the impact to integrity of a
successfully exploited vulnerability.
privilegesRequired: This metric describes the level of privileges an
attacker must possess before successfully exploiting the vulnerability.
scope: The Scope metric captures whether a vulnerability in one vulnerable
component impacts resources in components beyond its security scope.
userInteraction: This metric captures the requirement for a human user,
other than the attacker, to participate in the successful compromise of
the vulnerable component.
c $ \ rS rSrSrSrSrSrSrg)&Cvssv3.AttackComplexityValueValuesEnumi This metric describes the conditions beyond the attacker's control
that must exist in order to exploit the vulnerability.
Values:
ATTACK_COMPLEXITY_UNSPECIFIED: Invalid value.
ATTACK_COMPLEXITY_LOW: Specialized access conditions or extenuating
circumstances do not exist. An attacker can expect repeatable success
when attacking the vulnerable component.
ATTACK_COMPLEXITY_HIGH: A successful attack depends on conditions beyond
the attacker's control. That is, a successful attack cannot be
accomplished at will, but requires the attacker to invest in some
measurable amount of effort in preparation or execution against the
vulnerable component before a successful attack can be expected.
r r r r N r r r r r! ATTACK_COMPLEXITY_UNSPECIFIEDATTACK_COMPLEXITY_LOWATTACK_COMPLEXITY_HIGHr0 r r1 r2 AttackComplexityValueValuesEnumr
%&! r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
"Cvssv3.AttackVectorValueValuesEnumi Base Metrics Represents the intrinsic characteristics of a
vulnerability that are constant over time and across user environments.
This metric reflects the context by which vulnerability exploitation is
possible.
Values:
ATTACK_VECTOR_UNSPECIFIED: Invalid value.
ATTACK_VECTOR_NETWORK: The vulnerable component is bound to the network
stack and the set of possible attackers extends beyond the other
options listed below, up to and including the entire Internet.
ATTACK_VECTOR_ADJACENT: The vulnerable component is bound to the network
stack, but the attack is limited at the protocol level to a logically
adjacent topology.
ATTACK_VECTOR_LOCAL: The vulnerable component is not bound to the
network stack and the attacker's path is via read/write/execute
capabilities.
ATTACK_VECTOR_PHYSICAL: The attack requires the attacker to physically
touch or manipulate the vulnerable component.
r r r r r r N r r r r r! ATTACK_VECTOR_UNSPECIFIEDATTACK_VECTOR_NETWORKATTACK_VECTOR_ADJACENTATTACK_VECTOR_LOCALATTACK_VECTOR_PHYSICALr0 r r1 r2 AttackVectorValueValuesEnumr ' & !" r1 r c ( \ rS rSrSrSrSrSrSrSr g) (Cvssv3.AvailabilityImpactValueValuesEnumi% This metric measures the impact to the availability of the impacted
component resulting from a successfully exploited vulnerability.
Values:
IMPACT_UNSPECIFIED: Invalid value.
IMPACT_HIGH: High impact.
IMPACT_LOW: Low impact.
IMPACT_NONE: No impact.
r r r r r N
r r r r r! IMPACT_UNSPECIFIED IMPACT_HIGH
IMPACT_LOW IMPACT_NONEr0 r r1 r2 !AvailabilityImpactValueValuesEnumr % KJKr1 r c ( \ rS rSrSrSrSrSrSrSr g) +Cvssv3.ConfidentialityImpactValueValuesEnumi4 ! This metric measures the impact to the confidentiality of the
information resources managed by a software component due to a
successfully exploited vulnerability.
Values:
IMPACT_UNSPECIFIED: Invalid value.
IMPACT_HIGH: High impact.
IMPACT_LOW: Low impact.
IMPACT_NONE: No impact.
r r r r r Nr r r1 r2 $ConfidentialityImpactValueValuesEnumr 4 KJKr1 r c ( \ rS rSrSrSrSrSrSrSr g) %Cvssv3.IntegrityImpactValueValuesEnumiD This metric measures the impact to integrity of a successfully
exploited vulnerability.
Values:
IMPACT_UNSPECIFIED: Invalid value.
IMPACT_HIGH: High impact.
IMPACT_LOW: Low impact.
IMPACT_NONE: No impact.
r r r r r Nr r r1 r2 IntegrityImpactValueValuesEnumr D r r1 r c ( \ rS rSrSrSrSrSrSrSr g) (Cvssv3.PrivilegesRequiredValueValuesEnumiS _ This metric describes the level of privileges an attacker must possess
before successfully exploiting the vulnerability.
Values:
PRIVILEGES_REQUIRED_UNSPECIFIED: Invalid value.
PRIVILEGES_REQUIRED_NONE: The attacker is unauthorized prior to attack,
and therefore does not require any access to settings or files of the
vulnerable system to carry out an attack.
PRIVILEGES_REQUIRED_LOW: The attacker requires privileges that provide
basic user capabilities that could normally affect only settings and
files owned by a user. Alternatively, an attacker with Low privileges
has the ability to access only non-sensitive resources.
PRIVILEGES_REQUIRED_HIGH: The attacker requires privileges that provide
significant (e.g., administrative) control over the vulnerable
component allowing access to component-wide settings and files.
r r r r r N
r r r r r! PRIVILEGES_REQUIRED_UNSPECIFIEDPRIVILEGES_REQUIRED_NONEPRIVILEGES_REQUIRED_LOWPRIVILEGES_REQUIRED_HIGHr0 r r1 r2 !PrivilegesRequiredValueValuesEnumr S ! '(# r1 r
c $ \ rS rSrSrSrSrSrSrg)Cvssv3.ScopeValueValuesEnumii The Scope metric captures whether a vulnerability in one vulnerable
component impacts resources in components beyond its security scope.
Values:
SCOPE_UNSPECIFIED: Invalid value.
SCOPE_UNCHANGED: An exploited vulnerability can only affect resources
managed by the same security authority.
SCOPE_CHANGED: An exploited vulnerability can affect resources beyond
the security scope managed by the security authority of the vulnerable
component.
r r r r N r r r r r! SCOPE_UNSPECIFIEDSCOPE_UNCHANGED
SCOPE_CHANGEDr0 r r1 r2 ScopeValueValuesEnumr
i
OMr1 r c $ \ rS rSrSrSrSrSrSrg)%Cvssv3.UserInteractionValueValuesEnumiy This metric captures the requirement for a human user, other than the
attacker, to participate in the successful compromise of the vulnerable
component.
Values:
USER_INTERACTION_UNSPECIFIED: Invalid value.
USER_INTERACTION_NONE: The vulnerable system can be exploited without
interaction from any user.
USER_INTERACTION_REQUIRED: Successful exploitation of this vulnerability
requires a user to take some action before the vulnerability can be
exploited.
r r r r N r r r r r! USER_INTERACTION_UNSPECIFIEDUSER_INTERACTION_NONEUSER_INTERACTION_REQUIREDr0 r r1 r2 UserInteractionValueValuesEnumr y $% ! r1 r r r r r r r r r r r Nr r r r r! r" ra r r r r r r
r r rb attackComplexity attackVectoravailabilityImpactrE baseScoreconfidentialityImpactintegrityImpactprivilegesRequiredscopeuserInteractionr0 r r1 r2 r r 9 4l & INN 4
)..
Y^^
y~~
!).. !,Y^^ "y~~ "" (()JAN$$%BAF, **+NPQR""1%)#--.TVWX ''(H!L/ **+NPQR
4a
8% ''(H!L/r1 r c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
Cwei " CWE stands for Common Weakness Enumeration. Information about this
weakness, as described by [CWE](https://cwe.mitre.org/).
Fields:
id: The CWE identifier, e.g. CWE-94
references: Any reference to the details on the CWE, for example,
https://cwe.mitre.org/data/definitions/94.html
r r r Tr r N r r r r r! r" r# r r% r r0 r r1 r2 r* r* s- Q "%%k1tD*r1 r* c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r \R " S5 r
S rg
) DataAccessEventi , Details about a data access attempt made by a principal not authorized
under applicable data security policy.
Enums:
OperationValueValuesEnum: The operation performed by the principal to
access the data.
Fields:
eventId: Unique identifier for data access event.
eventTime: Timestamp of data access event.
operation: The operation performed by the principal to access the data.
principalEmail: The email address of the principal that accessed the data.
The principal could be a user account, service account, Google group, or
other.
c ( \ rS rSrSrSrSrSrSrSr g) (DataAccessEvent.OperationValueValuesEnumi The operation performed by the principal to access the data.
Values:
OPERATION_UNSPECIFIED: The operation is unspecified.
READ: Represents a read operation.
MOVE: Represents a move operation.
COPY: Represents a copy operation.
r r r r r N
r r r r r! OPERATION_UNSPECIFIEDREADMOVECOPYr0 r r1 r2 OperationValueValuesEnumr1 D D Dr1 r8 r r r r r Nr r r r r! r" ra r8 r# eventId eventTimerb operationr( r0 r r1 r2 r. r. \
! !! $'##A&)!!" r0 r r1 r2 r\ r\ ' k 8 %%a(+
"
"1t
4( q !$
"%
"
"1
%( ! !! $'r1 r\ c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)DatasetiL aY Vertex AI dataset associated with the finding.
Fields:
displayName: The user defined display name of dataset, e.g. plants-dataset
name: Resource name of the dataset, e.g.
projects/{project}/locations/{location}/datasets/2094040236064505856
source: Data source, such as BigQuery source URI, e.g. bq://scc-nexus-
test.AIPPtest.gsod
r r r r N r r r r r! r" r# rd r9 r r0 r r1 r2 rc rc L 9 %%a(+ q !$ #&r1 rc c < \ rS rSrSr\R " SSSS9rSrg) Deniedi\ PDenied IP rule.
Fields:
ipRules: Optional. Optional list of denied IP rules.
rn r Tr r Nro r r1 r2 rg rg \ rq r1 rg c ` \ rS rSrSr\R " S5 r\R " S5 r Sr
g) Detectionif Memory hash detection contributing to the binary family match.
Fields:
binary: The name of the binary associated with the memory hash signature
detection.
percentPagesMatched: The percentage of memory page hashes in the signature
that were matched.
r r r N r r r r r! r" r# binaryrE percentPagesMatchedr0 r r1 r2 rj rj f * #&!,,Q/r1 rj c < \ rS rSrSr\R " S5 rSrg)Diskit Contains information about the disk associated with the finding.
Fields:
name: The name of the disk, for example,
"https://www.googleapis.com/compute/v1/projects/{project-
id}/zones/{zone-id}/disks/{disk-id}".
r r N r r r r r! r" r# r9 r0 r r1 r2 rq rq t
q !$r1 rq c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)DiskPathi J Path of the file in terms of underlying disk/partition identifiers.
Fields:
partitionUuid: UUID of the partition (format
https://wiki.archlinux.org/title/persistent_block_device_naming#by-uuid)
relativePath: Relative path of the file in the partition as a JSON encoded
string. Example: /home/user1/executable_file.sh
r r r N
r r r r r! r" r#
partitionUuid relativePathr0 r r1 r2 rv rv ) ''*-&&q),r1 rv c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)DynamicMuteRecordi The record of a dynamic mute rule that matches the finding.
Fields:
matchTime: When the dynamic mute rule first matched the finding.
muteConfig: The relative resource name of the mute rule, represented by a
mute config, that created this record, for example
`organizations/123/muteConfigs/mymuteconfig` or
`organizations/123/locations/global/muteConfigs/mymuteconfig`.
r r r N
r r r r r! r" r# matchTime
muteConfigr0 r r1 r2 r} r} ) ##A&)$$Q'*r1 r} c \ rS rSrSrSrg)Emptyi a A generic empty message that you can re-use to avoid defining duplicated
empty messages in your APIs. A typical example is to use it as the request
or the response type of an API method. For instance: service Foo { rpc
Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
r Nr r r r r! r0 r r1 r2 r r s r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)EnvironmentVariablei A name-value pair representing an environment variable used in an
operating system process.
Fields:
name: Environment variable name as a JSON encoded string.
val: Environment variable value as a JSON encoded string.
r r r N
r r r r r! r" r# r9 valr0 r r1 r2 r r )
q !$ a #r1 r c ^ \ rS rSrSr\R " SSS9r\R " S5 rSr g)
ExfilResourcei Resource where data was exfiltrated from or exfiltrated to.
Fields:
components: Subcomponents of the asset that was exfiltrated, like URIs
used during exfiltration, table names, databases, and filenames. For
example, multiple tables might have been exfiltrated from the same Cloud
SQL instance, or multiple files might have been exfiltrated from the
same Cloud Storage bucket.
name: The resource's [full resource name](https://cloud.google.com/apis/de
sign/resource_names#full_resource_name).
r Tr r r N
r r r r r! r" r#
componentsr9 r0 r r1 r2 r r +
$$Q6* q !$r1 r c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S5 r
S r g
) Exfiltrationi Exfiltration represents a data exfiltration attempt from one or more
sources to one or more targets. The `sources` attribute lists the sources of
the exfiltrated data. The `targets` attribute lists the destinations the
data was copied to.
Fields:
sources: If there are multiple sources, then the data is considered
"joined" between them. For instance, BigQuery can join multiple tables,
and each table would be considered a source.
targets: If there are multiple targets, each target would get a complete
copy of the "joined" source data.
totalExfiltratedBytes: Total exfiltrated bytes processed for the entire
job.
r r Tr r r r N r r r r r! r" r% sourcestargetsrM totalExfiltratedBytesr0 r r1 r2 r r sB
" "?A E' " "?A E'#003r1 r c b \ rS rSrSr\R " SS5 r\R " S5 r Sr
g)ExportFindingsMetadatai zThe LRO metadata for a ExportFindings request.
Fields:
bigQueryDestination: Required. The destination BigQuery dataset to export
findings to.
exportStartTime: Optional. Timestamp at which export was started
r r r r N) r r r r r! r" r% bigQueryDestinationr# exportStartTimer0 r r1 r2 r r s- "../DaH ))!,/r1 r c > \ rS rSrSr\R " SS5 rSrg)ExportFindingsRequesti zRequest message for exporting findings to external BigQuery.
Fields:
bigQueryDestination: Required. The destination BigQuery dataset to export
findings to.
r r r N) r r r r r! r" r% r r0 r r1 r2 r r s "../DaHr1 r c \ rS rSrSrSrg)ExportFindingsResponsei zJThe response to a ExportFindings request. Contains the LRO information.
r Nr r r1 r2 r r s r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) r i aq Represents a textual expression in the Common Expression Language (CEL)
syntax. CEL is a C-like expression language. The syntax and semantics of CEL
are documented at https://github.com/google/cel-spec. Example (Comparison):
title: "Summary size limit" description: "Determines if a summary is less
than 100 chars" expression: "document.summary.size() < 100" Example
(Equality): title: "Requestor is owner" description: "Determines if
requestor is the document owner" expression: "document.owner ==
request.auth.claims.email" Example (Logic): title: "Public documents"
description: "Determine whether the document should be publicly visible"
expression: "document.type != 'private' && document.type != 'internal'"
Example (Data Manipulation): title: "Notification string" description:
"Create a notification string with a timestamp." expression: "'New message
received at ' + string(document.create_time)" The exact variables and
functions that may be referenced within an expression are determined by the
service that evaluates it. See the service documentation for additional
information.
Fields:
description: Optional. Description of the expression. This is a longer
text which describes the expression, e.g. when hovered over it in a UI.
expression: Textual representation of an expression in Common Expression
Language syntax.
location: Optional. String indicating the location of the expression for
error reporting, e.g. a file name and a position in the file.
title: Optional. Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
r r r r r N) r r r r r! r" r# r
expressionrg titler0 r r1 r2 r r sI : %%a(+$$Q'*
"
"1
%(
"%r1 r c : \ rS rSrSr\R " S5 r\R " SS5 r \R " S5 r \R " SSS S
9r \R " S 5 r\R " S 5 r\R " S
5 r\R " S5 rSrg)Filei + File information about the related binary/library used by an executable,
or the script used by a script interpreter
Fields:
contents: Prefix of the file contents as a JSON-encoded string.
diskPath: Path of the file in terms of underlying disk/partition
identifiers.
hashedSize: The length in bytes of the file prefix that was hashed. If
hashed_size == size, any hashes reported represent the entire file.
operations: Operation(s) performed on a file.
partiallyHashed: True when the hash covers only a prefix of the file.
path: Absolute path of the file as a JSON encoded string.
sha256: SHA256 hash of the first hashed_size bytes of the file encoded as
a hex string. If hashed_size == size, sha256 represents the SHA256 hash
of the entire file.
size: Size of the file in bytes.
r rv r r
FileOperationr Tr r r r r r Nr r r r r! r" r# contentsr% diskPathrM
hashedSize
operationsrd partiallyHashedpathsha256sizer0 r r1 r2 r r s $
"
"1
%(
#
#J
2(%%a(*%%oq4H* **1-/ q !$ #& "$r1 r c h \ rS rSrSr " S S\R 5 r\R " SS5 r Sr
g)r i8 Operation(s) performed on a file.
Enums:
TypeValueValuesEnum: The type of the operation
Fields:
type: The type of the operation
c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) !FileOperation.TypeValueValuesEnumiB & The type of the operation
Values:
OPERATION_TYPE_UNSPECIFIED: The operation is unspecified.
OPEN: Represents an open operation.
READ: Represents a read operation.
RENAME: Represents a rename operation.
WRITE: Represents a write operation.
EXECUTE: Represents an execute operation.
r r r r r r r N r r r r r! OPERATION_TYPE_UNSPECIFIEDOPENr5 RENAMEWRITEEXECUTEr0 r r1 r2 r r B ( "# D D
F
EGr1 r r r N r r r r r! r" ra r rb r r0 r r1 r2 r r 8 , INN $
2A 6$r1 r c
\ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S
\R 5 r
\ R " S 5 " S S
\R 5 5 r\ R " S 5 " S S\R 5 5 r\ R " S 5 " S S\R 5 5 r\R" " SS5 r\R" " SS5 r\R" " SS5 r\R" " SS5 r\R" " SS5 r\R" " S S 5 r\R0 " S 5 r\R0 " S 5 r\R" " S S!5 r\R" " S"S#5 r \R" " S$S%5 r \R" " S&S'5 r \R" " S(S)5 r \R" " S*S+S,S-9r \R" " S.S/S,S-9r!\R" " S
S05 r"\R" " S1S2S,S-9r#\R0 " S35 r$\R" " S4S5S,S-9r%\R" " S6S7S,S-9r&\R" " S8S9S,S-9r'\R" " S:S;5 r(\R0 " S<5 r)\R" " S=S>5 r*\R0 " S?5 r+\R" " S@SA5 r,\R" " SSB5 r-\R0 " SC5 r.\R" " SDSES,S-9r/\R` " SSF5 r1\R" " SGSHS,S-9r2\R" " SISJS,S-9r3\R" " SKSL5 r4\R" " SMSN5 r5\R" " SOSP5 r6\R" " SQSR5 r7\R" " SSST5 r8\R" " SUSVS,S-9r9\R" " SWSXS,S-9r:\R" " SYSZ5 r;\R0 " S[5 r<\R` " SS\5 r=\R0 " S]5 r>\R" " S^S_5 r?\R0 " S`5 r@\R0 " Sa5 rA\R0 " Sb5 rB\R" " ScSdS,S-9rC\R0 " Se5 rD\R" " SfSg5 rE\R" " ShSiS,S-9rF\R0 " Sj5 rG\R0 " Sk5 rH\R" " SlSmS,S-9rI\R0 " Sn5 rJ\R" " SoSp5 rK\R" " SqSr5 rL\R` " SSs5 rM\R" " SSt5 rN\R` " S
Su5 rO\R" " SvSw5 rP\R" " SxSy5 rQ\R" " SzS{5 rRS|rSg})~FindingiW aW) Security Command Center finding. A finding is a record of assessment
data like security, risk, health, or privacy, that is ingested into Security
Command Center for presentation, notification, analysis, policy testing, and
enforcement. For example, a cross-site scripting (XSS) vulnerability in an
App Engine application is a finding.
Enums:
FindingClassValueValuesEnum: The class of the finding.
MuteValueValuesEnum: Indicates the mute state of a finding (either muted,
unmuted or undefined). Unlike other attributes of a finding, a finding
provider shouldn't set the value of mute.
SeverityValueValuesEnum: The severity of the finding. This field is
managed by the source that writes the finding.
StateValueValuesEnum: The state of the finding.
Messages:
ContactsValue: Output only. Map containing the points of contact for the
given finding. The key represents the type of contact, while the value
contains a list of all the contacts that pertain. Please refer to:
https://cloud.google.com/resource-manager/docs/managing-notification-
contacts#notification-categories { "security": { "contacts": [ {
"email": "person1@company.com" }, { "email": "person2@company.com" } ] }
}
ExternalSystemsValue: Output only. Third party SIEM/SOAR fields within
SCC, contains external system information and external system finding
fields.
SourcePropertiesValue: Source specific properties. These properties are
managed by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
Fields:
access: Access details associated with the finding, such as more
information on the caller, which method was accessed, and from where.
affectedResources: AffectedResources associated with the finding.
aiModel: The AI model associated with the finding.
application: Represents an application associated with the finding.
attackExposure: The results of an attack path simulation relevant to this
finding.
backupDisasterRecovery: Fields related to Backup and DR findings.
canonicalName: The canonical name of the finding. It's either "organizatio
ns/{organization_id}/sources/{source_id}/findings/{finding_id}",
"folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or
"projects/{project_number}/sources/{source_id}/findings/{finding_id}",
depending on the closest CRM ancestor of the resource associated with
the finding.
category: The additional taxonomy group within findings from a given
source. This field is immutable after creation time. Example:
"XSS_FLASH_INJECTION"
chokepoint: Contains details about a chokepoint, which is a resource or
resource group where high-risk attack paths converge, based on [attack
path simulations] (https://cloud.google.com/security-command-
center/docs/attack-exposure-learn#attack_path_simulations). This field
cannot be updated. Its value is ignored in all update requests.
cloudArmor: Fields related to Cloud Armor findings.
cloudDlpDataProfile: Cloud DLP data profile that is associated with the
finding.
cloudDlpInspection: Cloud Data Loss Prevention (Cloud DLP) inspection
results that are associated with the finding.
complianceDetails: Details about the compliance implications of the
finding.
compliances: Contains compliance information for security standards
associated to the finding.
connections: Contains information about the IP connection associated with
the finding.
contacts: Output only. Map containing the points of contact for the given
finding. The key represents the type of contact, while the value
contains a list of all the contacts that pertain. Please refer to:
https://cloud.google.com/resource-manager/docs/managing-notification-
contacts#notification-categories { "security": { "contacts": [ {
"email": "person1@company.com" }, { "email": "person2@company.com" } ] }
}
containers: Containers associated with the finding. This field provides
information for both Kubernetes and non-Kubernetes containers.
createTime: The time at which the finding was created in Security Command
Center.
dataAccessEvents: Data access events associated with the finding.
dataFlowEvents: Data flow events associated with the finding.
dataRetentionDeletionEvents: Data retention deletion events associated
with the finding.
database: Database associated with the finding.
description: Contains more details about the finding.
disk: Disk associated with the finding.
eventTime: The time the finding was first detected. If an existing finding
is updated, then this is the time the update occurred. For example, if
the finding represents an open firewall, this property captures the time
the detector believes the firewall became open. The accuracy is
determined by the detector. If the finding is later resolved, then this
time reflects when the finding was resolved. This must not be set to a
value greater than the current timestamp.
exfiltration: Represents exfiltrations associated with the finding.
externalSystems: Output only. Third party SIEM/SOAR fields within SCC,
contains external system information and external system finding fields.
externalUri: The URI that, if available, points to a web page outside of
Security Command Center where additional information about the finding
can be found. This field is guaranteed to be either empty or a well
formed URL.
files: File associated with the finding.
findingClass: The class of the finding.
groupMemberships: Contains details about groups of which this finding is a
member. A group is a collection of findings that are related in some
way. This field cannot be updated. Its value is ignored in all update
requests.
iamBindings: Represents IAM bindings associated with the finding.
indicator: Represents what's commonly known as an *indicator of
compromise* (IoC) in computer forensics. This is an artifact observed on
a network or in an operating system that, with high confidence,
indicates a computer intrusion. For more information, see [Indicator of
compromise](https://en.wikipedia.org/wiki/Indicator_of_compromise).
ipRules: IP rules associated with the finding.
job: Job associated with the finding.
kernelRootkit: Signature of the kernel rootkit.
kubernetes: Kubernetes resources associated with the finding.
loadBalancers: The load balancers associated with the finding.
logEntries: Log entries that are relevant to the finding.
mitreAttack: MITRE ATT&CK tactics and techniques related to this finding.
See: https://attack.mitre.org
moduleName: Unique identifier of the module which generated the finding.
Example: folders/598186756061/securityHealthAnalyticsSettings/customModu
les/56799441161885
mute: Indicates the mute state of a finding (either muted, unmuted or
undefined). Unlike other attributes of a finding, a finding provider
shouldn't set the value of mute.
muteAnnotation: Records additional information about the mute operation
e.g. mute config that muted the finding etc. Unlike other attributes of
a finding, a finding provider shouldn't set the value of
mute_annotation.
muteInfo: Output only. The mute information regarding this finding.
muteInitiator: Records additional information about the mute operation,
for example, the [mute configuration](/security-command-center/docs/how-
to-mute-findings) that muted the finding and the user who muted the
finding.
muteUpdateTime: Output only. The most recent time this finding was muted
or unmuted.
name: The [relative resource name](https://cloud.google.com/apis/design/re
source_names#relative_resource_name) of the finding. Example: "organizat
ions/{organization_id}/sources/{source_id}/findings/{finding_id}",
"folders/{folder_id}/sources/{source_id}/findings/{finding_id}",
"projects/{project_id}/sources/{source_id}/findings/{finding_id}".
networks: Represents the VPC networks that the resource is attached to.
nextSteps: Steps to address the finding.
notebook: Notebook associated with the finding.
orgPolicies: Contains information about the org policies associated with
the finding.
parent: The relative resource name of the source the finding belongs to.
See: https://cloud.google.com/apis/design/resource_names#relative_resour
ce_name This field is immutable after creation time. For example:
"organizations/{organization_id}/sources/{source_id}"
parentDisplayName: Output only. The human readable display name of the
finding source such as "Event Threat Detection" or "Security Health
Analytics".
processes: Represents operating system processes associated with the
Finding.
resourceName: For findings on Google Cloud resources, the full resource
name of the Google Cloud resource this finding is for. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
When the finding is for a non-Google Cloud resource, the resourceName
can be a customer or partner defined string. This field is immutable
after creation time.
securityMarks: Output only. User specified security marks. These marks are
entirely managed by the user and come from the SecurityMarks resource
that belongs to the finding.
securityPosture: The security posture associated with the finding.
severity: The severity of the finding. This field is managed by the source
that writes the finding.
sourceProperties: Source specific properties. These properties are managed
by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
state: The state of the finding.
toxicCombination: Contains details about a group of security issues that,
when the issues occur together, represent a greater risk than when the
issues occur independently. A group of such issues is referred to as a
toxic combination. This field cannot be updated. Its value is ignored in
all update requests.
vertexAi: VertexAi associated with the finding.
vulnerability: Represents vulnerability-specific fields like CVE and CVSS
scores. CVE stands for Common Vulnerabilities and Exposures
(https://cve.mitre.org/about/)
c @ \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rg)#Finding.FindingClassValueValuesEnumi ah The class of the finding.
Values:
FINDING_CLASS_UNSPECIFIED: Unspecified finding class.
THREAT: Describes unwanted or malicious activity.
VULNERABILITY: Describes a potential weakness in software that increases
risk to Confidentiality & Integrity & Availability.
MISCONFIGURATION: Describes a potential weakness in cloud resource/asset
configuration that increases risk.
OBSERVATION: Describes a security observation that is for informational
purposes.
SCC_ERROR: Describes an error that prevents some SCC functionality.
POSTURE_VIOLATION: Describes a potential security risk due to a change
in the security posture.
TOXIC_COMBINATION: Describes a group of security issues that, when the
issues occur together, represent a greater risk than when the issues
occur independently. A group of such issues is referred to as a toxic
combination.
SENSITIVE_DATA_RISK: Describes a potential security risk to data assets
that contain sensitive data.
CHOKEPOINT: Describes a resource or resource group where high risk
attack paths converge, based on attack path simulations (APS).
r r r r r r r r r r r Nr r r r r! FINDING_CLASS_UNSPECIFIEDTHREAT
VULNERABILITYMISCONFIGURATION OBSERVATION SCC_ERRORPOSTURE_VIOLATIONTOXIC_COMBINATIONSENSITIVE_DATA_RISK
CHOKEPOINTr0 r r1 r2 FindingClassValueValuesEnumr s@ . !"
FMKIJr1 r c ( \ rS rSrSrSrSrSrSrSr g) Finding.MuteValueValuesEnumi2 I Indicates the mute state of a finding (either muted, unmuted or
undefined). Unlike other attributes of a finding, a finding provider
shouldn't set the value of mute.
Values:
MUTE_UNSPECIFIED: Unspecified.
MUTED: Finding has been muted.
UNMUTED: Finding has been unmuted.
UNDEFINED: Finding has never been muted/unmuted.
r r r r r N
r r r r r! MUTE_UNSPECIFIEDr' UNMUTEDr( r0 r r1 r2 MuteValueValuesEnumr 2
EGIr1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
Finding.SeverityValueValuesEnumiB
The severity of the finding. This field is managed by the source that
writes the finding.
Values:
SEVERITY_UNSPECIFIED: This value is used for findings when a source
doesn't write a severity value.
CRITICAL: Vulnerability: A critical vulnerability is easily discoverable
by an external actor, exploitable, and results in the direct ability
to execute arbitrary code, exfiltrate data, and otherwise gain
additional access and privileges to cloud resources and workloads.
Examples include publicly accessible unprotected user data and public
SSH access with weak or no passwords. Threat: Indicates a threat that
is able to access, modify, or delete data or execute unauthorized code
within existing resources.
HIGH: Vulnerability: A high risk vulnerability can be easily discovered
and exploited in combination with other vulnerabilities in order to
gain direct access and the ability to execute arbitrary code,
exfiltrate data, and otherwise gain additional access and privileges
to cloud resources and workloads. An example is a database with weak
or no passwords that is only accessible internally. This database
could easily be compromised by an actor that had access to the
internal network. Threat: Indicates a threat that is able to create
new computational resources in an environment but not able to access
data or execute code in existing resources.
MEDIUM: Vulnerability: A medium risk vulnerability could be used by an
actor to gain access to resources or privileges that enable them to
eventually (through multiple steps or a complex exploit) gain access
and the ability to execute arbitrary code or exfiltrate data. An
example is a service account with access to more projects than it
should have. If an actor gains access to the service account, they
could potentially use that access to manipulate a project the service
account was not intended to. Threat: Indicates a threat that is able
to cause operational impact but may not access data or execute
unauthorized code.
LOW: Vulnerability: A low risk vulnerability hampers a security
organization's ability to detect vulnerabilities or active threats in
their deployment, or prevents the root cause investigation of security
issues. An example is monitoring and logs being disabled for resource
configurations and access. Threat: Indicates a threat that has
obtained minimal access to an environment but is not able to access
data, execute code, or create resources.
r r r r r r N r r r r r! SEVERITY_UNSPECIFIEDr r r r r0 r r1 r2 SeverityValueValuesEnumr B $ )T H D
F
Cr1 r c $ \ rS rSrSrSrSrSrSrg) Finding.StateValueValuesEnumis The state of the finding.
Values:
STATE_UNSPECIFIED: Unspecified state.
ACTIVE: The finding requires attention and has not been addressed yet.
INACTIVE: The finding has been fixed, triaged as a non-issue or
otherwise addressed and is no longer active.
r r r r N r r r r r! r ACTIVEINACTIVEr0 r r1 r2 r r s
FHr1 r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Finding.ContactsValuei 7 Output only. Map containing the points of contact for the given
finding. The key represents the type of contact, while the value contains
a list of all the contacts that pertain. Please refer to:
https://cloud.google.com/resource-manager/docs/managing-notification-
contacts#notification-categories { "security": { "contacts": [ { "email":
"person1@company.com" }, { "email": "person2@company.com" } ] } }
Messages:
AdditionalProperty: An additional property for a ContactsValue object.
Fields:
additionalProperties: Additional properties of type ContactsValue
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)(Finding.ContactsValue.AdditionalPropertyi zAn additional property for a ContactsValue object.
Fields:
key: Name of the additional property.
value: A ContactDetails attribute.
r r r r N r r r r r! r" r# r r% r r0 r r1 r2 r r s,
! !! $c$$%5q9er1 r r Tr r Nr r r1 r2
ContactsValuer s2 :Y . . : %112FTXYr1 r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Finding.ExternalSystemsValuei 2 Output only. Third party SIEM/SOAR fields within SCC, contains
external system information and external system finding fields.
Messages:
AdditionalProperty: An additional property for a ExternalSystemsValue
object.
Fields:
additionalProperties: Additional properties of type ExternalSystemsValue
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)/Finding.ExternalSystemsValue.AdditionalPropertyi zAn additional property for a ExternalSystemsValue object.
Fields:
key: Name of the additional property.
value: A GoogleCloudSecuritycenterV1ExternalSystem attribute.
r )GoogleCloudSecuritycenterV1ExternalSystemr r Nr r r1 r2 r r -
! !! $c$$%PRSTer1 r r Tr r Nr r r1 r2 ExternalSystemsValuer 4 UY . . U %112FTXYr1 r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Finding.SourcePropertiesValuei Source specific properties. These properties are managed by the source
that writes the finding. The key names in the source_properties map must
be between 1 and 255 characters, and must start with a letter and contain
alphanumeric characters or underscores only.
Messages:
AdditionalProperty: An additional property for a SourcePropertiesValue
object.
Fields:
additionalProperties: Additional properties of type
SourcePropertiesValue
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)0Finding.SourcePropertiesValue.AdditionalPropertyi An additional property for a SourcePropertiesValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r extra_types.JsonValuer r Nr r r1 r2 r r ,
! !! $c$$%
Vulnerability? r N)Tr r r r r! r" ra r r r r r r r r r r r% accessaffectedResourcesaiModel applicationattackExposurebackupDisasterRecoveryr#
canonicalNamecategory
chokepoint
cloudArmorcloudDlpDataProfilecloudDlpInspectioncomplianceDetails compliances connectionsr
containersr dataAccessEventsdataFlowEventsdataRetentionDeletionEventsdatabaser diskr< exfiltrationexternalSystems externalUrifilesrb findingClassgroupMemberships iamBindings indicatorrp job
kernelRootkit
kubernetes
loadBalancers
logEntries mitreAttack
moduleNamemutemuteAnnotationmuteInfo
muteInitiatormuteUpdateTimer9 networks nextStepsnotebook orgPoliciesr parentDisplayName processes resourceName
securityMarkssecurityPostureseveritysourcePropertiesr toxicCombinationvertexAi
vulnerabilityr0 r r1 r2 r r W sg un!INN !FINN / / b Y^^ !!"89Zi'' Z :Z8 !!"89ZY . . Z :Z2 !!"89Zi / / Z :Z8 ! !(A .& ,,-@!D " "9a 0'&&}a8+ ))*:A>.$112JAN''*-
"
"1
%(%%lA6*%%lB7*!../DbI --.BBG ,,-@"E&&|R$G+&&|R$G+
#
#OR
8(%%k2E*$$R(* ++,=rDQ ))/2M. ) 6 67SUWbf g
#
#J
3(%%b)+ +$##B')'';, **+A2F/%%b)+
d
;%$$%BBG, ++,=rDQ&&|R$G+$$["5) " "9b 1' ub)#(( "=-%%lB7*(( dK-%%j"tD*&&}b9+$$R(* 2B 7$ ((,.
#
#J
3(''+- ((,. r "$
#
#IrD
A(##B')
#
#J
3(&&{BF+ $& ++B/$$YTB)&&r*,(( "=- **+C
#
#J
3((( "=-r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)Folderi ) Message that contains the resource name and display name of a folder
resource.
Fields:
resourceFolder: Full resource name of this folder. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
resourceFolderDisplayName: The user defined display name for this folder.
r r r N
r r r r r! r" r# resourceFolderresourceFolderDisplayNamer0 r r1 r2 r~ r~ * ((+. ' 3 3A 6r1 r~ c " \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SSSS 9r
\R " S
S SS 9r \R " S 5 r\R " S
5 r\R " SS5 rSrg)r| i# Compliance framework associated with the finding.
Enums:
CategoryValueListEntryValuesEnum:
TypeValueValuesEnum: Type of the framework associated with the finding, to
specify whether the framework is built-in (pre-defined and immutable) or
a custom framework defined by the customer (equivalent to security
posture)
Fields:
category: Category of the framework associated with the finding. E.g.
Security Benchmark, or Assured Workloads
controls: The controls associated with the framework.
displayName: Display name of the framework. For a standard framework, this
will look like e.g. PCI DSS 3.2.1, whereas for a custom framework it can
be a user defined string like MyFramework
name: Name of the framework associated with the finding
type: Type of the framework associated with the finding, to specify
whether the framework is built-in (pre-defined and immutable) or a
custom framework defined by the customer (equivalent to security
posture)
c , \ rS rSrSrSrSrSrSrSr Sr
g )
*Framework.CategoryValueListEntryValuesEnumi; D CategoryValueListEntryValuesEnum enum type.
Values:
FRAMEWORK_CATEGORY_UNSPECIFIED: Default value. This value is unused.
SECURITY_BENCHMARKS: Security Benchmarks framework
ASSURED_WORKLOADS: Assured Workloads framework
DATA_SECURITY: Data Security framework
GOOGLE_BEST_PRACTICES: Google Best Practices framework
r r r r r r N r r r r r! FRAMEWORK_CATEGORY_UNSPECIFIEDSECURITY_BENCHMARKSASSURED_WORKLOADS
DATA_SECURITYGOOGLE_BEST_PRACTICESr0 r r1 r2 CategoryValueListEntryValuesEnumr ; & &'"M r1 r c $ \ rS rSrSrSrSrSrSrg) Framework.TypeValueValuesEnumiK Type of the framework associated with the finding, to specify whether
the framework is built-in (pre-defined and immutable) or a custom
framework defined by the customer (equivalent to security posture)
Values:
FRAMEWORK_TYPE_UNSPECIFIED: Default value. This value is unused.
FRAMEWORK_TYPE_BUILT_IN: The framework is a built-in framework if it is
created and managed by GCP.
FRAMEWORK_TYPE_CUSTOM: The framework is a custom framework if it is
created and managed by the user.
r r r r N r r r r r! FRAMEWORK_TYPE_UNSPECIFIEDFRAMEWORK_TYPE_BUILT_INFRAMEWORK_TYPE_CUSTOMr0 r r1 r2 r r K
"# r1 r r Tr r r r r r r Nr r r r r! r" ra r r rb rM r% controlsr# rd r9 r r0 r r1 r2 r| r| # s . INN
!CQQU
V(
#
#Iq4
@(%%a(+ q !$ 2A 6$r1 r| c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S 5 r
S rg
) GcpMetadataib a Google Cloud metadata associated with the resource. Only applicable if
the finding's cloud provider is Google Cloud.
Fields:
folders: Output only. Contains a Folder message for each folder in the
assets ancestry. The first folder is the deepest nested folder, and the
last folder is the folder directly under the Organization.
organization: The name of the organization that the resource belongs to.
parent: The full resource name of resource's parent.
parentDisplayName: The human readable name of resource's parent.
project: The full resource name of project that the resource belongs to.
projectDisplayName: The project ID that the resource belongs to.
!GoogleCloudSecuritycenterV2Folderr Tr r r r r r r N)r r r r r! r" r% foldersr# r r rs projectprojectDisplayNamer0 r r1 r2 r r b sq
" "#FTX Y'&&q), #& ++A. ! !! $' ,,Q/r1 r c < \ rS rSrSr\R " S5 rSrg)r
iy VRepresents a geographical location for a given access.
Fields:
regionCode: A CLDR.
r r N r r r r r! r" r#
regionCoder0 r r1 r2 r
r
y $$Q'*r1 r
c > \ rS rSrSr\R " SS5 rSrg)GetIamPolicyRequesti zRequest message for `GetIamPolicy` method.
Fields:
options: OPTIONAL: A `GetPolicyOptions` object for specifying options to
`GetIamPolicy`.
GetPolicyOptionsr r N) r r r r r! r" r% optionsr0 r r1 r2 r r s
" "#5q 9'r1 r c b \ rS rSrSr\R " S\R R S9r Sr
g)r i a] Encapsulates settings provided to GetIamPolicy.
Fields:
requestedPolicyVersion: Optional. The maximum policy version that will be
used to format the policy. Valid values are 0, 1, and 3. Requests
specifying an invalid value will be rejected. Requests for policies with
any conditional role bindings must specify version 3. Policies with no
conditional role bindings may specify any valid value or leave the field
unset. The policy in the response might use the policy version that you
specified, or it might use a lower policy version. For example, if you
specify version 3, but the policy has no conditional role bindings, the
response uses version 1. To learn which resources support conditions in
their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
r r} r N) r r r r r! r" rM r r requestedPolicyVersionr0 r r1 r2 r r s( " %11!Y=N=N=T=TUr1 r c 8 \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
\R " S
5 rS rg )
)GoogleCloudSecuritycenterV1BigQueryExporti a Configures how to deliver Findings to BigQuery Instance.
Fields:
createTime: Output only. The time at which the BigQuery export was
created. This field is set by the server and will be ignored if provided
on export on creation.
dataset: The dataset to write findings' updates to. Its format is
"projects/[project_id]/datasets/[bigquery_dataset_id]". BigQuery Dataset
unique ID must contain only letters (a-z, A-Z), numbers (0-9), or
underscores (_).
description: The description of the export (max of 1024 characters).
filter: Expression that defines the filter to apply across create/update
events of findings. The expression is a list of zero or more
restrictions combined via logical operators `AND` and `OR`. Parentheses
are supported, and `OR` has higher precedence than `AND`. Restrictions
have the form ` ` and may have a `-` character in front of them to
indicate negation. The fields map to those defined in the corresponding
resource. The supported operators are: * `=` for all value types. * `>`,
`<`, `>=`, `<=` for integer values. * `:`, meaning substring matching,
for strings. The supported value types are: * string literals in quotes.
* integer literals without quotes. * boolean literals `true` and `false`
without quotes.
mostRecentEditor: Output only. Email address of the user who last edited
the BigQuery export. This field is set by the server and will be ignored
if provided on export creation or update.
name: The relative resource name of this export. See: https://cloud.google
.com/apis/design/resource_names#relative_resource_name. Example format:
"organizations/{organization_id}/bigQueryExports/{export_id}" Example
format: "folders/{folder_id}/bigQueryExports/{export_id}" Example
format: "projects/{project_id}/bigQueryExports/{export_id}" This field
is provided in responses, and is ignored when provided in create
requests.
principal: Output only. The service account that needs permission to
create table and upload data to the BigQuery dataset.
updateTime: Output only. The most recent time at which the BigQuery export
was updated. This field is set by the server and will be ignored if
provided on export creation or update.
r r r r r r r r r N)r r r r r! r" r# r r r r* mostRecentEditorr9 principal
updateTimer0 r r1 r2 r r s %N $$Q'* ! !! $'%%a(+ #& **1- q !$##A&)$$Q'*r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " SS5 r
\R " SSS S
9r S r g )
"GoogleCloudSecuritycenterV1Bindingi 3 Represents a Kubernetes RoleBinding or ClusterRoleBinding.
Fields:
name: Name for the binding.
ns: Namespace for the binding.
role: The Role or ClusterRole referenced by the binding.
subjects: Represents one or more subjects that are bound to the role. Not
always available for PATCH requests.
r r Roler Subjectr Tr r N
r r r r r! r" r# r9 r: r% r! subjectsr0 r r1 r2 r r sO
q !$ Q " *$
#
#Iq4
@(r1 r c \ rS rSrSrSrg)3GoogleCloudSecuritycenterV1BulkMuteFindingsResponsei AThe response to a BulkMute request. Contains the LRO information.r Nr r r1 r2 r r Jr1 r c H \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " S 5 r \R " S
S 5 r
\R " S 5 r\R " S
S5 r\R " SS5 rSrg)'GoogleCloudSecuritycenterV1CustomConfigi a Defines the properties in a custom module configuration for Security
Health Analytics. Use the custom module configuration to create custom
detectors that generate custom findings for resources that you specify.
Enums:
SeverityValueValuesEnum: The severity to assign to findings generated by
the module.
Fields:
celPolicy: The CEL policy spec attached to the custom module.
customOutput: Custom output properties.
description: Text that describes the vulnerability or misconfiguration
that the custom module detects. This explanation is returned with each
finding instance to help investigators understand the detected issue.
The text must be enclosed in quotation marks.
predicate: The CEL expression to evaluate to produce findings. When the
expression evaluates to true against a resource, a finding is generated.
recommendation: An explanation of the recommended steps that security
teams can take to resolve the detected issue. This explanation is
returned with each finding generated by this module in the `nextSteps`
property of the finding JSON.
resourceSelector: The resource types that the custom module operates on.
Each custom module can specify up to 5 resource types.
severity: The severity to assign to findings generated by the module.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
?GoogleCloudSecuritycenterV1CustomConfig.SeverityValueValuesEnumi
zThe severity to assign to findings generated by the module.
Values:
SEVERITY_UNSPECIFIED: Unspecified severity.
CRITICAL: Critical severity.
HIGH: High severity.
MEDIUM: Medium severity.
LOW: Low severity.
r r r r r r Nr r r1 r2 r r
# H D
F
Cr1 r r- r +GoogleCloudSecuritycenterV1CustomOutputSpecr r r r r +GoogleCloudSecuritycenterV1ResourceSelectorr r r N)r r r r r! r" ra r r% celPolicy customOutputr# r predicaterecommendationresourceSelectorrb rx r0 r r1 r2 r r s 4 $$_a8)''(UWXY,%%a(+$$VQ/) ((+. ++,Y[\]
!:A
>(r1 r c < \ rS rSrSr\R " SSSS9rSrg) r i
aK A set of optional name-value pairs that define custom source properties
to return with each finding that is generated by the custom module. The
custom source properties that are defined here are included in the finding
JSON under `sourceProperties`.
Fields:
properties: A list of custom output properties to add to the finding.
#GoogleCloudSecuritycenterV1Propertyr Tr r N) r r r r r! r" r%
propertiesr0 r r1 r2 r r
s %%&KQY]^*r1 r c & \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " SS 5 r \R " S
5 r\R " SS 5 r\R " S 5 rS
rg)GGoogleCloudSecuritycenterV1EffectiveSecurityHealthAnalyticsCustomModulei+
a An EffectiveSecurityHealthAnalyticsCustomModule is the representation of
a Security Health Analytics custom module at a specified level of the
resource hierarchy: organization, folder, or project. If a custom module is
inherited from a parent organization or folder, the value of the
`enablementState` property in EffectiveSecurityHealthAnalyticsCustomModule
is set to the value that is effective in the parent, instead of `INHERITED`.
For example, if the module is enabled in a parent organization or folder,
the effective enablement_state for the module in all child folders or
projects is also `enabled`. EffectiveSecurityHealthAnalyticsCustomModule is
read-only.
Enums:
CloudProviderValueValuesEnum: The cloud provider of the custom module.
EnablementStateValueValuesEnum: Output only. The effective state of
enablement for the module at the given level of the hierarchy.
Fields:
cloudProvider: The cloud provider of the custom module.
customConfig: Output only. The user-specified configuration for the
module.
displayName: Output only. The display name for the custom module. The name
must be between 1 and 128 characters, start with a lowercase letter, and
contain alphanumeric characters or underscores only.
enablementState: Output only. The effective state of enablement for the
module at the given level of the hierarchy.
name: Output only. The resource name of the custom module. Its format is "
organizations/{organization}/securityHealthAnalyticsSettings/effectiveCu
stomModules/{customModule}", or "folders/{folder}/securityHealthAnalytic
sSettings/effectiveCustomModules/{customModule}", or "projects/{project}
/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}"
c ( \ rS rSrSrSrSrSrSrSr g) dGoogleCloudSecuritycenterV1EffectiveSecurityHealthAnalyticsCustomModule.CloudProviderValueValuesEnumiL
zThe cloud provider of the custom module.
Values:
CLOUD_PROVIDER_UNSPECIFIED: Unspecified cloud provider.
GOOGLE_CLOUD_PLATFORM: Google Cloud.
AMAZON_WEB_SERVICES: Amazon Web Services.
MICROSOFT_AZURE: Microsoft Azure.
r r r r r N
r r r r r! CLOUD_PROVIDER_UNSPECIFIEDGOOGLE_CLOUD_PLATFORMAMAZON_WEB_SERVICESMICROSOFT_AZUREr0 r r1 r2 CloudProviderValueValuesEnumr L
"# Or1 r c $ \ rS rSrSrSrSrSrSrg)fGoogleCloudSecuritycenterV1EffectiveSecurityHealthAnalyticsCustomModule.EnablementStateValueValuesEnumiZ
a Output only. The effective state of enablement for the module at the
given level of the hierarchy.
Values:
ENABLEMENT_STATE_UNSPECIFIED: Unspecified enablement state.
ENABLED: The module is enabled at the given level.
DISABLED: The module is disabled at the given level.
r r r r N) r r r r r! ENABLEMENT_STATE_UNSPECIFIEDENABLEDDISABLEDr0 r r1 r2 EnablementStateValueValuesEnumr Z
s $% GHr1 r r r r r r r r N)r r r r r! r" ra r r rb
cloudProviderr% customConfigr# rd enablementStater9 r0 r r1 r2 r r +
s @ Y^^ y~~ %%&DaH-''(QSTU,%%a(+ ''(H!L/ q !$r1 r c \ rS rSrSr\R " SSS9r\R " S5 r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S 5 r
\R " S 5 r\R " S
5 r\R " S5 r\R" " SS5 rSrg)r in
aM Representation of third party SIEM/SOAR fields within SCC.
Fields:
assignees: References primary/secondary etc assignees in the external
system.
caseCloseTime: The time when the case was closed, as reported by the
external system.
caseCreateTime: The time when the case was created, as reported by the
external system.
casePriority: The priority of the finding's corresponding case in the
external system.
caseSla: The SLA of the finding's corresponding case in the external
system.
caseUri: The link to the finding's corresponding case in the external
system.
externalSystemUpdateTime: The time when the case was last updated, as
reported by the external system.
externalUid: The identifier that's used to track the finding's
corresponding case in the external system.
name: Full resource name of the external system, for example:
"organizations/1234/sources/5678/findings/123456/externalSystems/jira",
"folders/1234/sources/5678/findings/123456/externalSystems/jira",
"projects/1234/sources/5678/findings/123456/externalSystems/jira"
status: The most recent status of the finding's corresponding case, as
reported by the external system.
ticketInfo: Information about the ticket, if any, that is being used to
track the resolution of the issue that is identified by this finding.
r Tr r r r r r r r r r
TicketInfor r Nr r r r r! r" r# assignees
caseCloseTimecaseCreateTime casePrioritycaseSlacaseUriexternalSystemUpdateTime externalUidr9 statusr%
ticketInfor0 r r1 r2 r r n
s : ##A5)''*- ((+.&&q), ! !! $' ! !! $' & 2 21 5%%a(+ q !$ $&%%lB7*r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
\R " S
5 r\R " S 5 r\R " SS 5 r\R " S
5 rSrg)%GoogleCloudSecuritycenterV1MuteConfigi
a
A mute config is a Cloud SCC resource that contains the configuration to
mute create/update events of findings.
Enums:
TypeValueValuesEnum: Optional. The type of the mute config, which
determines what type of mute state the config affects. The static mute
state takes precedence over the dynamic mute state. Immutable after
creation. STATIC by default if not set during creation.
Fields:
createTime: Output only. The time at which the mute config was created.
This field is set by the server and will be ignored if provided on
config creation.
description: A description of the mute config.
displayName: The human readable name to be displayed for the mute config.
expiryTime: Optional. The expiry of the mute config. Only applicable for
dynamic configs. If the expiry is set, when the config expires, it is
removed from all findings.
filter: Required. An expression that defines the filter to apply across
create/update events of findings. While creating a filter string, be
mindful of the scope in which the mute configuration is being created.
E.g., If a filter contains project = X but is created under the project
= Y scope, it might not match any findings. The following field and
operator combinations are supported: * severity: `=`, `:` * category:
`=`, `:` * resource.name: `=`, `:` * resource.project_name: `=`, `:` *
resource.project_display_name: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.parent_name: `=`,
`:` * resource.parent_display_name: `=`, `:` * resource.type: `=`, `:` *
finding_class: `=`, `:` * indicator.ip_addresses: `=`, `:` *
indicator.domains: `=`, `:`
mostRecentEditor: Output only. Email address of the user who last edited
the mute config. This field is set by the server and will be ignored if
provided on config creation or update.
name: This field will be ignored if provided on config creation. Format
`organizations/{organization}/muteConfigs/{mute_config}`
`folders/{folder}/muteConfigs/{mute_config}`
`projects/{project}/muteConfigs/{mute_config}` `organizations/{organizat
ion}/locations/global/muteConfigs/{mute_config}`
`folders/{folder}/locations/global/muteConfigs/{mute_config}`
`projects/{project}/locations/global/muteConfigs/{mute_config}`
type: Optional. The type of the mute config, which determines what type of
mute state the config affects. The static mute state takes precedence
over the dynamic mute state. Immutable after creation. STATIC by default
if not set during creation.
updateTime: Output only. The most recent time at which the mute config was
updated. This field is set by the server and will be ignored if provided
on config creation or update.
c $ \ rS rSrSrSrSrSrSrg)9GoogleCloudSecuritycenterV1MuteConfig.TypeValueValuesEnumi
a Optional. The type of the mute config, which determines what type of
mute state the config affects. The static mute state takes precedence over
the dynamic mute state. Immutable after creation. STATIC by default if not
set during creation.
Values:
MUTE_CONFIG_TYPE_UNSPECIFIED: Unused.
STATIC: A static mute config, which sets the static mute state of future
matching findings to muted. Once the static mute state has been set,
finding or config modifications will not affect the state.
DYNAMIC: A dynamic mute config, which is applied to existing and future
matching findings, setting their dynamic mute state to "muted". If the
config is updated or deleted, or a matching finding is updated, such
that the finding doesn't match the config, the config will be removed
from the finding, and the finding's dynamic mute state may become
"unmuted" (unless other configs still match).
r r r r N r r r r r! MUTE_CONFIG_TYPE_UNSPECIFIEDSTATICDYNAMICr0 r r1 r2 r r
s " $%
FGr1 r r r r r r r r r r r N)r r r r r! r" ra r r# r r rd
expiryTimer* r r9 rb r r r0 r r1 r2 r r
s /bINN , $$Q'*%%a(+%%a(+$$Q'* #& **1- q !$ 2A 6$$$Q'*r1 r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SS5 r
Sr g )
.GoogleCloudSecuritycenterV1NotificationMessagei
# Cloud SCC's Notification
Fields:
finding: If it's a Finding based notification config, this field will be
populated.
notificationConfigName: Name of the notification config that generated
current notification.
resource: The Cloud resource tied to this notification's Finding.
r r r #GoogleCloudSecuritycenterV1Resourcer r N r r r r r! r" r% findingr# notificationConfigNamer; r0 r r1 r2 r r
s?
" "9a 0'$003
#
#$I1
M(r1 r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)r i
a> An individual name-value pair that defines a custom source property.
Fields:
name: Name of the property for the custom output.
valueExpression: The CEL expression for the custom output. A resource
property can be specified to return the value of the property or a text
string enclosed in quotation marks.
r r r r N) r r r r r! r" r# r9 r% valueExpressionr0 r r1 r2 r r
s+
q !$ **615/r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " SS 5 r \R " S
5 r\R " S S S
S9r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R " SS5 r\R " S5 r\R " S5 r\R " S5 rSrg ) r i
a) Information related to the Google Cloud resource.
Enums:
CloudProviderValueValuesEnum: Indicates which cloud provider the resource
resides in.
Fields:
awsMetadata: The AWS metadata associated with the finding.
azureMetadata: The Azure metadata associated with the finding.
cloudProvider: Indicates which cloud provider the resource resides in.
displayName: The human readable name of the resource.
folders: Output only. Contains a Folder message for each folder in the
assets ancestry. The first folder is the deepest nested folder, and the
last folder is the folder directly under the Organization.
location: The region or location of the service (if applicable).
name: The full resource name of the resource. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
organization: Indicates which organization or tenant in the cloud provider
the finding applies to.
parent: The full resource name of resource's parent.
parentDisplayName: The human readable name of resource's parent.
project: The full resource name of project that the resource belongs to.
projectDisplayName: The project ID that the resource belongs to.
resourcePath: Provides the path to the resource within the resource
hierarchy.
resourcePathString: A string representation of the resource path. For
Google Cloud, it has the format of `organizations/{organization_id}/fold
ers/{folder_id}/folders/{folder_id}/projects/{project_id}` where there
can be any number of folders. For AWS, it has the format of `org/{organi
zation_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/accou
nt/{account_id}` where there can be any number of organizational units.
For Azure, it has the format of `mg/{management_group_id}/mg/{management
_group_id}/subscription/{subscription_id}/rg/{resource_group_name}`
where there can be any number of management groups.
service: The parent service or product from which the resource is
provided, for example, GKE or SNS.
type: The full resource type of the resource.
c ( \ rS rSrSrSrSrSrSrSr g) @GoogleCloudSecuritycenterV1Resource.CloudProviderValueValuesEnumi2 a; Indicates which cloud provider the resource resides in.
Values:
CLOUD_PROVIDER_UNSPECIFIED: The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM: The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES: The cloud provider is Amazon Web Services.
MICROSOFT_AZURE: The cloud provider is Microsoft Azure.
r r r r r Nr r r1 r2 r r 2 r r1 r r r r r r r r~ r Tr r r r r r r r ResourcePathr r r r r N) r r r r r! r" ra r r% awsMetadata
azureMetadatarb r r# rd r rg r9 r r rs r r resourcePathresourcePathStringr r r0 r r1 r2 r r
s* %N Y^^ &&}a8+(( !<-%%&DaH-%%a(+ " "8Q >'
"
"1
%( q !$&&q), #& ++B/ ! !" %' ,,R0'';, ,,R0 ! !" %' r "$r1 r c : \ rS rSrSr\R " SSS9rSrg)r iR zkResource for selecting resource type.
Fields:
resourceTypes: The resource types to run the detector on.
r Tr r N) r r r r r! r" r#
resourceTypesr0 r r1 r2 r r R s ''D9-r1 r c R \ rS rSrSr " S S\R 5 r " S S\R 5 r\ R " S5 " S S \R 5 5 r \R " SS
5 r\R " S 5 r\R " S 5 r\R " S
5 r\R& " S S5 r\R " S5 r\R " SS5 r\R " S5 r\R& " SS5 r\R " SSS9r\R " S5 rSrg).GoogleCloudSecuritycenterV1ResourceValueConfigi\ a A resource value configuration (RVC) is a mapping configuration of
user's resources to resource values. Used in Attack path simulations.
Enums:
CloudProviderValueValuesEnum: Cloud provider this configuration applies to
ResourceValueValueValuesEnum: Required. Resource value level this
expression represents
Messages:
ResourceLabelsSelectorValue: List of resource labels to search for,
evaluated with `AND`. For example, `"resource_labels_selector": {"key":
"value", "env": "prod"}` will match resources with labels "key": "value"
`AND` "env": "prod" https://cloud.google.com/resource-
manager/docs/creating-managing-labels
Fields:
cloudProvider: Cloud provider this configuration applies to
createTime: Output only. Timestamp this resource value configuration was
created.
description: Description of the resource value configuration.
name: Name for the resource value configuration
resourceLabelsSelector: List of resource labels to search for, evaluated
with `AND`. For example, `"resource_labels_selector": {"key": "value",
"env": "prod"}` will match resources with labels "key": "value" `AND`
"env": "prod" https://cloud.google.com/resource-manager/docs/creating-
managing-labels
resourceType: Apply resource_value only to resources that match
resource_type. resource_type will be checked with `AND` of other
resources. For example, "storage.googleapis.com/Bucket" with
resource_value "HIGH" will apply "HIGH" value only to
"storage.googleapis.com/Bucket" resources.
resourceValue: Required. Resource value level this expression represents
scope: Project or folder to scope this configuration to. For example,
"project/456" would apply this configuration only to resources in
"project/456" scope will be checked with `AND` of other resources.
sensitiveDataProtectionMapping: A mapping of the sensitivity on Sensitive
Data Protection finding to resource values. This mapping can only be
used in combination with a resource_type that is related to BigQuery,
e.g. "bigquery.googleapis.com/Dataset".
tagValues: Required. Tag values combined with `AND` to check against. For
Google Cloud resources, they are tag value IDs in the form of
"tagValues/123". Example: `[ "tagValues/123", "tagValues/456",
"tagValues/789" ]` https://cloud.google.com/resource-
manager/docs/tags/tags-creating-and-managing
updateTime: Output only. Timestamp this resource value configuration was
last updated.
c ( \ rS rSrSrSrSrSrSrSr g) KGoogleCloudSecuritycenterV1ResourceValueConfig.CloudProviderValueValuesEnumi 0 Cloud provider this configuration applies to
Values:
CLOUD_PROVIDER_UNSPECIFIED: The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM: The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES: The cloud provider is Amazon Web Services.
MICROSOFT_AZURE: The cloud provider is Microsoft Azure.
r r r r r Nr r r1 r2 r r r r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
KGoogleCloudSecuritycenterV1ResourceValueConfig.ResourceValueValueValuesEnumi zRequired. Resource value level this expression represents
Values:
RESOURCE_VALUE_UNSPECIFIED: Unspecific value
HIGH: High resource value
MEDIUM: Medium resource value
LOW: Low resource value
NONE: No resource value, e.g. ignore these resources
r r r r r r N r r r r r! RESOURCE_VALUE_UNSPECIFIEDr r r NONEr0 r r1 r2 ResourceValueValueValuesEnumr s# "# D
F
C Dr1 r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
JGoogleCloudSecuritycenterV1ResourceValueConfig.ResourceLabelsSelectorValuei a List of resource labels to search for, evaluated with `AND`. For
example, `"resource_labels_selector": {"key": "value", "env": "prod"}`
will match resources with labels "key": "value" `AND` "env": "prod"
https://cloud.google.com/resource-manager/docs/creating-managing-labels
Messages:
AdditionalProperty: An additional property for a
ResourceLabelsSelectorValue object.
Fields:
additionalProperties: Additional properties of type
ResourceLabelsSelectorValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)]GoogleCloudSecuritycenterV1ResourceValueConfig.ResourceLabelsSelectorValue.AdditionalPropertyi An additional property for a ResourceLabelsSelectorValue object.
Fields:
key: Name of the additional property.
value: A string attribute.
r r r Nr r r1 r2 r r r r1 r r Tr r Nr r r1 r2 ResourceLabelsSelectorValuer 2 'Y . . ' %112FTXYr1 r r r r r r r r r 9GoogleCloudSecuritycenterV1SensitiveDataProtectionMappingr r Tr r r N r r r r r! r" ra r r r r r r rb r r# r r r9 r% resourceLabelsSelectorr
resourceValuer& sensitiveDataProtectionMapping tagValuesr r0 r r1 r2 r r \ s .` Y^^
Y^^
!!"89ZI$5$5 Z :Z8 %%&DaH-$$Q'*%%a(+ q !$$112OQRS&&q),%%&DaH-
"%#,#9#9:uwx#y ##B6)$$R(*r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) 4GoogleCloudSecuritycenterV1RunAssetDiscoveryResponsei Response of asset discovery run
Enums:
StateValueValuesEnum: The state of an asset discovery run.
Fields:
duration: The duration between asset discovery run start and end
state: The state of an asset discovery run.
c ( \ rS rSrSrSrSrSrSrSr g) IGoogleCloudSecuritycenterV1RunAssetDiscoveryResponse.StateValueValuesEnumi The state of an asset discovery run.
Values:
STATE_UNSPECIFIED: Asset discovery run state was unspecified.
COMPLETED: Asset discovery run completed successfully.
SUPERSEDED: Asset discovery run was cancelled with tasks still pending,
as another run for the same organization was started with a higher
priority.
TERMINATED: Asset discovery run was killed and terminated.
r r r r r N
r r r r r! r COMPLETED
SUPERSEDED
TERMINATEDr0 r r1 r2 r r$ IJJr1 r r r r N
r r r r r! r" ra r r# r= rb r r0 r r1 r2 r! r! < Y^^
"
"1
%(
4a
8%r1 r! c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " S5 r
\R " SS5 r \R " S S
5 r\R " S 5 r\R " SS 5 r\R " S
5 r\R " S5 r\R " S5 rSrg)>GoogleCloudSecuritycenterV1SecurityHealthAnalyticsCustomModulei a Represents an instance of a Security Health Analytics custom module,
including its full module name, display name, enablement state, and last
updated time. You can create a custom module at the organization, folder, or
project level. Custom modules that you create at the organization or folder
level are inherited by the child folders and projects.
Enums:
CloudProviderValueValuesEnum: The cloud provider of the custom module.
EnablementStateValueValuesEnum: The enablement state of the custom module.
Fields:
ancestorModule: Output only. If empty, indicates that the custom module
was created in the organization, folder, or project in which you are
viewing the custom module. Otherwise, `ancestor_module` specifies the
organization or folder from which the custom module is inherited.
cloudProvider: The cloud provider of the custom module.
customConfig: The user specified custom configuration for the module.
displayName: The display name of the Security Health Analytics custom
module. This display name becomes the finding category for all findings
that are returned by this custom module. The display name must be
between 1 and 128 characters, start with a lowercase letter, and contain
alphanumeric characters or underscores only.
enablementState: The enablement state of the custom module.
lastEditor: Output only. The editor that last updated the custom module.
name: Immutable. The resource name of the custom module. Its format is "or
ganizations/{organization}/securityHealthAnalyticsSettings/customModules
/{customModule}", or "folders/{folder}/securityHealthAnalyticsSettings/c
ustomModules/{customModule}", or "projects/{project}/securityHealthAnaly
ticsSettings/customModules/{customModule}" The id {customModule} is
server-generated and is not user settable. It will be a numeric id
containing 1-20 digits.
updateTime: Output only. The time at which the custom module was last
updated.
c ( \ rS rSrSrSrSrSrSrSr g) [GoogleCloudSecuritycenterV1SecurityHealthAnalyticsCustomModule.CloudProviderValueValuesEnumi zThe cloud provider of the custom module.
Values:
CLOUD_PROVIDER_UNSPECIFIED: Unspecified cloud provider.
GOOGLE_CLOUD_PLATFORM: Google Cloud.
AMAZON_WEB_SERVICES: Amazon Web Services (AWS).
MICROSOFT_AZURE: Microsoft Azure.
r r r r r Nr r r1 r2 r r0 r r1 r c ( \ rS rSrSrSrSrSrSrSr g) ]GoogleCloudSecuritycenterV1SecurityHealthAnalyticsCustomModule.EnablementStateValueValuesEnumi& a The enablement state of the custom module.
Values:
ENABLEMENT_STATE_UNSPECIFIED: Unspecified enablement state.
ENABLED: The module is enabled at the given CRM resource.
DISABLED: The module is disabled at the given CRM resource.
INHERITED: State is inherited from an ancestor module. The module will
either be effectively ENABLED or DISABLED based on its closest non-
inherited ancestor module in the CRM hierarchy.
r r r r r N)
r r r r r! r r r INHERITEDr0 r r1 r2 r r2 & s $% GHIr1 r r r r r r r r r r r N)r r r r r! r" ra r r r# ancestorModulerb r r% r rd r
lastEditorr9 r r0 r r1 r2 r. r. s !F Y^^ y~~ ((+.%%&DaH-''(QSTU,%%a(+ ''(H!L/$$Q'* q !$$$Q'*r1 r. c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " SS5 r S r g
) r i@ a Resource value mapping for Sensitive Data Protection findings. If any of
these mappings have a resource value that is not unspecified, the
resource_value field will be ignored when reading this configuration.
Enums:
HighSensitivityMappingValueValuesEnum: Resource value mapping for high-
sensitivity Sensitive Data Protection findings
MediumSensitivityMappingValueValuesEnum: Resource value mapping for
medium-sensitivity Sensitive Data Protection findings
Fields:
highSensitivityMapping: Resource value mapping for high-sensitivity
Sensitive Data Protection findings
mediumSensitivityMapping: Resource value mapping for medium-sensitivity
Sensitive Data Protection findings
c , \ rS rSrSrSrSrSrSrSr Sr
g )
_GoogleCloudSecuritycenterV1SensitiveDataProtectionMapping.HighSensitivityMappingValueValuesEnumiR Resource value mapping for high-sensitivity Sensitive Data Protection
findings
Values:
RESOURCE_VALUE_UNSPECIFIED: Unspecific value
HIGH: High resource value
MEDIUM: Medium resource value
LOW: Low resource value
NONE: No resource value, e.g. ignore these resources
r r r r r r Nr r r1 r2 %HighSensitivityMappingValueValuesEnumr8 R # "# D
F
C Dr1 r: c , \ rS rSrSrSrSrSrSrSr Sr
g )
aGoogleCloudSecuritycenterV1SensitiveDataProtectionMapping.MediumSensitivityMappingValueValuesEnumic Resource value mapping for medium-sensitivity Sensitive Data
Protection findings
Values:
RESOURCE_VALUE_UNSPECIFIED: Unspecific value
HIGH: High resource value
MEDIUM: Medium resource value
LOW: Low resource value
NONE: No resource value, e.g. ignore these resources
r r r r r r Nr r r1 r2 'MediumSensitivityMappingValueValuesEnumr= c r; r1 r? r r r N
r r r r r! r" ra r: r? rb highSensitivityMappingmediumSensitivityMappingr0 r r1 r2 r r @ S "
inn
"
" %../VXYZ & 0 01Z\] ^r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) 9GoogleCloudSecuritycenterV1beta1RunAssetDiscoveryResponseix r" c ( \ rS rSrSrSrSrSrSrSr g) NGoogleCloudSecuritycenterV1beta1RunAssetDiscoveryResponse.StateValueValuesEnumi r% r r r r r Nr& r r1 r2 r rG r* r1 r r r r Nr+ r r1 r2 rE rE x r, r1 rE c x \ rS rSrSr " S S\R 5 r " S S\R 5 r\ R " S5 " S S \R 5 5 r \R " S
5 r\R " S 5 r\R " S 5 r\R " S
5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 r\R, " SS5 r\R0 " SS5 r\R, " S S5 r\R0 " SS5 rSr g))GoogleCloudSecuritycenterV1p1beta1Findingi aE Security Command Center finding. A finding is a record of assessment
data (security, risk, health or privacy) ingested into Security Command
Center for presentation, notification, analysis, policy testing, and
enforcement. For example, an XSS vulnerability in an App Engine application
is a finding.
Enums:
SeverityValueValuesEnum: The severity of the finding. This field is
managed by the source that writes the finding.
StateValueValuesEnum: The state of the finding.
Messages:
SourcePropertiesValue: Source specific properties. These properties are
managed by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
Fields:
canonicalName: The canonical name of the finding. It's either "organizatio
ns/{organization_id}/sources/{source_id}/findings/{finding_id}",
"folders/{folder_id}/sources/{source_id}/findings/{finding_id}" or
"projects/{project_number}/sources/{source_id}/findings/{finding_id}",
depending on the closest CRM ancestor of the resource associated with
the finding.
category: The additional taxonomy group within findings from a given
source. This field is immutable after creation time. Example:
"XSS_FLASH_INJECTION"
createTime: The time at which the finding was created in Security Command
Center.
eventTime: The time at which the event took place, or when an update to
the finding occurred. For example, if the finding represents an open
firewall it would capture the time the detector believes the firewall
became open. The accuracy is determined by the detector. If the finding
were to be resolved afterward, this time would reflect when the finding
was resolved. Must not be set to a value greater than the current
timestamp.
externalUri: The URI that, if available, points to a web page outside of
Security Command Center where additional information about the finding
can be found. This field is guaranteed to be either empty or a well
formed URL.
name: The relative resource name of this finding. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me Example: "organizations/{organization_id}/sources/{source_id}/finding
s/{finding_id}"
parent: The relative resource name of the source the finding belongs to.
See: https://cloud.google.com/apis/design/resource_names#relative_resour
ce_name This field is immutable after creation time. For example:
"organizations/{organization_id}/sources/{source_id}"
resourceName: For findings on Google Cloud resources, the full resource
name of the Google Cloud resource this finding is for. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
When the finding is for a non-Google Cloud resource, the resourceName
can be a customer or partner defined string. This field is immutable
after creation time.
securityMarks: Output only. User specified security marks. These marks are
entirely managed by the user and come from the SecurityMarks resource
that belongs to the finding.
severity: The severity of the finding. This field is managed by the source
that writes the finding.
sourceProperties: Source specific properties. These properties are managed
by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
state: The state of the finding.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
AGoogleCloudSecuritycenterV1p1beta1Finding.SeverityValueValuesEnumi a The severity of the finding. This field is managed by the source that
writes the finding.
Values:
SEVERITY_UNSPECIFIED: No severity specified. The default value.
CRITICAL: Critical severity.
HIGH: High severity.
MEDIUM: Medium severity.
LOW: Low severity.
r r r r r r Nr r r1 r2 r rK s# H D
F
Cr1 r c $ \ rS rSrSrSrSrSrSrg)>GoogleCloudSecuritycenterV1p1beta1Finding.StateValueValuesEnumi r r r r r Nr r r1 r2 r rM r r1 r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
?GoogleCloudSecuritycenterV1p1beta1Finding.SourcePropertiesValuei r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)RGoogleCloudSecuritycenterV1p1beta1Finding.SourcePropertiesValue.AdditionalPropertyi
r r r r r Nr r r1 r2 r rQ
r r1 r r Tr r Nr r r1 r2 r rO r r1 r r r r r r r r r /GoogleCloudSecuritycenterV1p1beta1SecurityMarksr r r r r N) r r r r r! r" ra r r r r r r r# rL rM r r< r] r9 r ru r% rv rb rx ry r r0 r r1 r2 rI rI s) BH " Y^^ !!"89Zi / / Z :Z8 ''*-
"
"1
%($$Q'*##A&)%%a(+ q !$ #&&&q),(()Z\]^-
!:B
?( ++,CRH
4b
9%r1 rI c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)(GoogleCloudSecuritycenterV1p1beta1Folderi%
r r r r Nr r r1 r2 rT rT %
r r1 rT c \ rS rSrSr\R " SS5 r\R " S5 r \R " SS5 r
Sr g )
5GoogleCloudSecuritycenterV1p1beta1NotificationMessagei3
a& Security Command Center's Notification
Fields:
finding: If it's a Finding based notification config, this field will be
populated.
notificationConfigName: Name of the notification config that generated
current notification.
resource: The Cloud resource tied to the notification.
rI r r *GoogleCloudSecuritycenterV1p1beta1Resourcer r Nr r r1 r2 rV rV 3
sB
" "#NPQ R'$003
#
#$PRS
T(r1 rV c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S 5 r
S rg
)rW iC
a Information related to the Google Cloud resource.
Fields:
folders: Output only. Contains a Folder message for each folder in the
assets ancestry. The first folder is the deepest nested folder, and the
last folder is the folder directly under the Organization.
name: The full resource name of the resource. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
parent: The full resource name of resource's parent.
parentDisplayName: The human readable name of resource's parent.
project: The full resource name of project that the resource belongs to.
projectDisplayName: The project id that the resource belongs to.
rT r Tr r r r r r r N)r r r r r! r" r% r r# r9 r rs r r r0 r r1 r2 rW rW C
sq
" "#Mq[_ `' q !$ #& ++A. ! !! $' ,,Q/r1 rW c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) ;GoogleCloudSecuritycenterV1p1beta1RunAssetDiscoveryResponseiZ
r" c ( \ rS rSrSrSrSrSrSrSr g) PGoogleCloudSecuritycenterV1p1beta1RunAssetDiscoveryResponse.StateValueValuesEnumie
r% r r r r r Nr& r r1 r2 r r\ e
r* r1 r r r r Nr+ r r1 r2 rZ rZ Z
r, r1 rZ c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 r \R " SS5 r
\R " S5 rS rg
) rR iy
User specified security marks that are attached to the parent Security
Command Center resource. Security marks are scoped within a Security Command
Center organization -- they can be modified and viewed by all users who have
proper permissions on the organization.
Messages:
MarksValue: Mutable user specified security marks belonging to the parent
resource. Constraints are as follows: * Keys and values are treated as
case insensitive * Keys must be between 1 - 256 characters (inclusive) *
Keys must be letters, numbers, underscores, or dashes * Values have
leading and trailing whitespace trimmed, remaining characters must be
between 1 - 4096 characters (inclusive)
Fields:
canonicalName: The canonical name of the marks. Examples:
"organizations/{organization_id}/assets/{asset_id}/securityMarks"
"folders/{folder_id}/assets/{asset_id}/securityMarks"
"projects/{project_number}/assets/{asset_id}/securityMarks" "organizatio
ns/{organization_id}/sources/{source_id}/findings/{finding_id}/securityM
arks" "folders/{folder_id}/sources/{source_id}/findings/{finding_id}/sec
urityMarks" "projects/{project_number}/sources/{source_id}/findings/{fin
ding_id}/securityMarks"
marks: Mutable user specified security marks belonging to the parent
resource. Constraints are as follows: * Keys and values are treated as
case insensitive * Keys must be between 1 - 256 characters (inclusive) *
Keys must be letters, numbers, underscores, or dashes * Values have
leading and trailing whitespace trimmed, remaining characters must be
between 1 - 4096 characters (inclusive)
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me Examples:
"organizations/{organization_id}/assets/{asset_id}/securityMarks" "organ
izations/{organization_id}/sources/{source_id}/findings/{finding_id}/sec
urityMarks".
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
:GoogleCloudSecuritycenterV1p1beta1SecurityMarks.MarksValuei
Mutable user specified security marks belonging to the parent
resource. Constraints are as follows: * Keys and values are treated as
case insensitive * Keys must be between 1 - 256 characters (inclusive) *
Keys must be letters, numbers, underscores, or dashes * Values have
leading and trailing whitespace trimmed, remaining characters must be
between 1 - 4096 characters (inclusive)
Messages:
AdditionalProperty: An additional property for a MarksValue object.
Fields:
additionalProperties: Additional properties of type MarksValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)MGoogleCloudSecuritycenterV1p1beta1SecurityMarks.MarksValue.AdditionalPropertyi
~An additional property for a MarksValue object.
Fields:
key: Name of the additional property.
value: A string attribute.
r r r Nr r r1 r2 r rc
r r1 r r Tr r Nr r r1 r2
MarksValuer`
r r1 re r r r r Nr r r r r! r r r" r re r# rL r% marksr9 r0 r r1 r2 rR rR y
l "H !!"89Z9$$ Z :Z8 ''*-
q
1% q !$r1 rR c \ rS rSrSr\R " S5 r\R " SS5 r \R " S5 r
\R " S5 r \R " S5 r \R " S S
S S 9r
\R " S
5 r\R " S5 r\R " S5 r\R " S5 r\R " S5 rSrg)!GoogleCloudSecuritycenterV2Accessi
r r &GoogleCloudSecuritycenterV2Geolocationr r r r 7GoogleCloudSecuritycenterV2ServiceAccountDelegationInfor Tr r r r r r r Nr r r1 r2 rj rj
s -^
"
"1
%(&&'OQRS+$$Q'* ((+. **1-!*!7!78qst @D "E #//2%%a(+##A&) ))"-/
"
"2
&(r1 rj c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
S
rg ) 'GoogleCloudSecuritycenterV2AccessReviewi
r6 r r r r r r r r Nr7 r r1 r2 rn rn
r? r1 rn c < \ rS rSrSr\R " S5 rSrg)-GoogleCloudSecuritycenterV2AdaptiveProtectioni rC r r NrD r r1 r2 rp rp rG r1 rp c < \ rS rSrSr\R " S5 rSrg),GoogleCloudSecuritycenterV2AffectedResourcesi* rK r r NrL r r1 r2 rr rr * rO r1 rr c @ \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r \R " S5 r
\R " S 5 r\R " S
5 r\R " S 5 rS rg
)"GoogleCloudSecuritycenterV2AiModeli4 rS c , \ rS rSrSrSrSrSrSrSr Sr
g )
DGoogleCloudSecuritycenterV2AiModel.DeploymentPlatformValueValuesEnumiG rW r r r r r r NrX r r1 r2 r^ rv G r_ r1 r^ r r r r r r r r Nr` r r1 r2 rt rt 4 ri r1 rt c < \ rS rSrSr\R " SSSS9rSrg) "GoogleCloudSecuritycenterV2Allowedi` rm !GoogleCloudSecuritycenterV2IpRuler Tr r Nro r r1 r2 rx rx `
" "#FTX Y'r1 rx c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)&GoogleCloudSecuritycenterV2Applicationij al Represents an application associated with a finding.
Fields:
baseUri: The base URI that identifies the network location of the
application in which the vulnerability was detected. For example,
`http://example.com`.
fullUri: The full URI with payload that could be used to reproduce the
vulnerability. For example, `http://example.com?p=aMmYgI6H`.
r r r Nru r r1 r2 r| r| j rx r1 r| c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " S5 r \R " S\R R S9r
\R " S5 rS rg
) !GoogleCloudSecuritycenterV2Attackiy r| r r r} r r r r Nr r r1 r2 r~ r~ y r r1 r~ c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S\R R S9r
\R " S\R R S9r\R " S \R R S9r\R " S
5 r\R" " S 5 r\R& " SS 5 rS
rg))GoogleCloudSecuritycenterV2AttackExposurei a An attack exposure contains the results of an attack path simulation
run.
Enums:
StateValueValuesEnum: Output only. What state this AttackExposure is in.
This captures whether or not an attack exposure has been calculated or
not.
Fields:
attackExposureResult: The resource name of the attack path simulation
result that contains the details regarding this attack exposure score.
Example: `organizations/123/simulations/456/attackExposureResults/789`
exposedHighValueResourcesCount: The number of high value resources that
are exposed as a result of this finding.
exposedLowValueResourcesCount: The number of high value resources that are
exposed as a result of this finding.
exposedMediumValueResourcesCount: The number of medium value resources
that are exposed as a result of this finding.
latestCalculationTime: The most recent time the attack exposure was
updated on this finding.
score: A number between 0 (inclusive) and infinity that represents how
important this finding is to remediate. The higher the score, the more
important it is to remediate.
state: Output only. What state this AttackExposure is in. This captures
whether or not an attack exposure has been calculated or not.
c $ \ rS rSrSrSrSrSrSrg)>GoogleCloudSecuritycenterV2AttackExposure.StateValueValuesEnumi a/ Output only. What state this AttackExposure is in. This captures
whether or not an attack exposure has been calculated or not.
Values:
STATE_UNSPECIFIED: The state is not specified.
CALCULATED: The attack exposure has been calculated.
NOT_CALCULATED: The attack exposure has not been calculated.
r r r r Nr r r1 r2 r r r r1 r r r r} r r r r r r Nr r r1 r2 r r s 6 Y^^ #..q1#,#9#9!YEVEVE\E\#] "+"8"8IDUDUD[D["\ %.%;%;AyGXGXG^G^%_"#//2
q
!%
4a
8%r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)%GoogleCloudSecuritycenterV2AwsAccounti r r r r Nr r r1 r2 r r r r1 r c \ rS rSrSr\R " SS5 r\R " SS5 r\R " SSS S
9r S r
g )
&GoogleCloudSecuritycenterV2AwsMetadatai r r r *GoogleCloudSecuritycenterV2AwsOrganizationr 0GoogleCloudSecuritycenterV2AwsOrganizationalUnitr Tr r Nr r r1 r2 r r sH
" "#JA N'''(TVWX,!../acdostr1 r c < \ rS rSrSr\R " S5 rSrg)r i r r r Nr r r1 r2 r r r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i r r r r Nr r r1 r2 r r r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)/GoogleCloudSecuritycenterV2AzureManagementGroupi r r r r Nr r r1 r2 r r r r1 r c \ rS rSrSr\R " SSSS9r\R " SS5 r\R " S S
5 r \R " S S 5 r
S
r g)(GoogleCloudSecuritycenterV2AzureMetadatai r r r Tr -GoogleCloudSecuritycenterV2AzureResourceGroupr ,GoogleCloudSecuritycenterV2AzureSubscriptionr &GoogleCloudSecuritycenterV2AzureTenantr r Nr r r1 r2 r r s\
++,]_`kop(()XZ[\-''(VXYZ, ! !"JA N&r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i r r r r Nr r r1 r2 r r r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i* r r r r Nr r r1 r2 r r * r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i7 r r r r Nr r r1 r2 r r 7 r r1 r c z \ rS rSrSr\R " S5 r\R " SSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S SS9r
\R " S SS9r\R " S
5 r\R " S5 rSrg)1GoogleCloudSecuritycenterV2BackupDisasterRecoveryiD r r r Tr r r r r r r r r r Nr r r1 r2 r r D r r1 r c \ \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
\R " S
5 r\R " S 5 rS rg
))GoogleCloudSecuritycenterV2BigQueryExporti a Configures how to deliver Findings to BigQuery Instance.
Fields:
createTime: Output only. The time at which the BigQuery export was
created. This field is set by the server and will be ignored if provided
on export on creation.
cryptoKeyName: Output only. The resource name of the Cloud KMS `CryptoKey`
used to protect this configuration's data, if configured during Security
Command Center activation.
dataset: The dataset to write findings' updates to. Its format is
"projects/[project_id]/datasets/[bigquery_dataset_id]". BigQuery dataset
unique ID must contain only letters (a-z, A-Z), numbers (0-9), or
underscores (_).
description: The description of the export (max of 1024 characters).
filter: Expression that defines the filter to apply across create/update
events of findings. The expression is a list of zero or more
restrictions combined via logical operators `AND` and `OR`. Parentheses
are supported, and `OR` has higher precedence than `AND`. Restrictions
have the form ` ` and may have a `-` character in front of them to
indicate negation. The fields map to those defined in the corresponding
resource. The supported operators are: * `=` for all value types. * `>`,
`<`, `>=`, `<=` for integer values. * `:`, meaning substring matching,
for strings. The supported value types are: * string literals in quotes.
* integer literals without quotes. * boolean literals `true` and `false`
without quotes.
mostRecentEditor: Output only. Email address of the user who last edited
the BigQuery export. This field is set by the server and will be ignored
if provided on export creation or update.
name: Identifier. The relative resource name of this export. See: https://
cloud.google.com/apis/design/resource_names#relative_resource_name. The
following list shows some examples: + `organizations/{organization_id}/l
ocations/{location_id}/bigQueryExports/{export_id}` + `folders/{folder_i
d}/locations/{location_id}/bigQueryExports/{export_id}` + `projects/{pro
ject_id}/locations/{location_id}/bigQueryExports/{export_id}` This field
is provided in responses, and is ignored when provided in create
requests.
principal: Output only. The service account that needs permission to
create table and upload data to the BigQuery dataset.
updateTime: Output only. The most recent time at which the BigQuery export
was updated. This field is set by the server and will be ignored if
provided on export creation or update.
r r r r r r r r r r N)r r r r r! r" r# r
cryptoKeyNamer r r* r r9 r r r0 r r1 r2 r r s )V $$Q'*''*- ! !! $'%%a(+ #& **1- q !$##A&)$$Q'*r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " SS5 r
\R " SSS S
9r S r g )
"GoogleCloudSecuritycenterV2Bindingi r r r GoogleCloudSecuritycenterV2Roler "GoogleCloudSecuritycenterV2Subjectr Tr r Nr r r1 r2 r r sR
q !$ Q " A1 E$
#
#$H!VZ
[(r1 r c \ rS rSrSrSrg)3GoogleCloudSecuritycenterV2BulkMuteFindingsResponsei r r Nr r r1 r2 r r r r1 r c : \ rS rSrSr\R " SSS9rSrg)%GoogleCloudSecuritycenterV2Chokepointi r1 r Tr r Nr2 r r1 r2 r r r4 r1 r c \ rS rSrSr\R " SS5 r\R " SS5 r\R " S5 r
\R " SS 5 r \R " S
S 5 r \R " S 5 r
S
rg)%GoogleCloudSecuritycenterV2CloudArmori r7 rp r r~ r r #GoogleCloudSecuritycenterV2Requestsr )GoogleCloudSecuritycenterV2SecurityPolicyr r r Nr: r r1 r2 r r sx * !--.]_`a ! !"Eq I&
"
"1
%(
#
#$I1
M( ))*UWXY.&&q),r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r \R " S\R R S 9rS
rg ) 'GoogleCloudSecuritycenterV2CloudControli rB c $ \ rS rSrSrSrSrSrSrg);GoogleCloudSecuritycenterV2CloudControl.TypeValueValuesEnumi rE r r r r NrF r r1 r2 r r rJ r1 r r r r r r} r NrK r r1 r2 r r rN r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SSSS 9r \R " SS
5 r
S rg )
.GoogleCloudSecuritycenterV2CloudDlpDataProfilei rQ c $ \ rS rSrSrSrSrSrSrg)HGoogleCloudSecuritycenterV2CloudDlpDataProfile.ParentTypeValueValuesEnumi* rT r r r r NrU r r1 r2 rY r * rZ r1 rY r #GoogleCloudSecuritycenterV2InfoTyper Tr r r Nr\ r r1 r2 r r sR
)..
%%a(+$$%JAX\])""#>B*r1 r c \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r \R " S5 r Sr
g) -GoogleCloudSecuritycenterV2CloudDlpInspectioni; rb r r r r r Nrc r r1 r2 r r ; ri r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) ,GoogleCloudSecuritycenterV2CloudLoggingEntryiR ar Metadata taken from a [Cloud Logging LogEntry](https://cloud.google.com/
logging/docs/reference/v2/rest/v2/LogEntry)
Fields:
insertId: A unique identifier for the log entry.
logId: The type of the log (part of `log_name`. `log_name` is the resource
name of the log to which this log entry belongs). For example:
`cloudresourcemanager.googleapis.com/activity` Note that this field is
not URL-encoded, unlike in `LogEntry`.
resourceContainer: The organization, folder, or project of the monitored
resource that produced this log entry.
timestamp: The time the event described by the log entry occurred.
r r r r r Nrl r r1 r2 r r R rq r1 r c \ rS rSrSr\R " SSS9r\R " S5 r\R " S5 r Sr
g )
%GoogleCloudSecuritycenterV2Complianceig rt r Tr r r r Nru r r1 r2 r r g rx r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " SS SS9r
S
r g ) ,GoogleCloudSecuritycenterV2ComplianceDetailsiw r{ r r r Tr $GoogleCloudSecuritycenterV2Frameworkr r Nr} r r1 r2 r r w sF ''(QSTU, ) 5 5a$ G %%&LaZ^_*r1 r c D \ rS rSrSr " S S\R 5 r\R " S5 r \R " S\R R S9r
\R " SS5 r\R " S 5 r\R " S
\R R S9rS rg )
%GoogleCloudSecuritycenterV2Connectioni r c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) =GoogleCloudSecuritycenterV2Connection.ProtocolValueValuesEnumi r r r r r r r r Nr r r1 r2 r r r r1 r r r r} r r r r Nr r r1 r2 r r r r1 r c < \ rS rSrSr\R " S5 rSrg)"GoogleCloudSecuritycenterV2Contacti r r r Nr r r1 r2 r r r r1 r c < \ rS rSrSr\R " SSSS9rSrg) )GoogleCloudSecuritycenterV2ContactDetailsi r r r Tr r Nr r r1 r2 r r s
#
#$H!VZ
[(r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " SSSS9r
\R " S 5 r \R " S
5 r S r
g )
$GoogleCloudSecuritycenterV2Containeri r r r GoogleCloudSecuritycenterV2Labelr Tr r r r Nr r r1 r2 r r s_ $$Q'* ! !! $' ! !"DaRV W& q !$ a #r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)"GoogleCloudSecuritycenterV2Controli r r r r Nr r r1 r2 r r r r1 r c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " S 5 r \R " SS
5 r\R " S 5 r\R " S 5 r\R " SS
5 r\R$ " S5 r\R " SSSS9r\R$ " S5 r\R$ " S5 rSrg) GoogleCloudSecuritycenterV2Cvei r c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) BGoogleCloudSecuritycenterV2Cve.ExploitationActivityValueValuesEnumi r r r r r r r r Nr r r1 r2 r r r r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
4GoogleCloudSecuritycenterV2Cve.ImpactValueValuesEnumi r r r r r r r Nr r r1 r2 r r r r1 r !GoogleCloudSecuritycenterV2Cvssv3r r r r r r r $GoogleCloudSecuritycenterV2Referencer Tr r r r Nr r r1 r2 r r s <INN &inn * ! !"Eq I& ,,Q/",,-RTUV#//2 Q " 6 :& ,,Q/%%&LaZ^_*"//2 " "2 &'r1 r c \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S
\R 5 r
" S S \R 5 r " S
S\R 5 r " S S\R 5 r
" S S\R 5 r\R " SS5 r\R " SS5 r\R " SS5 r\R& " S5 r\R " S
S5 r\R " S S5 r\R " SS5 r\R " SS5 r\R " SS5 rS rg ) r i: r c $ \ rS rSrSrSrSrSrSrg)AGoogleCloudSecuritycenterV2Cvssv3.AttackComplexityValueValuesEnumiq r r r r r Nr r r1 r2 r r q r r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
=GoogleCloudSecuritycenterV2Cvssv3.AttackVectorValueValuesEnumi r r r r r r r Nr r r1 r2 r r r r1 r c ( \ rS rSrSrSrSrSrSrSr g) CGoogleCloudSecuritycenterV2Cvssv3.AvailabilityImpactValueValuesEnumi r r r r r r Nr r r1 r2 r r r r1 r c ( \ rS rSrSrSrSrSrSrSr g) FGoogleCloudSecuritycenterV2Cvssv3.ConfidentialityImpactValueValuesEnumi r r r r r r Nr r r1 r2 r r r r1 r c ( \ rS rSrSrSrSrSrSrSr g) @GoogleCloudSecuritycenterV2Cvssv3.IntegrityImpactValueValuesEnumi r r r r r r Nr r r1 r2 r r r r1 r c ( \ rS rSrSrSrSrSrSrSr g) CGoogleCloudSecuritycenterV2Cvssv3.PrivilegesRequiredValueValuesEnumi r r r r r r Nr r r1 r2 r
r r r1 r
c $ \ rS rSrSrSrSrSrSrg)6GoogleCloudSecuritycenterV2Cvssv3.ScopeValueValuesEnumi r r r r r Nr r r1 r2 r r r r1 r c $ \ rS rSrSrSrSrSrSrg)@GoogleCloudSecuritycenterV2Cvssv3.UserInteractionValueValuesEnumi r r r r r Nr r r1 r2 r r r r1 r r r r r r r r r r r Nr r r1 r2 r r : r( r1 r c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
GoogleCloudSecuritycenterV2Cwei r+ r r r Tr r Nr, r r1 r2 r r s/ Q "%%&LaZ^_*r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r \R " S5 r
S rg
) *GoogleCloudSecuritycenterV2DataAccessEventi r/ c ( \ rS rSrSrSrSrSrSrSr g) CGoogleCloudSecuritycenterV2DataAccessEvent.OperationValueValuesEnumi- r2 r r r r r Nr3 r r1 r2 r8 r - r9 r1 r8 r r r r r Nr: r r1 r2 r r r> r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r \R " S5 r
\R " S 5 rS
rg ) (GoogleCloudSecuritycenterV2DataFlowEventiA rA c ( \ rS rSrSrSrSrSrSrSr g) AGoogleCloudSecuritycenterV2DataFlowEvent.OperationValueValuesEnumiV rD r r r r r Nr3 r r1 r2 r8 r V r9 r1 r8 r r r r r r NrE r r1 r2 r r A rG r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r \R " SS5 r
\R " S5 rS rg
) 5GoogleCloudSecuritycenterV2DataRetentionDeletionEventik rJ c ( \ rS rSrSrSrSrSrSrSr g) NGoogleCloudSecuritycenterV2DataRetentionDeletionEvent.EventTypeValueValuesEnumi rM r r r r r NrN r r1 r2 rS r rT r1 rS r r r r r NrU r r1 r2 r r k rZ r1 r c \ rS rSrSr\R " S5 r\R " SSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r S r
g )
#GoogleCloudSecuritycenterV2Databasei r] r r Tr r r r r r Nr^ r r1 r2 r r ra r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)"GoogleCloudSecuritycenterV2Dataseti a[ Vertex AI dataset associated with the finding.
Fields:
displayName: The user defined display name of dataset, e.g. plants-dataset
name: Resource name of the dataset, e.g.
projects/{project}/locations/{location}/datasets/2094040236064505856
source: Data source, such as a BigQuery source URI, e.g. bq://scc-nexus-
test.AIPPtest.gsod
r r r r Nrd r r1 r2 r r re r1 r c < \ rS rSrSr\R " SSSS9rSrg) !GoogleCloudSecuritycenterV2Deniedi rh ry r Tr r Nro r r1 r2 r r rz r1 r c ` \ rS rSrSr\R " S5 r\R " S5 r Sr
g)$GoogleCloudSecuritycenterV2Detectioni rk r r r Nrl r r1 r2 r r ro r1 r c < \ rS rSrSr\R " S5 rSrg) GoogleCloudSecuritycenterV2Diski rr r r Nrs r r1 r2 r r rt r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)#GoogleCloudSecuritycenterV2DiskPathi rw r r r Nrx r r1 r2 r r r{ r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g),GoogleCloudSecuritycenterV2DynamicMuteRecordi r~ r r r Nr r r1 r2 r r r r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g).GoogleCloudSecuritycenterV2EnvironmentVariablei r r r r Nr r r1 r2 r r r r1 r c ^ \ rS rSrSr\R " SSS9r\R " S5 rSr g) (GoogleCloudSecuritycenterV2ExfilResourcei# r r Tr r r Nr r r1 r2 r r # r r1 r c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S5 r
S r g
) 'GoogleCloudSecuritycenterV2Exfiltrationi4 r r r Tr r r r Nr r r1 r2 r r 4 sF
" "#Mq[_ `' " "#Mq[_ `'#003r1 r c \ rS rSrSr\R " SSS9r\R " S5 r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r \R " S 5 r
\R " S 5 r\R " S
5 r\R " S5 r\R" " SS5 rSrg))GoogleCloudSecuritycenterV2ExternalSystemiI a Representation of third party SIEM/SOAR fields within SCC.
Fields:
assignees: References primary/secondary etc assignees in the external
system.
caseCloseTime: The time when the case was closed, as reported by the
external system.
caseCreateTime: The time when the case was created, as reported by the
external system.
casePriority: The priority of the finding's corresponding case in the
external system.
caseSla: The SLA of the finding's corresponding case in the external
system.
caseUri: The link to the finding's corresponding case in the external
system.
externalSystemUpdateTime: The time when the case was last updated, as
reported by the external system.
externalUid: The identifier that's used to track the finding's
corresponding case in the external system.
name: Full resource name of the external system. The following list shows
some examples: +
`organizations/1234/sources/5678/findings/123456/externalSystems/jira` +
`organizations/1234/sources/5678/locations/us/findings/123456/externalSy
stems/jira` +
`folders/1234/sources/5678/findings/123456/externalSystems/jira` + `fold
ers/1234/sources/5678/locations/us/findings/123456/externalSystems/jira`
+ `projects/1234/sources/5678/findings/123456/externalSystems/jira` + `p
rojects/1234/sources/5678/locations/us/findings/123456/externalSystems/j
ira`
status: The most recent status of the finding's corresponding case, as
reported by the external system.
ticketInfo: Information about the ticket, if any, that is being used to
track the resolution of the issue that is identified by this finding.
r Tr r r r r r r r r r %GoogleCloudSecuritycenterV2TicketInfor r Nr r r1 r2 r r I s !F ##A5)''*- ((+.&&q), ! !! $' ! !! $' & 2 21 5%%a(+ q !$ $&%%&MrR*r1 r c : \ rS rSrSr\R " S5 r\R " SS5 r \R " S5 r \R " SSS S
9r \R " S 5 r\R " S 5 r\R " S
5 r\R " S5 rSrg) GoogleCloudSecuritycenterV2Fileiz r r r r r (GoogleCloudSecuritycenterV2FileOperationr Tr r r r r r Nr r r1 r2 r r z s $
"
"1
%(
#
#$I1
M(%%a(*%%&PRS^bc* **1-/ q !$ #& "$r1 r c h \ rS rSrSr " S S\R 5 r\R " SS5 r Sr
g)r i r c 0 \ rS rSrSrSrSrSrSrSr Sr
S r g
) S?5 r+\R0 " S@5 r,\R" " SASB5 r-\R" " SSC5 r.\R0 " SD5 r/\R" " SESFS,S-9r0\Rb " SSG5 r2\R" " SHSIS,S-9r3\R" " SJSKS,S-9r4\R" " SLSM5 r5\R" " SNSO5 r6\R" " SPSQ5 r7\R" " SRSS5 r8\R" " STSU5 r9\R" " SVSWS,S-9r:\R" " SXSYS,S-9r;\R" " SZS[5 r<\R0 " S\5 r=\Rb " SS]5 r>\R" " S^S_5 r?\R0 " S`5 r@\R0 " Sa5 rA\R0 " Sb5 rB\R" " ScSdS,S-9rC\R0 " Se5 rD\R" " SfSg5 rE\R" " ShSiS,S-9rF\R0 " Sj5 rG\R0 " Sk5 rH\R" " SlSmS,S-9rI\R0 " Sn5 rJ\R" " SoSp5 rK\R" " SqSr5 rL\Rb " SSs5 rM\R" " SSt5 rN\Rb " S
Su5 rO\R" " SvSw5 rP\R" " SxSy5 rQ\R" " SzS{5 rRS|rSg})~"GoogleCloudSecuritycenterV2Findingi a , Security Command Center finding. A finding is a record of assessment
data like security, risk, health, or privacy, that is ingested into Security
Command Center for presentation, notification, analysis, policy testing, and
enforcement. For example, a cross-site scripting (XSS) vulnerability in an
App Engine application is a finding.
Enums:
FindingClassValueValuesEnum: The class of the finding.
MuteValueValuesEnum: Indicates the mute state of a finding (either muted,
unmuted or undefined). Unlike other attributes of a finding, a finding
provider shouldn't set the value of mute.
SeverityValueValuesEnum: The severity of the finding. This field is
managed by the source that writes the finding.
StateValueValuesEnum: Output only. The state of the finding.
Messages:
ContactsValue: Output only. Map containing the points of contact for the
given finding. The key represents the type of contact, while the value
contains a list of all the contacts that pertain. Please refer to:
https://cloud.google.com/resource-manager/docs/managing-notification-
contacts#notification-categories { "security": { "contacts": [ {
"email": "person1@company.com" }, { "email": "person2@company.com" } ] }
}
ExternalSystemsValue: Output only. Third party SIEM/SOAR fields within
SCC, contains external system information and external system finding
fields.
SourcePropertiesValue: Source specific properties. These properties are
managed by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
Fields:
access: Access details associated with the finding, such as more
information on the caller, which method was accessed, and from where.
affectedResources: AffectedResources associated with the finding.
aiModel: The AI model associated with the finding.
application: Represents an application associated with the finding.
attackExposure: The results of an attack path simulation relevant to this
finding.
backupDisasterRecovery: Fields related to Backup and DR findings.
canonicalName: Output only. The canonical name of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/locations/{location_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` + `projects/{project_id}/sources/{source_id}/locations/{loca
tion_id}/findings/{finding_id}` The prefix is the closest CRM ancestor
of the resource associated with the finding.
category: Immutable. The additional taxonomy group within findings from a
given source. Example: "XSS_FLASH_INJECTION"
chokepoint: Contains details about a chokepoint, which is a resource or
resource group where high-risk attack paths converge, based on [attack
path simulations] (https://cloud.google.com/security-command-
center/docs/attack-exposure-learn#attack_path_simulations). This field
cannot be updated. Its value is ignored in all update requests.
cloudArmor: Fields related to Cloud Armor findings.
cloudDlpDataProfile: Cloud DLP data profile that is associated with the
finding.
cloudDlpInspection: Cloud Data Loss Prevention (Cloud DLP) inspection
results that are associated with the finding.
complianceDetails: Details about the compliance implications of the
finding.
compliances: Contains compliance information for security standards
associated to the finding.
connections: Contains information about the IP connection associated with
the finding.
contacts: Output only. Map containing the points of contact for the given
finding. The key represents the type of contact, while the value
contains a list of all the contacts that pertain. Please refer to:
https://cloud.google.com/resource-manager/docs/managing-notification-
contacts#notification-categories { "security": { "contacts": [ {
"email": "person1@company.com" }, { "email": "person2@company.com" } ] }
}
containers: Containers associated with the finding. This field provides
information for both Kubernetes and non-Kubernetes containers.
createTime: Output only. The time at which the finding was created in
Security Command Center.
cryptoKeyName: Output only. The name of the Cloud KMS key used to encrypt
this finding, if any.
dataAccessEvents: Data access events associated with the finding.
dataFlowEvents: Data flow events associated with the finding.
dataRetentionDeletionEvents: Data retention deletion events associated
with the finding.
database: Database associated with the finding.
description: Contains more details about the finding.
disk: Disk associated with the finding.
eventTime: The time the finding was first detected. If an existing finding
is updated, then this is the time the update occurred. For example, if
the finding represents an open firewall, this property captures the time
the detector believes the firewall became open. The accuracy is
determined by the detector. If the finding is later resolved, then this
time reflects when the finding was resolved. This must not be set to a
value greater than the current timestamp.
exfiltration: Represents exfiltrations associated with the finding.
externalSystems: Output only. Third party SIEM/SOAR fields within SCC,
contains external system information and external system finding fields.
externalUri: The URI that, if available, points to a web page outside of
Security Command Center where additional information about the finding
can be found. This field is guaranteed to be either empty or a well
formed URL.
files: File associated with the finding.
findingClass: The class of the finding.
groupMemberships: Contains details about groups of which this finding is a
member. A group is a collection of findings that are related in some
way. This field cannot be updated. Its value is ignored in all update
requests.
iamBindings: Represents IAM bindings associated with the finding.
indicator: Represents what's commonly known as an *indicator of
compromise* (IoC) in computer forensics. This is an artifact observed on
a network or in an operating system that, with high confidence,
indicates a computer intrusion. For more information, see [Indicator of
compromise](https://en.wikipedia.org/wiki/Indicator_of_compromise).
ipRules: IP rules associated with the finding.
job: Job associated with the finding.
kernelRootkit: Signature of the kernel rootkit.
kubernetes: Kubernetes resources associated with the finding.
loadBalancers: The load balancers associated with the finding.
logEntries: Log entries that are relevant to the finding.
mitreAttack: MITRE ATT&CK tactics and techniques related to this finding.
See: https://attack.mitre.org
moduleName: Unique identifier of the module which generated the finding.
Example: folders/598186756061/securityHealthAnalyticsSettings/customModu
les/56799441161885
mute: Indicates the mute state of a finding (either muted, unmuted or
undefined). Unlike other attributes of a finding, a finding provider
shouldn't set the value of mute.
muteInfo: Output only. The mute information regarding this finding.
muteInitiator: Records additional information about the mute operation,
for example, the [mute configuration](https://cloud.google.com/security-
command-center/docs/how-to-mute-findings) that muted the finding and the
user who muted the finding.
muteUpdateTime: Output only. The most recent time this finding was muted
or unmuted.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
networks: Represents the VPC networks that the resource is attached to.
nextSteps: Steps to address the finding.
notebook: Notebook associated with the finding.
orgPolicies: Contains information about the org policies associated with
the finding.
parent: The relative resource name of the source and location the finding
belongs to. See: https://cloud.google.com/apis/design/resource_names#rel
ative_resource_name This field is immutable after creation time. The
following list shows some examples: +
`organizations/{organization_id}/sources/{source_id}` +
`folders/{folders_id}/sources/{source_id}` +
`projects/{projects_id}/sources/{source_id}` + `organizations/{organizat
ion_id}/sources/{source_id}/locations/{location_id}` +
`folders/{folders_id}/sources/{source_id}/locations/{location_id}` +
`projects/{projects_id}/sources/{source_id}/locations/{location_id}`
parentDisplayName: Output only. The human readable display name of the
finding source such as "Event Threat Detection" or "Security Health
Analytics".
processes: Represents operating system processes associated with the
Finding.
resourceName: Immutable. For findings on Google Cloud resources, the full
resource name of the Google Cloud resource this finding is for. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
When the finding is for a non-Google Cloud resource, the resourceName
can be a customer or partner defined string.
securityMarks: Output only. User specified security marks. These marks are
entirely managed by the user and come from the SecurityMarks resource
that belongs to the finding.
securityPosture: The security posture associated with the finding.
severity: The severity of the finding. This field is managed by the source
that writes the finding.
sourceProperties: Source specific properties. These properties are managed
by the source that writes the finding. The key names in the
source_properties map must be between 1 and 255 characters, and must
start with a letter and contain alphanumeric characters or underscores
only.
state: Output only. The state of the finding.
toxicCombination: Contains details about a group of security issues that,
when the issues occur together, represent a greater risk than when the
issues occur independently. A group of such issues is referred to as a
toxic combination. This field cannot be updated. Its value is ignored in
all update requests.
vertexAi: VertexAi associated with the finding.
vulnerability: Represents vulnerability-specific fields like CVE and CVSS
scores. CVE stands for Common Vulnerabilities and Exposures
(https://cve.mitre.org/about/)
c @ \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rg)>GoogleCloudSecuritycenterV2Finding.FindingClassValueValuesEnumiw a The class of the finding.
Values:
FINDING_CLASS_UNSPECIFIED: Unspecified finding class.
THREAT: Describes unwanted or malicious activity.
VULNERABILITY: Describes a potential weakness in software that increases
risk to Confidentiality & Integrity & Availability.
MISCONFIGURATION: Describes a potential weakness in cloud resource/asset
configuration that increases risk.
OBSERVATION: Describes a security observation that is for informational
purposes.
SCC_ERROR: Describes an error that prevents some SCC functionality.
POSTURE_VIOLATION: Describes a potential security risk due to a change
in the security posture.
TOXIC_COMBINATION: Describes a combination of security issues that
represent a more severe security problem when taken together.
SENSITIVE_DATA_RISK: Describes a potential security risk to data assets
that contain sensitive data.
CHOKEPOINT: Describes a resource or resource group where high risk
attack paths converge, based on attack path simulations (APS).
r r r r r r r r r r r Nr r r1 r2 r r w s@ * !"
FMKIJr1 r c ( \ rS rSrSrSrSrSrSrSr g) 6GoogleCloudSecuritycenterV2Finding.MuteValueValuesEnumi r r r r r r Nr r r1 r2 r r r r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
:GoogleCloudSecuritycenterV2Finding.SeverityValueValuesEnumi r r r r r r r Nr r r1 r2 r r r r1 r c $ \ rS rSrSrSrSrSrSrg)7GoogleCloudSecuritycenterV2Finding.StateValueValuesEnumi a Output only. The state of the finding.
Values:
STATE_UNSPECIFIED: Unspecified state.
ACTIVE: The finding requires attention and has not been addressed yet.
INACTIVE: The finding has been fixed, triaged as a non-issue or
otherwise addressed and is no longer active.
r r r r Nr r r1 r2 r r r r1 r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
0GoogleCloudSecuritycenterV2Finding.ContactsValuei r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)CGoogleCloudSecuritycenterV2Finding.ContactsValue.AdditionalPropertyi zAn additional property for a ContactsValue object.
Fields:
key: Name of the additional property.
value: A GoogleCloudSecuritycenterV2ContactDetails attribute.
r r r r Nr r r1 r2 r r r r1 r r Tr r Nr r r1 r2 r r s4 UY . . U %112FTXYr1 r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
7GoogleCloudSecuritycenterV2Finding.ExternalSystemsValuei r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)JGoogleCloudSecuritycenterV2Finding.ExternalSystemsValue.AdditionalPropertyi zAn additional property for a ExternalSystemsValue object.
Fields:
key: Name of the additional property.
value: A GoogleCloudSecuritycenterV2ExternalSystem attribute.
r r r r Nr r r1 r2 r r r r1 r r Tr r Nr r r1 r2 r r r r1 r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
8GoogleCloudSecuritycenterV2Finding.SourcePropertiesValuei r c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)KGoogleCloudSecuritycenterV2Finding.SourcePropertiesValue.AdditionalPropertyi- r r r r r Nr r r1 r2 r r - r r1 r r Tr r Nr r r1 r2 r r r r1 r rj r rr r rt r r| r r r r r r r r r r r r r r r r r r r Tr r r r r r r
r r r r r r r r r r
r r r r r
r r r r r *GoogleCloudSecuritycenterV2GroupMembershipr %GoogleCloudSecuritycenterV2IamBindingr $GoogleCloudSecuritycenterV2Indicatorr "GoogleCloudSecuritycenterV2IpRulesr GoogleCloudSecuritycenterV2Jobr (GoogleCloudSecuritycenterV2KernelRootkitr %GoogleCloudSecuritycenterV2Kubernetesr 'GoogleCloudSecuritycenterV2LoadBalancerr" #GoogleCloudSecuritycenterV2LogEntryr$ &GoogleCloudSecuritycenterV2MitreAttackr% r& r' #GoogleCloudSecuritycenterV2MuteInfor) r* r+ r, "GoogleCloudSecuritycenterV2Networkr. r/ #GoogleCloudSecuritycenterV2Notebookr1 $GoogleCloudSecuritycenterV2OrgPolicyr3 r4 r5 "GoogleCloudSecuritycenterV2Processr7 r8 (GoogleCloudSecuritycenterV2SecurityMarksr: *GoogleCloudSecuritycenterV2SecurityPosturer< r= r> r? +GoogleCloudSecuritycenterV2ToxicCombinationrA #GoogleCloudSecuritycenterV2VertexAirC (GoogleCloudSecuritycenterV2VulnerabilityrE r N)Tr r r r r! r" ra r r r r r r r r r r r% rF rG rH rI rJ rK r# rL rM rN rO rP rQ rR rS rT r rU r r rV rW rX rY r rZ r< r[ r\ r] r^ rb r_ r` ra rb rp rc rd re rf rg rh ri rj rl rm rn r9 ro rp rq rr r rs rt ru rv rw rx ry r rz r{ r| r0 r r1 r2 r
r
s ~@ INN BINN / / b Y^^ !!"89Zi'' Z :Z8 !!"89ZY . . Z :Z2 !!"89Zi / / Z :Z8 ! !"Eq I& ,,-[]^_ " "#G K'&&'OQRS+ ))*UWXY.$112eghi''*-
"
"1
%(%%&MqQ*%%&MrR*!../_acd --.]_ab ,,-[]_`&&'NPR]ab+&&'NPR]ab+
#
#OR
8(%%&Lb[_`*$$R(*''+- ++,XZ\gkl ))*TVXcgh. ) 6 67npr ~B !C
#
#$I2
N(%%b)+ A2 F$##B')''(QSUV, **+A2F/%%b)+
!BBQU
V%$$%BBG, ++,XZ\gkl&&'NPR]ab+$$%KRP) " "#G L' ?D#(()SUWX-%%&MrR*(()RTVaef-%%&KRZ^_*&&'OQST+$$R(* 2B 7$
#
#$I2
N(''+- ((,. r "$
#
#$H"W[
\(##B')
#
#$I2
N(&&'Mr\`a+ $& ++B/$$%I2X\])&&r*,(()SUWX- **+WY[\/
!:B
?( ++,CRH
4b
9% ++,Y[]^
#
#$I2
N((()SUWX-r1 r
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i{ r r r r Nr r r1 r2 r r { r r1 r c " \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SSSS 9r
\R " S
S SS 9r \R " S 5 r\R " S
5 r\R " SS5 rSrg)r i r c , \ rS rSrSrSrSrSrSrSr Sr
g )
EGoogleCloudSecuritycenterV2Framework.CategoryValueListEntryValuesEnumi r r r r r r r Nr r r1 r2 r r6 r r1 r c $ \ rS rSrSrSrSrSrSrg)8GoogleCloudSecuritycenterV2Framework.TypeValueValuesEnumi r r r r r Nr r r1 r2 r r8 r r1 r r Tr r r r r r r Nr r r1 r2 r r s . INN
!CQQU
V(
#
#$H!VZ
[(%%a(+ q !$ 2A 6$r1 r c < \ rS rSrSr\R " S5 rSrg)rk i r r r Nr r r1 r2 rk rk r r1 rk c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) r i Contains details about groups of which this finding is a member. A group
is a collection of findings that are related in some way.
Enums:
GroupTypeValueValuesEnum: Type of group.
Fields:
groupId: ID of the group.
groupType: Type of group.
c $ \ rS rSrSrSrSrSrSrg)CGoogleCloudSecuritycenterV2GroupMembership.GroupTypeValueValuesEnumi Type of group.
Values:
GROUP_TYPE_UNSPECIFIED: Default value.
GROUP_TYPE_TOXIC_COMBINATION: Group represents a toxic combination.
GROUP_TYPE_CHOKEPOINT: Group represents a chokepoint.
r r r r N r r r r r! GROUP_TYPE_UNSPECIFIED GROUP_TYPE_TOXIC_COMBINATIONGROUP_TYPE_CHOKEPOINTr0 r r1 r2 GroupTypeValueValuesEnumr= #$ r1 rC r r r N
r r r r r! r" ra rC r# groupIdrb groupTyper0 r r1 r2 r r <
! !! $'!!" r0 r r1 r2 r r $ s>
q !$ ++,Y[\] ! !! $'r1 r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ry i8 IP rule information.
Fields:
portRanges: Optional. An optional list of ports to which this rule
applies. This field is only applicable for the UDP or (S)TCP protocols.
Each entry must be either an integer or a range including a min and max
port number.
protocol: The IP protocol this rule applies to. This value can either be
one of the following well known protocol strings (TCP, UDP, ICMP, ESP,
AH, IPIP, SCTP) or a string representation of the integer value.
$GoogleCloudSecuritycenterV2PortRanger Tr r r N r r r r r! r" r%
portRangesr# r r0 r r1 r2 ry ry 8 s/
%%&LaZ^_*
"
"1
%(r1 ry c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " S S
S 9r \R " SS 5 r\R " S
S
S 9r\R " SS
S 9rSrg)r" iI IP rules associated with the finding.
Enums:
DirectionValueValuesEnum: The direction that the rule is applicable to,
one of ingress or egress.
Fields:
allowed: Tuple with allowed rules.
denied: Tuple with denied rules.
destinationIpRanges: If destination IP ranges are specified, the firewall
rule applies only to traffic that has a destination IP address in these
ranges. These ranges must be expressed in CIDR format. Only supports
IPv4.
direction: The direction that the rule is applicable to, one of ingress or
egress.
exposedServices: Name of the network protocol service, such as FTP, that
is exposed by the open port. Follows the naming convention available at:
https://www.iana.org/assignments/service-names-port-numbers/service-
names-port-numbers.xhtml.
sourceIpRanges: If source IP ranges are specified, the firewall rule
applies only to traffic that has a source IP address in these ranges.
These ranges must be expressed in CIDR format. Only supports IPv4.
c $ \ rS rSrSrSrSrSrSrg);GoogleCloudSecuritycenterV2IpRules.DirectionValueValuesEnumib The direction that the rule is applicable to, one of ingress or
egress.
Values:
DIRECTION_UNSPECIFIED: Unspecified direction value.
INGRESS: Ingress direction value.
EGRESS: Egress direction value.
r r r r N r r r r r! DIRECTION_UNSPECIFIEDINGRESSEGRESSr0 r r1 r2 DirectionValueValuesEnumrm b G
Fr1 rs rx r r r r Tr r r r r Nr r r r r! r" ra rs r% alloweddeniedr# destinationIpRangesrb directionexposedServicessourceIpRangesr0 r r1 r2 r" r" I s 0
" "#G K' ! !"Eq I&!--a$?!!" \ rS rSrSr\R " SS5 rSrg)r i zThe AWS metadata of a resource associated with an issue.
Fields:
account: The AWS account of the resource associated with the issue.
=GoogleCloudSecuritycenterV2IssueResourceAwsMetadataAwsAccountr r N) r r r r r! r" r% r r0 r r1 r2 r r s
" "#bde f'r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i zThe AWS account of the resource associated with the issue.
Fields:
id: The AWS account ID of the resource associated with the issue.
name: The AWS account name of the resource associated with the issue.
r r r Nr r r1 r2 r r r r1 r c > \ rS rSrSr\R " SS5 rSrg)r i zThe Azure metadata of a resource associated with an issue.
Fields:
subscription: The Azure subscription of the resource associated with the
issue.
FGoogleCloudSecuritycenterV2IssueResourceAzureMetadataAzureSubscriptionr r N) r r r r r! r" r% r r0 r r1 r2 r r s ''(prst,r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i zThe Azure subscription of the resource associated with the issue.
Fields:
displayName: The Azure subscription display name of the resource
associated with the issue.
id: The Azure subscription ID of the resource associated with the issue.
r r r Nr r r1 r2 r r r r1 r c < \ rS rSrSr\R " S5 rSrg)r i zGoogle Cloud metadata of a resource associated with an issue.
Fields:
projectId: The project ID that the resource associated with the issue
belongs to.
r r N) r r r r r! r" r# projectIdr0 r r1 r2 r r s ##A&)r1 r c d \ rS rSrSr\R " SS5 r\R " SS5 rSr g) r i zSecurity context associated with an issue.
Fields:
aggregatedCount: The aggregated count of the security context.
context: The context of the security context.
>GoogleCloudSecuritycenterV2IssueSecurityContextAggregatedCountr 6GoogleCloudSecuritycenterV2IssueSecurityContextContextr r N)
r r r r r! r" r% aggregatedCountcontextr0 r r1 r2 r r s1 **+kmno/ " "#[]^ _'r1 r c \ rS rSrSr\R " S5 r\R " S\R R S9r Sr g)r i zeAggregated count of a security context.
Fields:
key: Aggregation key.
value: Aggregation value.
r r r} r N)
r r r r r! r" r# r rM r r r r0 r r1 r2 r r s7 a #
I,=,=,C,C
D%r1 r c ^ \ rS rSrSr\R " S5 r\R " SSS9rSr g) r i zXContext of a security context.
Fields:
type: Context type.
values: Context values.
r r Tr r N)
r r r r r! r" r# r valuesr0 r r1 r2 r r s+
q !$ T 2&r1 r c \ rS rSrSr " S S\R 5 r\R " S\R R S9r \R " S5 r
\R " S5 r\R " SS 5 rS
rg ) r# i' Describes a job
Enums:
StateValueValuesEnum: Output only. State of the job, such as `RUNNING` or
`PENDING`.
Fields:
errorCode: Optional. If the job did not complete successfully, this field
describes why.
location: Optional. Gives the location where the job ran, such as `US` or
`europe-west1`
name: The fully-qualified name for a job. e.g. `projects//jobs/`
state: Output only. State of the job, such as `RUNNING` or `PENDING`.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
3GoogleCloudSecuritycenterV2Job.StateValueValuesEnumi7 I Output only. State of the job, such as `RUNNING` or `PENDING`.
Values:
JOB_STATE_UNSPECIFIED: Unspecified represents an unknown state and
should not be used.
PENDING: Job is scheduled and pending for run
RUNNING: Job in progress
SUCCEEDED: Job has completed with success
FAILED: Job has completed but with failure
r r r r r r N r r r r r! JOB_STATE_UNSPECIFIEDPENDINGRUNNING SUCCEEDEDFAILEDr0 r r1 r2 r r 7 # GGI
Fr1 r r r} r r r r Nr r r r r! r" ra r rM r r errorCoder# rg r9 rb r r0 r r1 r2 r# r# ' j
Y^^ " $$Q 0A0A0G0GH)
"
"1
%( q !$
4a
8%r1 r# c \ \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S5 r
\R " S 5 r\R " S
5 r\R " S 5 rS rg
)r$ iN Kernel mode rootkit signatures.
Fields:
name: Rootkit name, when available.
unexpectedCodeModification: True if unexpected modifications of kernel
code memory are present.
unexpectedFtraceHandler: True if `ftrace` points are present with
callbacks pointing to regions that are not in the expected kernel or
module code range.
unexpectedInterruptHandler: True if interrupt handlers that are are not in
the expected kernel or module code regions are present.
unexpectedKernelCodePages: True if kernel code pages that are not in the
expected kernel or module code regions are present.
unexpectedKprobeHandler: True if `kprobe` points are present with
callbacks pointing to regions that are not in the expected kernel or
module code range.
unexpectedProcessesInRunqueue: True if unexpected processes in the
scheduler run queue are present. Such processes are in the run queue,
but not in the process task list.
unexpectedReadOnlyDataModification: True if unexpected modifications of
kernel read-only data memory are present.
unexpectedSystemCallHandler: True if system call handlers that are are not
in the expected kernel or module code regions are present.
r r r r r r r r r r Nr r r r r! r" r# r9 rd unexpectedCodeModificationunexpectedFtraceHandlerunexpectedInterruptHandlerunexpectedKernelCodePagesunexpectedKprobeHandler unexpectedProcessesInRunqueue"unexpectedReadOnlyDataModificationunexpectedSystemCallHandlerr0 r r1 r2 r$ r$ N 2
q !$ ( 5 5a 8 % 2 21 5 ( 5 5a 8 ' 4 4Q 7 % 2 21 5"+"8"8"; '0'='=a'@$ ) 6 6q 9 r1 r$ c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S S
SS9r \R " S S SS9r
\R " S
SSS9r \R " SSSS9r \R " SSSS9r
Srg)r% is Kubernetes-related attributes.
Fields:
accessReviews: Provides information on any Kubernetes access reviews
(privilege checks) relevant to the finding.
bindings: Provides Kubernetes role binding information for findings that
involve [RoleBindings or
ClusterRoleBindings](https://cloud.google.com/kubernetes-
engine/docs/how-to/role-based-access-control).
nodePools: GKE [node pools](https://cloud.google.com/kubernetes-
engine/docs/concepts/node-pools) associated with the finding. This field
contains node pool information for each node, when it is available.
nodes: Provides Kubernetes [node](https://cloud.google.com/kubernetes-
engine/docs/concepts/cluster-architecture#nodes) information.
objects: Kubernetes objects related to the finding.
pods: Kubernetes [Pods](https://cloud.google.com/kubernetes-
engine/docs/concepts/pod) associated with the finding. This field
contains Pod records for each container that is owned by a Pod.
roles: Provides Kubernetes role information for findings that involve
[Roles or ClusterRoles](https://cloud.google.com/kubernetes-
engine/docs/how-to/role-based-access-control).
rn r Tr r r #GoogleCloudSecuritycenterV2NodePoolr GoogleCloudSecuritycenterV2Noder !GoogleCloudSecuritycenterV2Objectr GoogleCloudSecuritycenterV2Podr r r r Nr r r r r! r" r%
accessReviewsbindings nodePoolsnodesobjectspodsrolesr0 r r1 r2 r% r% s s . (()RTU`de-
#
#$H!VZ
[($$%JAX\])
!BAPT
U% " "#FTX Y' @!d S$
!BAPT
U%r1 r% c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i Represents a generic name-value label. A label has separate name and
value fields to support filtering with the `contains()` function. For more
information, see [Filtering on array-type
fields](https://cloud.google.com/security-command-center/docs/how-to-api-
list-findings#array-contains-filtering).
Fields:
name: Name of the label.
value: Value that corresponds to the label's name.
r r r N
r r r r r! r" r# r9 r r0 r r1 r2 r r )
q !$
"%r1 r c < \ rS rSrSr\R " S5 rSrg)r& i Contains information related to the load balancer associated with the
finding.
Fields:
name: The name of the load balancer associated with the finding.
r r Nrs r r1 r2 r& r&
q !$r1 r& c > \ rS rSrSr\R " SS5 rSrg)r' i rAn individual entry in a log.
Fields:
cloudLoggingEntry: An individual entry in a log stored in Cloud Logging.
r r r N r r r r r! r" r% cloudLoggingEntryr0 r r1 r2 r' r' s ,,-[]^_r1 r' c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
.GoogleCloudSecuritycenterV2MemoryHashSignaturei A signature corresponding to memory page hashes.
Fields:
binaryFamily: The binary family.
detections: The list of memory hash detections contributing to the binary
family match.
r r r Tr r N r r r r r! r" r# binaryFamilyr%
detectionsr0 r r1 r2 r r s/ &&q),%%&LaZ^_*r1 r c v \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S
\R 5 r
\R " SS S S
9r \R " SSS S
9r
\R " SS5 r\R " S
SS S
9r\R " S5 rSrg)r( i MITRE ATT&CK tactics and techniques related to this finding. See:
https://attack.mitre.org
Enums:
AdditionalTacticsValueListEntryValuesEnum:
AdditionalTechniquesValueListEntryValuesEnum:
PrimaryTacticValueValuesEnum: The MITRE ATT&CK tactic most closely
represented by this finding, if any.
PrimaryTechniquesValueListEntryValuesEnum:
Fields:
additionalTactics: Additional MITRE ATT&CK tactics related to this
finding, if any.
additionalTechniques: Additional MITRE ATT&CK techniques related to this
finding, if any, along with any of their respective parent techniques.
primaryTactic: The MITRE ATT&CK tactic most closely represented by this
finding, if any.
primaryTechniques: The MITRE ATT&CK technique most closely represented by
this finding, if any. primary_techniques is a repeated field because
there are multiple levels of MITRE ATT&CK techniques. If the technique
most closely represented by this finding is a sub-technique (e.g.
`SCANNING_IP_BLOCKS`), both the sub-technique and its parent
technique(s) will be listed (e.g. `SCANNING_IP_BLOCKS`,
`ACTIVE_SCANNING`).
version: The MITRE ATT&CK version referenced by the above fields. E.g.
"8".
c T \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrg)PGoogleCloudSecuritycenterV2MitreAttack.AdditionalTacticsValueListEntryValuesEnumi AdditionalTacticsValueListEntryValuesEnum enum type.
Values:
TACTIC_UNSPECIFIED: Unspecified value.
RECONNAISSANCE: TA0043
RESOURCE_DEVELOPMENT: TA0042
INITIAL_ACCESS: TA0001
EXECUTION: TA0002
PERSISTENCE: TA0003
PRIVILEGE_ESCALATION: TA0004
DEFENSE_EVASION: TA0005
CREDENTIAL_ACCESS: TA0006
DISCOVERY: TA0007
LATERAL_MOVEMENT: TA0008
COLLECTION: TA0009
COMMAND_AND_CONTROL: TA0011
EXFILTRATION: TA0010
IMPACT: TA0040
r r r r r r r r r r r r r r r r Nr r r r r! TACTIC_UNSPECIFIEDRECONNAISSANCERESOURCE_DEVELOPMENTINITIAL_ACCESS EXECUTION PERSISTENCEPRIVILEGE_ESCALATIONDEFENSE_EVASIONCREDENTIAL_ACCESS DISCOVERYLATERAL_MOVEMENT
COLLECTIONCOMMAND_AND_CONTROL EXFILTRATIONIMPACTr0 r r1 r2 )AdditionalTacticsValueListEntryValuesEnumr Z & N NIK OIJ L
Fr1 r. c D \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1S0r2S1r3S2r4S3r5S4r6S5r7S6r8S7r9S8r:S9r;S:rS=r?S>r@S?rAS@rBSArCSBrDSCrESDrFSErGSFrHSGrISHrJSIrKSJrLSKrMSLrNSMrOSNrPSOrQSPrRSQrSSRrTSSrUSTrVSUrWSVrXSWrYSXrZSYr[SZr\S[r]S\r^S]r_S^r`S_raS`rbSarcSbrdScreSdrfSergSfrhSgriShrjSirkSjrlSkrmSlrnSmroSnrpSorqSprrSqrsSrrtSsruStrvSurwSvrxSwrySxrzSyr{Szr|S{r}S|r~S}rS~rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrg)SGoogleCloudSecuritycenterV2MitreAttack.AdditionalTechniquesValueListEntryValuesEnumi AdditionalTechniquesValueListEntryValuesEnum enum type.
Values:
TECHNIQUE_UNSPECIFIED: Unspecified value.
DATA_OBFUSCATION: T1001
DATA_OBFUSCATION_STEGANOGRAPHY: T1001.002
OS_CREDENTIAL_DUMPING: T1003
OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM: T1003.007
OS_CREDENTIAL_DUMPING_ETC_PASSWORD_AND_ETC_SHADOW: T1003.008
DATA_FROM_LOCAL_SYSTEM: T1005
AUTOMATED_EXFILTRATION: T1020
OBFUSCATED_FILES_OR_INFO: T1027
STEGANOGRAPHY: T1027.003
COMPILE_AFTER_DELIVERY: T1027.004
COMMAND_OBFUSCATION: T1027.010
SCHEDULED_TRANSFER: T1029
SYSTEM_OWNER_USER_DISCOVERY: T1033
MASQUERADING: T1036
MATCH_LEGITIMATE_NAME_OR_LOCATION: T1036.005
BOOT_OR_LOGON_INITIALIZATION_SCRIPTS: T1037
STARTUP_ITEMS: T1037.005
NETWORK_SERVICE_DISCOVERY: T1046
SCHEDULED_TASK_JOB: T1053
SCHEDULED_TASK_JOB_CRON: T1053.003
CONTAINER_ORCHESTRATION_JOB: T1053.007
PROCESS_INJECTION: T1055
INPUT_CAPTURE: T1056
INPUT_CAPTURE_KEYLOGGING: T1056.001
PROCESS_DISCOVERY: T1057
COMMAND_AND_SCRIPTING_INTERPRETER: T1059
UNIX_SHELL: T1059.004
PYTHON: T1059.006
EXPLOITATION_FOR_PRIVILEGE_ESCALATION: T1068
PERMISSION_GROUPS_DISCOVERY: T1069
CLOUD_GROUPS: T1069.003
INDICATOR_REMOVAL: T1070
INDICATOR_REMOVAL_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS: T1070.002
INDICATOR_REMOVAL_CLEAR_COMMAND_HISTORY: T1070.003
INDICATOR_REMOVAL_FILE_DELETION: T1070.004
INDICATOR_REMOVAL_TIMESTOMP: T1070.006
INDICATOR_REMOVAL_CLEAR_MAILBOX_DATA: T1070.008
APPLICATION_LAYER_PROTOCOL: T1071
DNS: T1071.004
SOFTWARE_DEPLOYMENT_TOOLS: T1072
VALID_ACCOUNTS: T1078
DEFAULT_ACCOUNTS: T1078.001
LOCAL_ACCOUNTS: T1078.003
CLOUD_ACCOUNTS: T1078.004
FILE_AND_DIRECTORY_DISCOVERY: T1083
ACCOUNT_DISCOVERY_LOCAL_ACCOUNT: T1087.001
PROXY: T1090
EXTERNAL_PROXY: T1090.002
MULTI_HOP_PROXY: T1090.003
ACCOUNT_MANIPULATION: T1098
ADDITIONAL_CLOUD_CREDENTIALS: T1098.001
ADDITIONAL_CLOUD_ROLES: T1098.003
SSH_AUTHORIZED_KEYS: T1098.004
ADDITIONAL_CONTAINER_CLUSTER_ROLES: T1098.006
MULTI_STAGE_CHANNELS: T1104
INGRESS_TOOL_TRANSFER: T1105
NATIVE_API: T1106
BRUTE_FORCE: T1110
AUTOMATED_COLLECTION: T1119
SHARED_MODULES: T1129
DATA_ENCODING: T1132
STANDARD_ENCODING: T1132.001
ACCESS_TOKEN_MANIPULATION: T1134
TOKEN_IMPERSONATION_OR_THEFT: T1134.001
CREATE_ACCOUNT: T1136
LOCAL_ACCOUNT: T1136.001
DEOBFUSCATE_DECODE_FILES_OR_INFO: T1140
EXPLOIT_PUBLIC_FACING_APPLICATION: T1190
SUPPLY_CHAIN_COMPROMISE: T1195
COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS: T1195.001
EXPLOITATION_FOR_CLIENT_EXECUTION: T1203
USER_EXECUTION: T1204
EXPLOITATION_FOR_CREDENTIAL_ACCESS: T1212
LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION: T1222.002
DOMAIN_POLICY_MODIFICATION: T1484
DATA_DESTRUCTION: T1485
DATA_ENCRYPTED_FOR_IMPACT: T1486
SERVICE_STOP: T1489
INHIBIT_SYSTEM_RECOVERY: T1490
FIRMWARE_CORRUPTION: T1495
RESOURCE_HIJACKING: T1496
NETWORK_DENIAL_OF_SERVICE: T1498
CLOUD_SERVICE_DISCOVERY: T1526
STEAL_APPLICATION_ACCESS_TOKEN: T1528
ACCOUNT_ACCESS_REMOVAL: T1531
TRANSFER_DATA_TO_CLOUD_ACCOUNT: T1537
STEAL_WEB_SESSION_COOKIE: T1539
CREATE_OR_MODIFY_SYSTEM_PROCESS: T1543
EVENT_TRIGGERED_EXECUTION: T1546
BOOT_OR_LOGON_AUTOSTART_EXECUTION: T1547
KERNEL_MODULES_AND_EXTENSIONS: T1547.006
SHORTCUT_MODIFICATION: T1547.009
ABUSE_ELEVATION_CONTROL_MECHANISM: T1548
ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID: T1548.001
ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING: T1548.003
UNSECURED_CREDENTIALS: T1552
CREDENTIALS_IN_FILES: T1552.001
BASH_HISTORY: T1552.003
PRIVATE_KEYS: T1552.004
SUBVERT_TRUST_CONTROL: T1553
INSTALL_ROOT_CERTIFICATE: T1553.004
COMPROMISE_HOST_SOFTWARE_BINARY: T1554
CREDENTIALS_FROM_PASSWORD_STORES: T1555
MODIFY_AUTHENTICATION_PROCESS: T1556
PLUGGABLE_AUTHENTICATION_MODULES: T1556.003
MULTI_FACTOR_AUTHENTICATION: T1556.006
IMPAIR_DEFENSES: T1562
DISABLE_OR_MODIFY_TOOLS: T1562.001
INDICATOR_BLOCKING: T1562.006
DISABLE_OR_MODIFY_LINUX_AUDIT_SYSTEM: T1562.012
HIDE_ARTIFACTS: T1564
HIDDEN_FILES_AND_DIRECTORIES: T1564.001
HIDDEN_USERS: T1564.002
EXFILTRATION_OVER_WEB_SERVICE: T1567
EXFILTRATION_TO_CLOUD_STORAGE: T1567.002
DYNAMIC_RESOLUTION: T1568
LATERAL_TOOL_TRANSFER: T1570
HIJACK_EXECUTION_FLOW: T1574
HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING: T1574.006
MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE: T1578
CREATE_SNAPSHOT: T1578.001
CLOUD_INFRASTRUCTURE_DISCOVERY: T1580
DEVELOP_CAPABILITIES: T1587
DEVELOP_CAPABILITIES_MALWARE: T1587.001
OBTAIN_CAPABILITIES: T1588
OBTAIN_CAPABILITIES_MALWARE: T1588.001
OBTAIN_CAPABILITIES_VULNERABILITIES: T1588.006
ACTIVE_SCANNING: T1595
SCANNING_IP_BLOCKS: T1595.001
STAGE_CAPABILITIES: T1608
UPLOAD_MALWARE: T1608.001
CONTAINER_ADMINISTRATION_COMMAND: T1609
DEPLOY_CONTAINER: T1610
ESCAPE_TO_HOST: T1611
CONTAINER_AND_RESOURCE_DISCOVERY: T1613
REFLECTIVE_CODE_LOADING: T1620
STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES: T1649
FINANCIAL_THEFT: T1657
r r r r r r r r r r r r r r r r r r r
r r r r r r
r r r
r r r r r r r r r r r r" r$ r% r& r' r) r* r+ r, r. r/ r1 r3 r4 r5 r7 r8 r: r< r= r> r? rA rC rE @ A B C D E F G H I J K L M N r5 P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k rB m n o p q r s t u v w x y z { rJ } ~ rR r Nr r r r r! TECHNIQUE_UNSPECIFIEDDATA_OBFUSCATION DATA_OBFUSCATION_STEGANOGRAPHYOS_CREDENTIAL_DUMPING%OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM1OS_CREDENTIAL_DUMPING_ETC_PASSWORD_AND_ETC_SHADOWDATA_FROM_LOCAL_SYSTEMAUTOMATED_EXFILTRATIONOBFUSCATED_FILES_OR_INFO
STEGANOGRAPHYCOMPILE_AFTER_DELIVERYCOMMAND_OBFUSCATIONSCHEDULED_TRANSFERSYSTEM_OWNER_USER_DISCOVERY MASQUERADING!MATCH_LEGITIMATE_NAME_OR_LOCATION$BOOT_OR_LOGON_INITIALIZATION_SCRIPTS
STARTUP_ITEMSNETWORK_SERVICE_DISCOVERYSCHEDULED_TASK_JOBSCHEDULED_TASK_JOB_CRONCONTAINER_ORCHESTRATION_JOBPROCESS_INJECTION
INPUT_CAPTUREINPUT_CAPTURE_KEYLOGGINGPROCESS_DISCOVERY!COMMAND_AND_SCRIPTING_INTERPRETER
UNIX_SHELLPYTHON%EXPLOITATION_FOR_PRIVILEGE_ESCALATIONPERMISSION_GROUPS_DISCOVERY CLOUD_GROUPSINDICATOR_REMOVAL0INDICATOR_REMOVAL_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS'INDICATOR_REMOVAL_CLEAR_COMMAND_HISTORY INDICATOR_REMOVAL_FILE_DELETIONINDICATOR_REMOVAL_TIMESTOMP$INDICATOR_REMOVAL_CLEAR_MAILBOX_DATAAPPLICATION_LAYER_PROTOCOLDNSSOFTWARE_DEPLOYMENT_TOOLSVALID_ACCOUNTSDEFAULT_ACCOUNTSLOCAL_ACCOUNTSCLOUD_ACCOUNTS FILE_AND_DIRECTORY_DISCOVERY ACCOUNT_DISCOVERY_LOCAL_ACCOUNTPROXYEXTERNAL_PROXYMULTI_HOP_PROXYACCOUNT_MANIPULATION ADDITIONAL_CLOUD_CREDENTIALSADDITIONAL_CLOUD_ROLESSSH_AUTHORIZED_KEYS"ADDITIONAL_CONTAINER_CLUSTER_ROLESMULTI_STAGE_CHANNELSINGRESS_TOOL_TRANSFER
NATIVE_API BRUTE_FORCEAUTOMATED_COLLECTIONSHARED_MODULES
DATA_ENCODINGSTANDARD_ENCODINGACCESS_TOKEN_MANIPULATION TOKEN_IMPERSONATION_OR_THEFTCREATE_ACCOUNT
LOCAL_ACCOUNT DEOBFUSCATE_DECODE_FILES_OR_INFO!EXPLOIT_PUBLIC_FACING_APPLICATIONSUPPLY_CHAIN_COMPROMISE6COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS!EXPLOITATION_FOR_CLIENT_EXECUTIONUSER_EXECUTION"EXPLOITATION_FOR_CREDENTIAL_ACCESS9LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATIONDOMAIN_POLICY_MODIFICATIONDATA_DESTRUCTIONDATA_ENCRYPTED_FOR_IMPACT SERVICE_STOPINHIBIT_SYSTEM_RECOVERYFIRMWARE_CORRUPTIONRESOURCE_HIJACKINGNETWORK_DENIAL_OF_SERVICECLOUD_SERVICE_DISCOVERY STEAL_APPLICATION_ACCESS_TOKENACCOUNT_ACCESS_REMOVAL TRANSFER_DATA_TO_CLOUD_ACCOUNTSTEAL_WEB_SESSION_COOKIE CREATE_OR_MODIFY_SYSTEM_PROCESSEVENT_TRIGGERED_EXECUTION!BOOT_OR_LOGON_AUTOSTART_EXECUTION KERNEL_MODULES_AND_EXTENSIONSSHORTCUT_MODIFICATION!ABUSE_ELEVATION_CONTROL_MECHANISM3ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID7ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHINGUNSECURED_CREDENTIALSCREDENTIALS_IN_FILES BASH_HISTORY PRIVATE_KEYSSUBVERT_TRUST_CONTROLINSTALL_ROOT_CERTIFICATE COMPROMISE_HOST_SOFTWARE_BINARY CREDENTIALS_FROM_PASSWORD_STORES MODIFY_AUTHENTICATION_PROCESS PLUGGABLE_AUTHENTICATION_MODULESMULTI_FACTOR_AUTHENTICATIONIMPAIR_DEFENSESDISABLE_OR_MODIFY_TOOLSINDICATOR_BLOCKING$DISABLE_OR_MODIFY_LINUX_AUDIT_SYSTEMHIDE_ARTIFACTS HIDDEN_FILES_AND_DIRECTORIES HIDDEN_USERS EXFILTRATION_OVER_WEB_SERVICE EXFILTRATION_TO_CLOUD_STORAGEDYNAMIC_RESOLUTIONLATERAL_TOOL_TRANSFERHIJACK_EXECUTION_FLOW.HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING#MODIFY_CLOUD_COMPUTE_INFRASTRUCTURECREATE_SNAPSHOT CLOUD_INFRASTRUCTURE_DISCOVERYDEVELOP_CAPABILITIES DEVELOP_CAPABILITIES_MALWAREOBTAIN_CAPABILITIESOBTAIN_CAPABILITIES_MALWARE#OBTAIN_CAPABILITIES_VULNERABILITIESACTIVE_SCANNINGSCANNING_IP_BLOCKSSTAGE_CAPABILITIESUPLOAD_MALWARE CONTAINER_ADMINISTRATION_COMMANDDEPLOY_CONTAINERESCAPE_TO_HOST CONTAINER_AND_RESOURCE_DISCOVERYREFLECTIVE_CODE_LOADING*STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATESFINANCIAL_THEFTr0 r r1 r2 ,AdditionalTechniquesValueListEntryValuesEnumr1 - N^ %&" ,-)895 M "$ L(*%+-(M " "$ M ! (*%J
F,.)"$ L794.0+&(#"$ +-(!#
C " NNN#% &(# ENO #% )+& JK NM " #% NM')$(*% =?:(*%N)+&@B=!# " L " %'" %'" ! &(# " (*%$&! (*%:<7>@; LL " &)#'*$$'!'*$"% O ! +.(N#& L$'!$'! 582*-'O%(" #& "% *-'O N'*$N'*$ !14.Or1 r c T \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrg)CGoogleCloudSecuritycenterV2MitreAttack.PrimaryTacticValueValuesEnumi# The MITRE ATT&CK tactic most closely represented by this finding, if
any.
Values:
TACTIC_UNSPECIFIED: Unspecified value.
RECONNAISSANCE: TA0043
RESOURCE_DEVELOPMENT: TA0042
INITIAL_ACCESS: TA0001
EXECUTION: TA0002
PERSISTENCE: TA0003
PRIVILEGE_ESCALATION: TA0004
DEFENSE_EVASION: TA0005
CREDENTIAL_ACCESS: TA0006
DISCOVERY: TA0007
LATERAL_MOVEMENT: TA0008
COLLECTION: TA0009
COMMAND_AND_CONTROL: TA0011
EXFILTRATION: TA0010
IMPACT: TA0040
r r r r r r r r r r r r r r r r Nr r r1 r2 PrimaryTacticValueValuesEnumr # Z ( N NIK OIJ L
Fr1 r c D \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1S0r2S1r3S2r4S3r5S4r6S5r7S6r8S7r9S8r:S9r;S:rS=r?S>r@S?rAS@rBSArCSBrDSCrESDrFSErGSFrHSGrISHrJSIrKSJrLSKrMSLrNSMrOSNrPSOrQSPrRSQrSSRrTSSrUSTrVSUrWSVrXSWrYSXrZSYr[SZr\S[r]S\r^S]r_S^r`S_raS`rbSarcSbrdScreSdrfSergSfrhSgriShrjSirkSjrlSkrmSlrnSmroSnrpSorqSprrSqrsSrrtSsruStrvSurwSvrxSwrySxrzSyr{Szr|S{r}S|r~S}rS~rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrg)PGoogleCloudSecuritycenterV2MitreAttack.PrimaryTechniquesValueListEntryValuesEnumiH PrimaryTechniquesValueListEntryValuesEnum enum type.
Values:
TECHNIQUE_UNSPECIFIED: Unspecified value.
DATA_OBFUSCATION: T1001
DATA_OBFUSCATION_STEGANOGRAPHY: T1001.002
OS_CREDENTIAL_DUMPING: T1003
OS_CREDENTIAL_DUMPING_PROC_FILESYSTEM: T1003.007
OS_CREDENTIAL_DUMPING_ETC_PASSWORD_AND_ETC_SHADOW: T1003.008
DATA_FROM_LOCAL_SYSTEM: T1005
AUTOMATED_EXFILTRATION: T1020
OBFUSCATED_FILES_OR_INFO: T1027
STEGANOGRAPHY: T1027.003
COMPILE_AFTER_DELIVERY: T1027.004
COMMAND_OBFUSCATION: T1027.010
SCHEDULED_TRANSFER: T1029
SYSTEM_OWNER_USER_DISCOVERY: T1033
MASQUERADING: T1036
MATCH_LEGITIMATE_NAME_OR_LOCATION: T1036.005
BOOT_OR_LOGON_INITIALIZATION_SCRIPTS: T1037
STARTUP_ITEMS: T1037.005
NETWORK_SERVICE_DISCOVERY: T1046
SCHEDULED_TASK_JOB: T1053
SCHEDULED_TASK_JOB_CRON: T1053.003
CONTAINER_ORCHESTRATION_JOB: T1053.007
PROCESS_INJECTION: T1055
INPUT_CAPTURE: T1056
INPUT_CAPTURE_KEYLOGGING: T1056.001
PROCESS_DISCOVERY: T1057
COMMAND_AND_SCRIPTING_INTERPRETER: T1059
UNIX_SHELL: T1059.004
PYTHON: T1059.006
EXPLOITATION_FOR_PRIVILEGE_ESCALATION: T1068
PERMISSION_GROUPS_DISCOVERY: T1069
CLOUD_GROUPS: T1069.003
INDICATOR_REMOVAL: T1070
INDICATOR_REMOVAL_CLEAR_LINUX_OR_MAC_SYSTEM_LOGS: T1070.002
INDICATOR_REMOVAL_CLEAR_COMMAND_HISTORY: T1070.003
INDICATOR_REMOVAL_FILE_DELETION: T1070.004
INDICATOR_REMOVAL_TIMESTOMP: T1070.006
INDICATOR_REMOVAL_CLEAR_MAILBOX_DATA: T1070.008
APPLICATION_LAYER_PROTOCOL: T1071
DNS: T1071.004
SOFTWARE_DEPLOYMENT_TOOLS: T1072
VALID_ACCOUNTS: T1078
DEFAULT_ACCOUNTS: T1078.001
LOCAL_ACCOUNTS: T1078.003
CLOUD_ACCOUNTS: T1078.004
FILE_AND_DIRECTORY_DISCOVERY: T1083
ACCOUNT_DISCOVERY_LOCAL_ACCOUNT: T1087.001
PROXY: T1090
EXTERNAL_PROXY: T1090.002
MULTI_HOP_PROXY: T1090.003
ACCOUNT_MANIPULATION: T1098
ADDITIONAL_CLOUD_CREDENTIALS: T1098.001
ADDITIONAL_CLOUD_ROLES: T1098.003
SSH_AUTHORIZED_KEYS: T1098.004
ADDITIONAL_CONTAINER_CLUSTER_ROLES: T1098.006
MULTI_STAGE_CHANNELS: T1104
INGRESS_TOOL_TRANSFER: T1105
NATIVE_API: T1106
BRUTE_FORCE: T1110
AUTOMATED_COLLECTION: T1119
SHARED_MODULES: T1129
DATA_ENCODING: T1132
STANDARD_ENCODING: T1132.001
ACCESS_TOKEN_MANIPULATION: T1134
TOKEN_IMPERSONATION_OR_THEFT: T1134.001
CREATE_ACCOUNT: T1136
LOCAL_ACCOUNT: T1136.001
DEOBFUSCATE_DECODE_FILES_OR_INFO: T1140
EXPLOIT_PUBLIC_FACING_APPLICATION: T1190
SUPPLY_CHAIN_COMPROMISE: T1195
COMPROMISE_SOFTWARE_DEPENDENCIES_AND_DEVELOPMENT_TOOLS: T1195.001
EXPLOITATION_FOR_CLIENT_EXECUTION: T1203
USER_EXECUTION: T1204
EXPLOITATION_FOR_CREDENTIAL_ACCESS: T1212
LINUX_AND_MAC_FILE_AND_DIRECTORY_PERMISSIONS_MODIFICATION: T1222.002
DOMAIN_POLICY_MODIFICATION: T1484
DATA_DESTRUCTION: T1485
DATA_ENCRYPTED_FOR_IMPACT: T1486
SERVICE_STOP: T1489
INHIBIT_SYSTEM_RECOVERY: T1490
FIRMWARE_CORRUPTION: T1495
RESOURCE_HIJACKING: T1496
NETWORK_DENIAL_OF_SERVICE: T1498
CLOUD_SERVICE_DISCOVERY: T1526
STEAL_APPLICATION_ACCESS_TOKEN: T1528
ACCOUNT_ACCESS_REMOVAL: T1531
TRANSFER_DATA_TO_CLOUD_ACCOUNT: T1537
STEAL_WEB_SESSION_COOKIE: T1539
CREATE_OR_MODIFY_SYSTEM_PROCESS: T1543
EVENT_TRIGGERED_EXECUTION: T1546
BOOT_OR_LOGON_AUTOSTART_EXECUTION: T1547
KERNEL_MODULES_AND_EXTENSIONS: T1547.006
SHORTCUT_MODIFICATION: T1547.009
ABUSE_ELEVATION_CONTROL_MECHANISM: T1548
ABUSE_ELEVATION_CONTROL_MECHANISM_SETUID_AND_SETGID: T1548.001
ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING: T1548.003
UNSECURED_CREDENTIALS: T1552
CREDENTIALS_IN_FILES: T1552.001
BASH_HISTORY: T1552.003
PRIVATE_KEYS: T1552.004
SUBVERT_TRUST_CONTROL: T1553
INSTALL_ROOT_CERTIFICATE: T1553.004
COMPROMISE_HOST_SOFTWARE_BINARY: T1554
CREDENTIALS_FROM_PASSWORD_STORES: T1555
MODIFY_AUTHENTICATION_PROCESS: T1556
PLUGGABLE_AUTHENTICATION_MODULES: T1556.003
MULTI_FACTOR_AUTHENTICATION: T1556.006
IMPAIR_DEFENSES: T1562
DISABLE_OR_MODIFY_TOOLS: T1562.001
INDICATOR_BLOCKING: T1562.006
DISABLE_OR_MODIFY_LINUX_AUDIT_SYSTEM: T1562.012
HIDE_ARTIFACTS: T1564
HIDDEN_FILES_AND_DIRECTORIES: T1564.001
HIDDEN_USERS: T1564.002
EXFILTRATION_OVER_WEB_SERVICE: T1567
EXFILTRATION_TO_CLOUD_STORAGE: T1567.002
DYNAMIC_RESOLUTION: T1568
LATERAL_TOOL_TRANSFER: T1570
HIJACK_EXECUTION_FLOW: T1574
HIJACK_EXECUTION_FLOW_DYNAMIC_LINKER_HIJACKING: T1574.006
MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE: T1578
CREATE_SNAPSHOT: T1578.001
CLOUD_INFRASTRUCTURE_DISCOVERY: T1580
DEVELOP_CAPABILITIES: T1587
DEVELOP_CAPABILITIES_MALWARE: T1587.001
OBTAIN_CAPABILITIES: T1588
OBTAIN_CAPABILITIES_MALWARE: T1588.001
OBTAIN_CAPABILITIES_VULNERABILITIES: T1588.006
ACTIVE_SCANNING: T1595
SCANNING_IP_BLOCKS: T1595.001
STAGE_CAPABILITIES: T1608
UPLOAD_MALWARE: T1608.001
CONTAINER_ADMINISTRATION_COMMAND: T1609
DEPLOY_CONTAINER: T1610
ESCAPE_TO_HOST: T1611
CONTAINER_AND_RESOURCE_DISCOVERY: T1613
REFLECTIVE_CODE_LOADING: T1620
STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES: T1649
FINANCIAL_THEFT: T1657
r r r r r r r r r r r r r r r r r r r
r r r r r r
r r r
r r r r r r r r r r r r" r$ r% r& r' r) r* r+ r, r. r/ r1 r3 r4 r5 r7 r8 r: r< r= r> r? rA rC rE r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA r5 rB rC rD rE rF rG rH rI rJ rK rL rM rN rO rP rQ rR rS rT rU rV rW rX rY rZ r[ r\ r] rB r^ r_ r` ra rb rc rd re rf rg rh ri rj rk rl rJ rm rn ro rp rq rr rs rt ru rR rv rw rx ry r Nrz r r1 r2 )PrimaryTechniquesValueListEntryValuesEnumr H r r1 r r Tr r r r r r Nr r r r r! r" ra r. r r r rb additionalTacticsadditionalTechniques
primaryTacticprimaryTechniquesr# r> r0 r r1 r2 r( r( 8").. "HZY^^ Zx#Y^^ #JZ).. Zx ))*UWXcgh",,-[]^imn%%&DaH- ))*UWXcgh ! !! $'r1 r( c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r \R " S 5 r
\R " S
5 r\R " S 5 r\R " SS 5 r\R " S
5 rSrg)%GoogleCloudSecuritycenterV2MuteConfigik a
A mute config is a Cloud SCC resource that contains the configuration to
mute create/update events of findings.
Enums:
TypeValueValuesEnum: Required. The type of the mute config, which
determines what type of mute state the config affects. Immutable after
creation.
Fields:
createTime: Output only. The time at which the mute config was created.
This field is set by the server and will be ignored if provided on
config creation.
cryptoKeyName: Output only. The resource name of the Cloud KMS `CryptoKey`
used to encrypt this configuration data, if CMEK was enabled during
Security Command Center activation.
description: A description of the mute config.
expiryTime: Optional. The expiry of the mute config. Only applicable for
dynamic configs. If the expiry is set, when the config expires, it is
removed from all findings.
filter: Required. An expression that defines the filter to apply across
create/update events of findings. While creating a filter string, be
mindful of the scope in which the mute configuration is being created.
E.g., If a filter contains project = X but is created under the project
= Y scope, it might not match any findings. The following field and
operator combinations are supported: * severity: `=`, `:` * category:
`=`, `:` * resource.name: `=`, `:` * resource.project_name: `=`, `:` *
resource.project_display_name: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.parent_name: `=`,
`:` * resource.parent_display_name: `=`, `:` * resource.type: `=`, `:` *
finding_class: `=`, `:` * indicator.ip_addresses: `=`, `:` *
indicator.domains: `=`, `:`
mostRecentEditor: Output only. Email address of the user who last edited
the mute config. This field is set by the server and will be ignored if
provided on config creation or update.
name: Identifier. This field will be ignored if provided on config
creation. The following list shows some examples of the format: +
`organizations/{organization}/muteConfigs/{mute_config}` + `organization
s/{organization}locations/{location}//muteConfigs/{mute_config}` +
`folders/{folder}/muteConfigs/{mute_config}` +
`folders/{folder}/locations/{location}/muteConfigs/{mute_config}` +
`projects/{project}/muteConfigs/{mute_config}` +
`projects/{project}/locations/{location}/muteConfigs/{mute_config}`
type: Required. The type of the mute config, which determines what type of
mute state the config affects. Immutable after creation.
updateTime: Output only. The most recent time at which the mute config was
updated. This field is set by the server and will be ignored if provided
on config creation or update.
c $ \ rS rSrSrSrSrSrSrg)9GoogleCloudSecuritycenterV2MuteConfig.TypeValueValuesEnumi a" Required. The type of the mute config, which determines what type of
mute state the config affects. Immutable after creation.
Values:
MUTE_CONFIG_TYPE_UNSPECIFIED: Unused.
STATIC: A static mute config, which sets the static mute state of future
matching findings to muted. Once the static mute state has been set,
finding or config modifications will not affect the state.
DYNAMIC: A dynamic mute config, which is applied to existing and future
matching findings, setting their dynamic mute state to "muted". If the
config is updated or deleted, or a matching finding is updated, such
that the finding doesn't match the config, the config will be removed
from the finding, and the finding's dynamic mute state may become
"unmuted" (unless other configs still match).
r r r r Nr r r1 r2 r r s $%
FGr1 r r r r r r r r r r r N)r r r r r! r" ra r r# r r r r r* r r9 rb r r r0 r r1 r2 r r k s /bINN ( $$Q'*''*-%%a(+$$Q'* #& **1- q !$ 2A 6$$$Q'*r1 r c b \ rS rSrSr\R " SSSS9r\R " SS5 rS r g
) r) i g Mute information about the finding, including whether the finding has a
static mute or any matching dynamic mute rules.
Fields:
dynamicMuteRecords: The list of dynamic mute rules that currently match
the finding.
staticMute: If set, the static mute applied to this finding. Static mutes
override dynamic mutes. If unset, there is no static mute.
r r Tr %GoogleCloudSecuritycenterV2StaticMuter r N
r r r r r! r" r% dynamicMuteRecords
staticMuter0 r r1 r2 r) r) s4 !--.\^_jno%%&MqQ*r1 r) c < \ rS rSrSr\R " S5 rSrg)r* i Contains information about a VPC network associated with the finding.
Fields:
name: The name of the VPC network resource, for example,
`//compute.googleapis.com/projects/my-project/global/networks/my-
network`.
r r Nrs r r1 r2 r* r* rt r1 r* c < \ rS rSrSr\R " S5 rSrg)r i Kubernetes nodes associated with the finding.
Fields:
name: [Full resource name](https://google.aip.dev/122#full-resource-names)
of the Compute Engine VM running the cluster node.
r r Nrs r r1 r2 r r r r1 r c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
r i |Provides GKE node pool information.
Fields:
name: Kubernetes node pool name.
nodes: Nodes associated with the finding.
r r r Tr r N r r r r r! r" r# r9 r% r r0 r r1 r2 r r s/
q !$
!BAPT
U%r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) r+ i Represents a Jupyter notebook IPYNB file, such as a [Colab Enterprise
notebook](https://cloud.google.com/colab/docs/introduction) file, that is
associated with a finding.
Fields:
lastAuthor: The user ID of the latest author to modify the notebook.
name: The name of the notebook.
notebookUpdateTime: The most recent time the notebook was updated.
service: The source notebook service, for example, "Colab Enterprise".
r r r r r N r r r r r! r" r#
lastAuthorr9 notebookUpdateTimer r0 r r1 r2 r+ r+ J $$Q'* q !$ ,,Q/ ! !! $'r1 r+ c \ rS rSrSr\R " SS5 r\R " S5 r \R " SS5 r
Sr g )
.GoogleCloudSecuritycenterV2NotificationMessagei r r
r r #GoogleCloudSecuritycenterV2Resourcer r Nr r r1 r2 r/ r/ s@
" "#G K'$003
#
#$I1
M(r1 r/ c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S5 r
\R " S 5 r \R " S
5 r S r
g )
r i Kubernetes object related to the finding, uniquely identified by GKNN.
Used if the object Kind is not one of Pod, Node, NodePool, Binding, or
AccessReview.
Fields:
containers: Pod containers associated with this finding, if any.
group: Kubernetes object group, such as "policy.k8s.io/v1".
kind: Kubernetes object kind, such as "Namespace".
name: Kubernetes object name. For details see
https://kubernetes.io/docs/concepts/overview/working-with-
objects/names/.
ns: Kubernetes object namespace. Must be a valid DNS label. Named "ns" to
avoid collision with C++ namespace keyword. For details see
https://kubernetes.io/docs/tasks/administer-cluster/namespaces/.
r r Tr r r r r r Nr r r r r! r" r% rU r# r8 kindr9 r: r0 r r1 r2 r r s_ %%&LaZ^_*
"% q !$ q !$ Q "r1 r c < \ rS rSrSr\R " S5 rSrg)r, i( zContains information about the org policies associated with the finding.
Fields:
name: Identifier. The resource name of the org policy. Example:
"organizations/{organization_id}/policies/{constraint_name}"
r r Nrs r r1 r2 r, r, ( r r1 r, c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) "GoogleCloudSecuritycenterV2Packagei3 - Package is a generic definition of a package.
Fields:
cpeUri: The CPE URI where the vulnerability was detected.
packageName: The name of the package where the vulnerability was detected.
packageType: Type of package, for example, os, maven, or go.
packageVersion: The version of the package.
r r r r r N r r r r r! r" r# cpeUri packageName packageTypepackageVersionr0 r r1 r2 r7 r7 3 I #&%%a(+%%a(+ ((+.r1 r7 c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)#GoogleCloudSecuritycenterV2PipelineiC a Vertex AI training pipeline associated with the finding.
Fields:
displayName: The user-defined display name of pipeline, e.g. plants-
classification
name: Resource name of the pipeline, e.g. projects/{project}/locations/{lo
cation}/trainingPipelines/5253428229225578496
r r r N
r r r r r! r" r# rd r9 r0 r r1 r2 r@ r@ C ) %%a(+ q !$r1 r@ c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S 5 r
\R " S
5 r S r g )
r iQ A Kubernetes Pod.
Fields:
containers: Pod containers associated with this finding, if any.
labels: Pod labels. For Kubernetes containers, these are applied to the
container.
name: Kubernetes Pod name.
ns: Kubernetes Pod namespace.
r r Tr r r r r r N
r r r r r! r" r% rU r r# r9 r: r0 r r1 r2 r r Q sU %%&LaZ^_* ! !"DaRV W& q !$ Q "r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)-GoogleCloudSecuritycenterV2PolicyDriftDetailsib The policy field that violates the deployed posture and its expected and
detected values.
Fields:
detectedValue: The detected value that violates the deployed posture, for
example, `false` or `allowed_values={"projects/22831892"}`.
expectedValue: The value of this field that was configured in a posture,
for example, `true` or `allowed_values={"projects/29831892"}`.
field: The name of the updated field, for example
constraint.implementation.policy_rules[0].enforce
r r r r N r r r r r! r" r#
detectedValue
expectedValuefieldr0 r r1 r2 rG rG b 9
''*-''*-
"%r1 rG c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)rg it A port range which is inclusive of the min and max values. Values are
between 0 and 2^16-1. The max can be equal / must be not smaller than the
min value. If min and max are equal this indicates that it is a single port.
Fields:
max: Maximum port value.
min: Minimum port value.
r r r N
r r r r r! r" rM maxminr0 r r1 r2 rg rg t ) q!# q!#r1 rg c \ rS rSrSr\R " SSS9r\R " S5 r \R " SS5 r \R " S S
SS9r \R " S 5 r
\R " SS SS9r\R " S
5 r\R " S5 r\R " S5 r\R " SS5 r\R " S5 rSrg)r- i Represents an operating system process.
Fields:
args: Process arguments as JSON encoded strings.
argumentsTruncated: True if `args` is incomplete.
binary: File information for the process executable.
envVariables: Process environment variables.
envVariablesTruncated: True if `env_variables` is incomplete.
libraries: File information for libraries loaded by the process.
name: The process name, as displayed in utilities like `top` and `ps`.
This name can be accessed through `/proc/[pid]/comm` and changed with
`prctl(PR_SET_NAME)`.
parentPid: The parent process ID.
pid: The process ID.
script: When the process represents the invocation of a script, `binary`
provides information about the interpreter, while `script` provides
information about the script file provided to the interpreter.
userId: The ID of the user that executed the process. E.g. If this is the
root user this will always be 0.
r Tr r r r r r r r r r r r r r Nr r r r r! r" r# argsrd argumentsTruncatedr% rm envVariablesenvVariablesTruncated librariesr9 rM parentPidpidscriptuserIdr0 r r1 r2 r- r- s *
q4 0$ --a0 ! !"CQ G&''(XZ[fjk,#003$$%FTXY) q !$$$Q') q!# ! !"CR H& ! !" %&r1 r- c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r \R " SS 5 r S
r
g ) rZ i Indicates what signature matched this process.
Enums:
SignatureTypeValueValuesEnum: Describes the type of resource associated
with the signature.
Fields:
memoryHashSignature: Signature indicating that a binary family was
matched.
signatureType: Describes the type of resource associated with the
signature.
yaraRuleSignature: Signature indicating that a YARA rule was matched.
c $ \ rS rSrSrSrSrSrSrg)HGoogleCloudSecuritycenterV2ProcessSignature.SignatureTypeValueValuesEnumi Describes the type of resource associated with the signature.
Values:
SIGNATURE_TYPE_UNSPECIFIED: The default signature type.
SIGNATURE_TYPE_PROCESS: Used for signatures concerning processes.
SIGNATURE_TYPE_FILE: Used for signatures concerning disks.
r r r r N r r r r r! SIGNATURE_TYPE_UNSPECIFIEDSIGNATURE_TYPE_PROCESSSIGNATURE_TYPE_FILEr0 r r1 r2 SignatureTypeValueValuesEnumrc "# r1 ri r r r ,GoogleCloudSecuritycenterV2YaraRuleSignaturer r Nr r r r r! r" ra ri r% memoryHashSignaturerb
signatureTypeyaraRuleSignaturer0 r r1 r2 rZ rZ sV
Y^^
"../_abc%%&DaH- ,,-[]^_r1 rZ c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i Additional Links
Fields:
source: Source of the reference e.g. NVD
uri: Uri for the mentioned source e.g. https://cve.mitre.org/cgi-
bin/cvename.cgi?name=CVE-2021-34527.
r r r N
r r r r r! r" r# r r r0 r r1 r2 r r ) #& a #r1 r c \ rS rSrSr\R " S\R R S9r \R " S\R R S9r
\R " S5 r \R " S\R R S9r
Srg )
r i Information about the requests relevant to the finding.
Fields:
longTermAllowed: Allowed RPS (requests per second) over the long term.
longTermDenied: Denied RPS (requests per second) over the long term.
ratio: For 'Increasing deny ratio', the ratio is the denied traffic
divided by the allowed traffic. For 'Allowed traffic spike', the ratio
is the allowed traffic in the short term divided by allowed traffic in
the long term.
shortTermAllowed: Allowed RPS (requests per second) in the short term.
r r} r r r r Nr r r r r! r" rM r r longTermAllowedlongTermDeniedrE ratioshortTermAllowedr0 r r1 r2 r r t
**1i6G6G6M6MN/ ))!Y5F5F5L5LM.
q
!% ++Ay7H7H7N7NOr1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " SS 5 r \R " S
5 r\R " S S 5 r\R " S
5 r\R " S5 r\R " SS5 r\R " S5 r\R " S5 r\R " S5 rSrg)r0 i a Information related to the Google Cloud resource.
Enums:
CloudProviderValueValuesEnum: Indicates which cloud provider the finding
is from.
Fields:
awsMetadata: The AWS metadata associated with the finding.
azureMetadata: The Azure metadata associated with the finding.
cloudProvider: Indicates which cloud provider the finding is from.
displayName: The human readable name of the resource.
gcpMetadata: The Google Cloud metadata associated with the finding.
location: The region or location of the service (if applicable).
name: The full resource name of the resource. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
resourcePath: Provides the path to the resource within the resource
hierarchy.
resourcePathString: A string representation of the resource path. For
Google Cloud, it has the format of `organizations/{organization_id}/fold
ers/{folder_id}/folders/{folder_id}/projects/{project_id}` where there
can be any number of folders. For AWS, it has the format of `org/{organi
zation_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/accou
nt/{account_id}` where there can be any number of organizational units.
For Azure, it has the format of `mg/{management_group_id}/mg/{management
_group_id}/subscription/{subscription_id}/rg/{resource_group_name}`
where there can be any number of management groups.
service: The service or resource provider associated with the resource.
type: The full resource type of the resource.
c ( \ rS rSrSrSrSrSrSrSr g) @GoogleCloudSecuritycenterV2Resource.CloudProviderValueValuesEnumi 7 Indicates which cloud provider the finding is from.
Values:
CLOUD_PROVIDER_UNSPECIFIED: The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM: The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES: The cloud provider is Amazon Web Services.
MICROSOFT_AZURE: The cloud provider is Microsoft Azure.
r r r r r Nr r r1 r2 r r~ r r1 r r r r r r r r r r r 'GoogleCloudSecuritycenterV2ResourcePathr r r r r Nr r r r r! r" ra r r% r r rb r r# rd gcpMetadatarg r9 r r r r r0 r r1 r2 r0 r0 s < Y^^ &&'OQRS+(()SUVW-%%&DaH-%%a(+&&}a8+
"
"1
%( q !$''(QSTU, ,,Q/ ! !" %' r "$r1 r0 c < \ rS rSrSr\R " SSSS9rSrg) r i Represents the path of resources leading up to the resource this finding
is about.
Fields:
nodes: The list of nodes that make the up resource path, ordered from
lowest level to highest level.
+GoogleCloudSecuritycenterV2ResourcePathNoder Tr r N r r r r r! r" r% r r0 r r1 r2 r r s
!NPQ\`
a%r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r Sr
g )
r i+ g A node within the resource path. Each node represents a resource within
the resource hierarchy.
Enums:
NodeTypeValueValuesEnum: The type of resource this node represents.
Fields:
displayName: The display name of the resource this node represents.
id: The ID of the resource this node represents.
nodeType: The type of resource this node represents.
c @ \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rg)CGoogleCloudSecuritycenterV2ResourcePathNode.NodeTypeValueValuesEnumi8 The type of resource this node represents.
Values:
RESOURCE_PATH_NODE_TYPE_UNSPECIFIED: Node type is unspecified.
GCP_ORGANIZATION: The node represents a Google Cloud organization.
GCP_FOLDER: The node represents a Google Cloud folder.
GCP_PROJECT: The node represents a Google Cloud project.
AWS_ORGANIZATION: The node represents an AWS organization.
AWS_ORGANIZATIONAL_UNIT: The node represents an AWS organizational unit.
AWS_ACCOUNT: The node represents an AWS account.
AZURE_MANAGEMENT_GROUP: The node represents an Azure management group.
AZURE_SUBSCRIPTION: The node represents an Azure subscription.
AZURE_RESOURCE_GROUP: The node represents an Azure resource group.
r r r r r r r r r r r Nr r r r r! #RESOURCE_PATH_NODE_TYPE_UNSPECIFIEDGCP_ORGANIZATION
GCP_FOLDER GCP_PROJECTAWS_ORGANIZATIONAWS_ORGANIZATIONAL_UNIT AWS_ACCOUNTAZURE_MANAGEMENT_GROUPAZURE_SUBSCRIPTIONAZURE_RESOURCE_GROUPr0 r r1 r2 NodeTypeValueValuesEnumr 8 B
+,'JK K r1 r r r r r Nr r r r r! r" ra r r# rd r rb nodeTyper0 r r1 r2 r r + L
4 %%a(+ Q "
!:A
>(r1 r c R \ rS rSrSr " S S\R 5 r " S S\R 5 r\ R " S5 " S S \R 5 5 r \R " SS
5 r\R " S 5 r\R " S 5 r\R " S
5 r\R& " S S5 r\R " S5 r\R " SS5 r\R " S5 r\R& " SS5 r\R " SSS9r\R " S5 rSrg)r iW aj
A resource value configuration (RVC) is a mapping configuration of
user's resources to resource values. Used in Attack path simulations.
Enums:
CloudProviderValueValuesEnum: Cloud provider this configuration applies to
ResourceValueValueValuesEnum: Resource value level this expression
represents Only required when there is no Sensitive Data Protection
mapping in the request
Messages:
ResourceLabelsSelectorValue: List of resource labels to search for,
evaluated with `AND`. For example, "resource_labels_selector": {"key":
"value", "env": "prod"} will match resources with labels "key": "value"
`AND` "env": "prod" https://cloud.google.com/resource-
manager/docs/creating-managing-labels
Fields:
cloudProvider: Cloud provider this configuration applies to
createTime: Output only. Timestamp this resource value configuration was
created.
description: Description of the resource value configuration.
name: Identifier. Name for the resource value configuration
resourceLabelsSelector: List of resource labels to search for, evaluated
with `AND`. For example, "resource_labels_selector": {"key": "value",
"env": "prod"} will match resources with labels "key": "value" `AND`
"env": "prod" https://cloud.google.com/resource-manager/docs/creating-
managing-labels
resourceType: Apply resource_value only to resources that match
resource_type. resource_type will be checked with `AND` of other
resources. For example, "storage.googleapis.com/Bucket" with
resource_value "HIGH" will apply "HIGH" value only to
"storage.googleapis.com/Bucket" resources.
resourceValue: Resource value level this expression represents Only
required when there is no Sensitive Data Protection mapping in the
request
scope: Project or folder to scope this configuration to. For example,
"project/456" would apply this configuration only to resources in
"project/456" scope and will be checked with `AND` of other resources.
sensitiveDataProtectionMapping: A mapping of the sensitivity on Sensitive
Data Protection finding to resource values. This mapping can only be
used in combination with a resource_type that is related to BigQuery,
e.g. "bigquery.googleapis.com/Dataset".
tagValues: Tag values combined with `AND` to check against. For Google
Cloud resources, they are tag value IDs in the form of "tagValues/123".
Example: `[ "tagValues/123", "tagValues/456", "tagValues/789" ]`
https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-
managing
updateTime: Output only. Timestamp this resource value configuration was
last updated.
c ( \ rS rSrSrSrSrSrSrSr g) KGoogleCloudSecuritycenterV2ResourceValueConfig.CloudProviderValueValuesEnumi r r r r r r Nr r r1 r2 r r r r1 r c , \ rS rSrSrSrSrSrSrSr Sr
g )
KGoogleCloudSecuritycenterV2ResourceValueConfig.ResourceValueValueValuesEnumi aE Resource value level this expression represents Only required when
there is no Sensitive Data Protection mapping in the request
Values:
RESOURCE_VALUE_UNSPECIFIED: Unspecific value
HIGH: High resource value
MEDIUM: Medium resource value
LOW: Low resource value
NONE: No resource value, e.g. ignore these resources
r r r r r r Nr r r1 r2 r r r; r1 r r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
JGoogleCloudSecuritycenterV2ResourceValueConfig.ResourceLabelsSelectorValuei a List of resource labels to search for, evaluated with `AND`. For
example, "resource_labels_selector": {"key": "value", "env": "prod"} will
match resources with labels "key": "value" `AND` "env": "prod"
https://cloud.google.com/resource-manager/docs/creating-managing-labels
Messages:
AdditionalProperty: An additional property for a
ResourceLabelsSelectorValue object.
Fields:
additionalProperties: Additional properties of type
ResourceLabelsSelectorValue
c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)]GoogleCloudSecuritycenterV2ResourceValueConfig.ResourceLabelsSelectorValue.AdditionalPropertyi r r r r Nr r r1 r2 r r r r1 r r Tr r Nr r r1 r2 r r r r1 r r r r r r r r r 9GoogleCloudSecuritycenterV2SensitiveDataProtectionMappingr r Tr r r Nr r r1 r2 r r W s 1f Y^^
Y^^
" !!"89ZI$5$5 Z :Z8 %%&DaH-$$Q'*%%a(+ q !$$112OQRS&&q),%%&DaH-
"%#,#9#9:uwx#y ##B6)$$R(*r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r Sr
g )
r i Kubernetes Role or ClusterRole.
Enums:
KindValueValuesEnum: Role type.
Fields:
kind: Role type.
name: Role name.
ns: Role namespace.
c $ \ rS rSrSrSrSrSrSrg)3GoogleCloudSecuritycenterV2Role.KindValueValuesEnumi Role type.
Values:
KIND_UNSPECIFIED: Role type is not specified.
ROLE: Kubernetes Role.
CLUSTER_ROLE: Kubernetes ClusterRole.
r r r r N r r r r r! KIND_UNSPECIFIEDROLE CLUSTER_ROLEr0 r r1 r2 KindValueValuesEnumr DLr1 r r r r r Nr r r r r! r" ra r rb r4 r# r9 r: r0 r r1 r2 r r L
INN
2A 6$ q !$ Q "r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)+GoogleCloudSecuritycenterV2SecurityBulletini SecurityBulletin are notifications of vulnerabilities of Google
products.
Fields:
bulletinId: ID of the bulletin corresponding to the vulnerability.
submissionTime: Submission time of this Security Bulletin.
suggestedUpgradeVersion: This represents a version that the cluster
receiving this notification should be upgraded to, based on its current
version. For example, 1.15.0
r r r r N r r r r r! r" r#
bulletinIdsubmissionTimesuggestedUpgradeVersionr0 r r1 r2 r r : $$Q'* ((+. % 1 1! 4r1 r c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 r \R " SS5 r
\R " S5 rS rg
) r. i a User specified security marks that are attached to the parent Security
Command Center resource. Security marks are scoped within a Security Command
Center organization -- they can be modified and viewed by all users who have
proper permissions on the organization.
Messages:
MarksValue: Mutable user specified security marks belonging to the parent
resource. Constraints are as follows: * Keys and values are treated as
case insensitive * Keys must be between 1 - 256 characters (inclusive) *
Keys must be letters, numbers, underscores, or dashes * Values have
leading and trailing whitespace trimmed, remaining characters must be
between 1 - 4096 characters (inclusive)
Fields:
canonicalName: The canonical name of the marks. The following list shows
some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks` +
`folders/{folder_id}/assets/{asset_id}/securityMarks` + `folders/{folder
_id}/sources/{source_id}/findings/{finding_id}/securityMarks` + `folders
/{folder_id}/sources/{source_id}/locations/{location}/findings/{finding_
id}/securityMarks` +
`projects/{project_number}/assets/{asset_id}/securityMarks` + `projects/
{project_number}/sources/{source_id}/findings/{finding_id}/securityMarks
` + `projects/{project_number}/sources/{source_id}/locations/{location}/
findings/{finding_id}/securityMarks`
marks: Mutable user specified security marks belonging to the parent
resource. Constraints are as follows: * Keys and values are treated as
case insensitive * Keys must be between 1 - 256 characters (inclusive) *
Keys must be letters, numbers, underscores, or dashes * Values have
leading and trailing whitespace trimmed, remaining characters must be
between 1 - 4096 characters (inclusive)
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
3GoogleCloudSecuritycenterV2SecurityMarks.MarksValuei. ra c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)FGoogleCloudSecuritycenterV2SecurityMarks.MarksValue.AdditionalPropertyi> rd r r r Nr r r1 r2 r r > r r1 r r Tr r Nr r r1 r2 re r . r r1 re r r r r Nrf r r1 r2 r. r. sl )V !!"89Z9$$ Z :Z8 ''*-
q
1% q !$r1 r. c \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r
Sr g)r iP Information about the [Google Cloud Armor security
policy](https://cloud.google.com/armor/docs/security-policy-overview)
relevant to the finding.
Fields:
name: The name of the Google Cloud Armor security policy, for example,
"my-security-policy".
preview: Whether or not the associated rule or policy is in preview mode.
type: The type of Google Cloud Armor security policy for example, 'backend
security policy', 'edge security policy', 'network edge security
policy', or 'always-on DDoS protection'.
r r r r N r r r r r! r" r# r9 rd previewr r0 r r1 r2 r r P 9
q !$ " "1 %' q !$r1 r c 8 \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " SSSS 9r \R " S
5 r \R " S 5 r
\R " S 5 r\R " S
5 rSrg)r/ ic a Represents a posture that is deployed on Google Cloud by the Security
Command Center Posture Management service. A posture contains one or more
policy sets. A policy set is a group of policies that enforce a set of
security rules on Google Cloud.
Fields:
changedPolicy: The name of the updated policy, for example,
`projects/{project_id}/policies/{constraint_name}`.
name: Name of the posture, for example, `CIS-Posture`.
policy: The ID of the updated policy, for example, `compute-policy-1`.
policyDriftDetails: The details about a change in an updated policy that
violates the deployed posture.
policySet: The name of the updated policy set, for example, `cis-
policyset`.
postureDeployment: The name of the posture deployment, for example,
`organizations/{org_id}/posturedeployments/{posture_deployment_id}`.
postureDeploymentResource: The project, folder, or organization on which
the posture is deployed, for example, `projects/{project_number}`.
revisionId: The version of the posture, for example, `c7cfa2a8`.
r r r rG r Tr r r r r r Nr r r r r! r" r#
changedPolicyr9 policyr% policyDriftDetails policySetpostureDeploymentpostureDeploymentResource
revisionIdr0 r r1 r2 r/ r/ c s * ''*- q !$ #& --.]_`kop##A&) ++A. ' 3 3A 6$$Q'*r1 r/ c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " SS5 r S r g
) r i a Resource value mapping for Sensitive Data Protection findings If any of
these mappings have a resource value that is not unspecified, the
resource_value field will be ignored when reading this configuration.
Enums:
HighSensitivityMappingValueValuesEnum: Resource value mapping for high-
sensitivity Sensitive Data Protection findings
MediumSensitivityMappingValueValuesEnum: Resource value mapping for
medium-sensitivity Sensitive Data Protection findings
Fields:
highSensitivityMapping: Resource value mapping for high-sensitivity
Sensitive Data Protection findings
mediumSensitivityMapping: Resource value mapping for medium-sensitivity
Sensitive Data Protection findings
c , \ rS rSrSrSrSrSrSrSr Sr
g )
_GoogleCloudSecuritycenterV2SensitiveDataProtectionMapping.HighSensitivityMappingValueValuesEnumi r9 r r r r r r Nr r r1 r2 r: r r; r1 r: c , \ rS rSrSrSrSrSrSrSr Sr
g )
aGoogleCloudSecuritycenterV2SensitiveDataProtectionMapping.MediumSensitivityMappingValueValuesEnumi r> r r r r r r Nr r r1 r2 r? r r; r1 r? r r r Nr@ r r1 r2 r r rC r1 r c h \ rS rSrSr " S S\R 5 r\R " SS5 r Sr
g)rb i Score is calculated from of all elements in the data profile. A higher
level means the data is more sensitive.
Enums:
ScoreValueValuesEnum: The sensitivity score applied to the resource.
Fields:
score: The sensitivity score applied to the resource.
c , \ rS rSrSrSrSrSrSrSr Sr
g )
@GoogleCloudSecuritycenterV2SensitivityScore.ScoreValueValuesEnumi The sensitivity score applied to the resource.
Values:
SENSITIVITY_SCORE_LEVEL_UNSPECIFIED: Unused.
SENSITIVITY_LOW: No sensitive information detected. The resource isn't
publicly accessible.
SENSITIVITY_UNKNOWN: Unable to determine sensitivity.
SENSITIVITY_MODERATE: Medium risk. Contains personally identifiable
information (PII), potentially sensitive data, or fields with free-
text data that are at a higher risk of having intermittent sensitive
data. Consider limiting access.
SENSITIVITY_HIGH: High risk. Sensitive personally identifiable
information (SPII) can be present. Exfiltration of data can lead to
user data loss. Re-identification of users might be possible. Consider
limiting usage and or removing SPII.
r r r r r r N r r r r r! #SENSITIVITY_SCORE_LEVEL_UNSPECIFIEDSENSITIVITY_LOWSENSITIVITY_UNKNOWNSENSITIVITY_MODERATESENSITIVITY_HIGHr0 r r1 r2 ScoreValueValuesEnumr & +,'O r1 r r r N r r r r r! r" ra r rb r r0 r r1 r2 rb rb , Y^^ .
4a
8%r1 rb c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)rl i Identity delegation history of an authenticated service account.
Fields:
principalEmail: The email address of a Google account.
principalSubject: A string representing the principal_subject associated
with the identity. As compared to `principal_email`, supports principals
that aren't associated with email addresses, such as third party
principals. For most identities, the format will be
`principal://iam.googleapis.com/{identity pool name}/subjects/{subject}`
except for some GKE identities (GKE_WORKLOAD, FREEFORM,
GKE_HUB_WORKLOAD) that are still in the legacy format
`serviceAccount:{identity pool name}[{subject}]`
r r r N
r r r r r! r" r# r( r) r0 r r1 r2 rl rl * ((+. **1-r1 rl c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) r i ; Information about the static mute state. A static mute state overrides
any dynamic mute rules that apply to this finding. The static mute state can
be set by a static mute rule or by muting the finding directly.
Enums:
StateValueValuesEnum: The static mute state. If the value is `MUTED` or
`UNMUTED`, then the finding's overall mute state will have the same
value.
Fields:
applyTime: When the static mute was applied.
state: The static mute state. If the value is `MUTED` or `UNMUTED`, then
the finding's overall mute state will have the same value.
c ( \ rS rSrSrSrSrSrSrSr g) :GoogleCloudSecuritycenterV2StaticMute.StateValueValuesEnumi The static mute state. If the value is `MUTED` or `UNMUTED`, then the
finding's overall mute state will have the same value.
Values:
MUTE_UNSPECIFIED: Unspecified.
MUTED: Finding has been muted.
UNMUTED: Finding has been unmuted.
UNDEFINED: Finding has never been muted/unmuted.
r r r r r Nr r r1 r2 r r
EGIr1 r r r r N
r r r r r! r" ra r r# applyTimerb r r0 r r1 r2 r r <
Y^^
##A&)
4a
8%r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r Sr
g )
r i Represents a Kubernetes subject.
Enums:
KindValueValuesEnum: Authentication type for the subject.
Fields:
kind: Authentication type for the subject.
name: Name for the subject.
ns: Namespace for the subject.
c ( \ rS rSrSrSrSrSrSrSr g) 6GoogleCloudSecuritycenterV2Subject.KindValueValuesEnumi" Authentication type for the subject.
Values:
AUTH_TYPE_UNSPECIFIED: Authentication is not specified.
USER: User with valid certificate.
SERVICEACCOUNT: Users managed by Kubernetes API with credentials stored
as secrets.
GROUP: Collection of users.
r r r r r N
r r r r r! AUTH_TYPE_UNSPECIFIEDUSERSERVICEACCOUNTGROUPr0 r r1 r2 r r " DN
Er1 r r r r r Nr r r1 r2 r r L
INN
2A 6$ q !$ Q "r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r S r
g
) r i6 $ Information about the ticket, if any, that is being used to track the
resolution of the issue that is identified by this finding.
Fields:
assignee: The assignee of the ticket in the ticket system.
description: The description of the ticket in the ticket system.
id: The identifier of the ticket in the ticket system.
status: The latest status of the ticket, as reported by the ticket system.
updateTime: The time when the ticket was last updated, as reported by the
ticket system.
uri: The link to the ticket in the ticket system.
r r r r r r r Nr r r r r! r" r# assigneer r r r r r0 r r1 r2 r r 6 i
"
"1
%(%%a(+ Q " #&$$Q'* a #r1 r c ^ \ rS rSrSr\R " S5 r\R " SSS9r Sr
g) r0 iL Contains details about a group of security issues that, when the issues
occur together, represent a greater risk than when the issues occur
independently. A group of such issues is referred to as a toxic combination.
Fields:
attackExposureScore: The [Attack exposure
score](https://cloud.google.com/security-command-center/docs/attack-
exposure-learn#attack_exposure_scores) of this toxic combination. The
score is a measure of how much this toxic combination exposes one or
more high-value resources to potential attack.
relatedFindings: List of resource names of findings associated with this
toxic combination. For example,
`organizations/123/sources/456/findings/789`.
r r Tr r N r r r r r! r" rE attackExposureScorer# r3 r0 r r1 r2 r0 r0 L ,
",,Q/ ))!d;/r1 r0 c ` \ rS rSrSr\R " SSSS9r\R " SSSS9rS r g
) r1 i` Vertex AI-related information associated with the finding.
Fields:
datasets: Datasets associated with the finding.
pipelines: Pipelines associated with the finding.
r r Tr r@ r r N
r r r r r! r" r% datasets pipelinesr0 r r1 r2 r1 r1 ` s5
#
#$H!VZ
[($$%JAX\])r1 r1 c \ rS rSrSr\R " SS5 r\R " SSSS9r\R " S S
5 r \R " S S 5 r
\R " S 5 r \R " S
5 r\R " SS5 rSrg)r2 il Refers to common vulnerability fields e.g. cve, cvss, cwe etc.
Fields:
cve: CVE stands for Common Vulnerabilities and Exposures
(https://cve.mitre.org/about/)
cwes: Represents one or more Common Weakness Enumeration (CWE) information
on this vulnerability.
fixedPackage: The fixed package is relevant to the finding.
offendingPackage: The offending package is relevant to the finding.
providerRiskScore: Provider provided risk_score based on multiple factors.
The higher the risk score, the more risky the vulnerability is.
reachable: Represents whether the vulnerability is reachable (detected via
static analysis)
securityBulletin: The security bulletin is relevant to this finding.
r r r r Tr r7 r r r r r r r Nr r r r r! r" r% r cwes fixedPackageoffendingPackagerM providerRiskScorerd reachabler r0 r r1 r2 r2 r2 l s ?C# @!d S$''(LaP, ++,PRST ,,Q/$$Q') ++,Y[\]r1 r2 c < \ rS rSrSr\R " S5 rSrg)rk i ZA signature corresponding to a YARA rule.
Fields:
yaraRule: The name of the YARA rule.
r r N r r r r r! r" r# yaraRuler0 r r1 r2 rk rk
"
"1
%(r1 rk c \ rS rSrSr\R " S5 r\R " S5 r\R " S\R R S9r \R " S5 r
Srg )
GroupFindingsRequesti a Request message for grouping by findings.
Fields:
filter: Expression that defines the filter to apply across findings. The
expression is a list of one or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. Examples include: *
name * security_marks.marks.marka The supported operators are: * `=` for
all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:`
groupBy: Required. Expression that defines what assets fields to use for
grouping. The string value should follow SQL syntax: comma separated
list of fields. For example: "parent,resource_name".
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `GroupFindingsResponse`;
indicates that this is a continuation of a prior `GroupFindings` call,
and that the system should return the next page of data.
r r r r} r r N)r r r r r! r" r# r* groupByrM r r pageSize pageTokenr0 r r1 r2 r r sX @ #& ! !! $'
#
#Ay/@/@/F/F
G(##A&)r1 r c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) GroupFindingsResponsei a Response message for group by findings.
Fields:
groupByResults: Group results. There exists an element for each existing
unique combination of property/values. The element contains a count for
the number of times those specific property/values appear.
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
totalSize: The total number of results matching the query.
GroupResultr Tr r r r} r N)r r r r r! r" r% groupByResultsr#
nextPageTokenrM r r totalSizer0 r r1 r2 r r sK ))-TJ.''*-$$Q 0A0A0G0GH)r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) r i r; c $ \ rS rSrSrSrSrSrSrg)(GroupMembership.GroupTypeValueValuesEnumi r> r r r r Nr? r r1 r2 rC r$ rD r1 rC r r r NrE r r1 r2 r r rH r1 r c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 r \R " SS5 r
Srg )
r i a Result containing the properties and count of a groupBy request.
Messages:
PropertiesValue: Properties matching the groupBy fields in the request.
Fields:
count: Total count of resources for the given properties.
properties: Properties matching the groupBy fields in the request.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
GroupResult.PropertiesValuei zProperties matching the groupBy fields in the request.
Messages:
AdditionalProperty: An additional property for a PropertiesValue object.
Fields:
additionalProperties: Additional properties of type PropertiesValue
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g).GroupResult.PropertiesValue.AdditionalPropertyi zAn additional property for a PropertiesValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r Nr r r1 r2 r r) r r1 r r Tr r Nr r r1 r2 PropertiesValuer' s4 AY . . A %112FTXYr1 r* r r r N)r r r r r! r r r" r r* rM rN r% r r0 r r1 r2 r r s\ !!"89Z )) Z :Z.
#%%%&7;*r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r Sr
g )
r i rJ c $ \ rS rSrSrSrSrSrSrg) IamBinding.ActionValueValuesEnumi rM r r r r NrN r r1 r2 rR r- rS r1 rR r r r r NrT r r1 r2 r r rW r1 r c \ rS rSrSr\R " SSS9r\R " SSS9r\R " SSSS9r
\R " S SS9r S
r g ) r i+ rY r Tr r ProcessSignaturer r r Nr[ r r1 r2 r r + sT
! !!d 3'%%a$7+%%&8!dK* q4 0$r1 r c \ rS rSrSr\R " S5 r\R " SS5 r \R " S5 r
Sr g) r[ iA ra r SensitivityScorer r r Nrc r r1 r2 r[ r[ A s=
q !$ ++,>B ! !! $'r1 r[ c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
rn iU rf PortRanger Tr r r Nrh r r1 r2 rn rn U s-
%%k1tD*
"
"1
%(r1 rn c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " S S
S 9r \R " SS 5 r\R " S
S
S 9r\R " SS
S 9rSrg)r if rk c $ \ rS rSrSrSrSrSrSrg) IpRules.DirectionValueValuesEnumi rn r r r r Nro r r1 r2 rs r6 rt r1 rs rk r rg r r Tr r r r r Nru r r1 r2 r r f s 0
" "9a 0' ! !(A .&!--a$?!!"' q4 8$
T
:%r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i! r r r r Nr
r r1 r2 r r ! r r1 r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListAttackPathsResponsei! a Response message for listing the attack paths for a given simulation or
valued resource.
Fields:
attackPaths: The attack paths that the attack path simulation identified.
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
r r Tr r r N) r r r r r! r" r% attackPathsr# r r0 r r1 r2 rB rB ! s- &&|QF+''*-r1 rB c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListBigQueryExportsResponsei ! a Response message for listing BigQuery exports.
Fields:
bigQueryExports: The BigQuery exports from the specified parent.
nextPageToken: A token, which can be sent as `page_token` to retrieve the
next page. If this field is omitted, there are no subsequent pages.
r r Tr r r N) r r r r r! r" r% bigQueryExportsr# r r0 r r1 r2 rE rE ! s0 **+VXYdhi/''*-r1 rE c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S\R R S 9r
S
rg ) ListFindingsResponsei,! a Response message for listing findings.
Fields:
listFindingsResults: Findings matching the list request.
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
totalSize: The total number of findings matching the query.
ListFindingsResultr Tr r r r} r N)r r r r r! r" r% listFindingsResultsr# r rM r r r! r0 r r1 r2 rH rH ,! sN "../CQQUV''*-$$Q 0A0A0G0GH)r1 rH c d \ rS rSrSr\R " SS5 r\R " SS5 rSr g) rI i;! zResult containing the Finding.
Fields:
finding: Finding matching the search request.
resource: Output only. Resource that is associated with this finding.
r
r Resourcer r N)
r r r r r! r" r% r r; r0 r r1 r2 rI rI ;! s.
" "#G K'
#
#J
2(r1 rI c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListMuteConfigsResponseiG! a Response message for listing mute configs.
Fields:
muteConfigs: The mute configs from the specified parent.
nextPageToken: A token, which can be sent as `page_token` to retrieve the
next page. If this field is omitted, there are no subsequent pages.
r r Tr r r N) r r r r r! r" r% muteConfigsr# r r0 r r1 r2 rN rN G! s0 &&'NPQ\`a+''*-r1 rN c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
ListNotificationConfigsResponseiT! zResponse message for listing notification configs.
Fields:
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
notificationConfigs: Notification configs belonging to the requested
parent.
r NotificationConfigr Tr r N) r r r r r! r" r# r r% notificationConfigsr0 r r1 r2 rQ rQ T! s0 ''*-!../CQQUVr1 rQ c \ rS rSrSr\R " S5 r\R " SSSS9r \R " SSS9r
S r g
) ListOperationsResponseib! a The response message for Operations.ListOperations.
Fields:
nextPageToken: The standard List next-page token.
operations: A list of operations that matches the specified filter in the
request.
unreachable: Unordered list. Unreachable resources. Populated when the
request sets `ListOperationsRequest.return_partial_success` and reads
across collections e.g. when attempting to list all resources across all
supported locations.
r Operationr Tr r r N) r r r r r! r" r# r r% r unreachabler0 r r1 r2 rU rU b! s?
''*-%%k1tD*%%a$7+r1 rU c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
ListResourceValueConfigsResponseit! a Response message to list resource value configs
Fields:
nextPageToken: A token, which can be sent as `page_token` to retrieve the
next page. If this field is empty, there are no subsequent pages.
resourceValueConfigs: The resource value configs from the specified
parent.
r r r Tr r N) r r r r r! r" r# r r% r r0 r r1 r2 rY rY t! s1 ''*-"//0`bcnrsr1 rY c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
ListSourcesResponsei! zResponse message for listing sources.
Fields:
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
sources: Sources belonging to the requested parent.
r Sourcer Tr r N) r r r r r! r" r# r r% r r0 r r1 r2 r[ r[ ! s- ''*- " "8Q >'r1 r[ c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " SSSS 9r
S
rg ) ListValuedResourcesResponsei! aZ Response message for listing the valued resources for a given
simulation.
Fields:
nextPageToken: Token to retrieve the next page of results, or empty if
there are no more results.
totalSize: The estimated total number of results matching the query.
valuedResources: The valued resources that the attack path simulation
identified.
r r r} ValuedResourcer Tr r N)r r r r r! r" r# r rM r r r! r% valuedResourcesr0 r r1 r2 r^ r^ ! sL ''*-$$Q 0A0A0G0GH) **+;QN/r1 r^ c < \ rS rSrSr\R " S5 rSrg)r i! r
r r Nrs r r1 r2 r r ! r r1 r c > \ rS rSrSr\R " SS5 rSrg)r! i! r rk r r Nr r r1 r2 r! r! ! s ,,-@!Dr1 r! c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
MemoryHashSignaturei! r r rj r Tr r Nr r r1 r2 rd rd ! s- &&q),%%k1tD*r1 rd c v \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S
\R 5 r
\R " SS S S
9r \R " SSS S
9r
\R " SS5 r\R " S
SS S
9r\R " S5 rSrg)r# i! r c T \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrg)5MitreAttack.AdditionalTacticsValueListEntryValuesEnumi! r r r r r r r r r r r r r r r r r Nr r r1 r2 r. rg ! r/ r1 r. c D \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1S0r2S1r3S2r4S3r5S4r6S5r7S6r8S7r9S8r:S9r;S:rS=r?S>r@S?rAS@rBSArCSBrDSCrESDrFSErGSFrHSGrISHrJSIrKSJrLSKrMSLrNSMrOSNrPSOrQSPrRSQrSSRrTSSrUSTrVSUrWSVrXSWrYSXrZSYr[SZr\S[r]S\r^S]r_S^r`S_raS`rbSarcSbrdScreSdrfSergSfrhSgriShrjSirkSjrlSkrmSlrnSmroSnrpSorqSprrSqrsSrrtSsruStrvSurwSvrxSwrySxrzSyr{Szr|S{r}S|r~S}rS~rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrg)8MitreAttack.AdditionalTechniquesValueListEntryValuesEnumi" r2 r r r r r r r r r r r r r r r r r r r
r r r r r r
r r r
r r r r r r r r r r r r" r$ r% r& r' r) r* r+ r, r. r/ r1 r3 r4 r5 r7 r8 r: r< r= r> r? rA rC rE r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA r5 rB rC rD rE rF rG rH rI rJ rK rL rM rN rO rP rQ rR rS rT rU rV rW rX rY rZ r[ r\ r] rB r^ r_ r` ra rb rc rd re rf rg rh ri rj rk rl rJ rm rn ro rp rq rr rs rt ru rR rv rw rx ry r Nrz r r1 r2 r ri " r r1 r c T \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrg)(MitreAttack.PrimaryTacticValueValuesEnumi # r
r r r r r r r r r r r r r r r r Nr r r1 r2 r rk # r r1 r c D \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rSrSrSrSrSrSrSrSrSrSrSrSrSr Sr S r S r S r S r!S r"S!r#S"r$S#r%S$r&S%r'S&r(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0S/r1S0r2S1r3S2r4S3r5S4r6S5r7S6r8S7r9S8r:S9r;S:rS=r?S>r@S?rAS@rBSArCSBrDSCrESDrFSErGSFrHSGrISHrJSIrKSJrLSKrMSLrNSMrOSNrPSOrQSPrRSQrSSRrTSSrUSTrVSUrWSVrXSWrYSXrZSYr[SZr\S[r]S\r^S]r_S^r`S_raS`rbSarcSbrdScreSdrfSergSfrhSgriShrjSirkSjrlSkrmSlrnSmroSnrpSorqSprrSqrsSrrtSsruStrvSurwSvrxSwrySxrzSyr{Szr|S{r}S|r~S}rS~rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrSrg)5MitreAttack.PrimaryTechniquesValueListEntryValuesEnumiD# r r r r r r r r r r r r r r r r r r r r
r r r r r r
r r r
r r r r r r r r r r r r" r$ r% r& r' r) r* r+ r, r. r/ r1 r3 r4 r5 r7 r8 r: r< r= r> r? rA rC rE r3 r4 r5 r6 r7 r8 r9 r: r; r< r= r> r? r@ rA r5 rB rC rD rE rF rG rH rI rJ rK rL rM rN rO rP rQ rR rS rT rU rV rW rX rY rZ r[ r\ r] rB r^ r_ r` ra rb rc rd re rf rg rh ri rj rk rl rJ rm rn ro rp rq rr rs rt ru rR rv rw rx ry r Nrz r r1 r2 r rm D# r r1 r r Tr r r r r r Nr r r1 r2 r# r# ! r r1 r# c b \ rS rSrSr\R " SSSS9r\R " SS5 rS r g
) r( ig$ r r} r Tr
StaticMuter r Nr r r1 r2 r( r( g$ s1 !--.A1tT%%lA6*r1 r( c < \ rS rSrSr\R " S5 rSrg)r- iv$ r" r r Nrs r r1 r2 r- r- v$ rt r1 r- c < \ rS rSrSr\R " S5 rSrg)r= i$ r$ r r Nrs r r1 r2 r= r= $ r r1 r= c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
r< i$ r& r r= r Tr r Nr' r r1 r2 r< r< $ s-
q !$
T
:%r1 r< c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) r0 i$ r) r r r r r Nr* r r1 r2 r0 r0 $ r- r1 r0 c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " SS 5 r
\R " S
5 rS rg )
rR i$ a Cloud Security Command Center (Cloud SCC) notification configs. A
notification config is a Cloud SCC resource that contains the configuration
to send notifications for create/update events of findings, assets and etc.
Fields:
cryptoKeyName: Output only. The resource name of the Cloud KMS `CryptoKey`
used to protect this configuration's data, if configured during Security
Command Center activation.
description: The description of the notification config (max of 1024
characters).
name: Identifier. The relative resource name of this notification config.
See: https://cloud.google.com/apis/design/resource_names#relative_resour
ce_name The following list shows some examples: + `organizations/{organi
zation_id}/locations/{location_id}/notificationConfigs/notify_public_buc
ket` + `folders/{folder_id}/locations/{location_id}/notificationConfigs/
notify_public_bucket` + `projects/{project_id}/locations/{location_id}/n
otificationConfigs/notify_public_bucket`
pubsubTopic: The Pub/Sub topic to send notifications to. Its format is
"projects/[project_id]/topics/[topic]".
serviceAccount: Output only. The service account that needs
"pubsub.topics.publish" permission to publish to the Pub/Sub topic.
streamingConfig: The config for triggering streaming-based notifications.
updateTime: Output only. The timestamp of when the notification config was
last updated.
r r r r r StreamingConfigr r r N)r r r r r! r" r# r r r9 pubsubTopicserviceAccountr% streamingConfigr r0 r r1 r2 rR rR $ s| 4 ''*-%%a(+ q !$%%a(+ ((+. **+ i$ r2 r r Tr r r r r r Nr3 r r1 r2 r> r> $ s] %%k1tD*
"% q !$ q !$ Q "r1 r> c z \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 " S S\R 5 5 r
\R " S5 r \R " S S
5 r\R " SS 5 r\R " S 5 r\R " SS
5 rSrg)rV i$ a This resource represents a long-running operation that is the result of
a network API call.
Messages:
MetadataValue: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
ResponseValue: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
Fields:
done: If the value is `false`, it means the operation is still in
progress. If `true`, the operation is completed, and either `error` or
`response` is available.
error: The error result of the operation in case of failure or
cancellation.
metadata: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
name: The server-assigned name, which is only unique within the same
service that originally returns it. If you use the default HTTP mapping,
the `name` should be a resource name ending with
`operations/{unique_id}`.
response: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Operation.MetadataValuei% a Service-specific metadata associated with the operation. It typically
contains progress information and common metadata such as create time.
Some services might not provide such metadata. Any method that returns a
long-running operation should document the metadata type, if any.
Messages:
AdditionalProperty: An additional property for a MetadataValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)*Operation.MetadataValue.AdditionalPropertyi % zAn additional property for a MetadataValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r Nr r r1 r2 r r~ % r r1 r r Tr r Nr r r1 r2
MetadataValuer| % s4 AY . . A %112FTXYr1 r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Operation.ResponseValuei-% a The normal, successful response of the operation. If the original
method returns no data on success, such as `Delete`, the response is
`google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
Messages:
AdditionalProperty: An additional property for a ResponseValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)*Operation.ResponseValue.AdditionalPropertyi?% zAn additional property for a ResponseValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r Nr r r1 r2 r r ?% r r1 r r Tr r Nr r r1 r2
ResponseValuer -% s4 AY . . A %112FTXYr1 r r Statusr r r r r N)r r r r r! r r r" r r r rd doner% errormetadatar# r9 responser0 r r1 r2 rV rV $ s 'R !!"89Zi'' Z :Z6 !!"89 Zi'' Z : Z<
"$
1
-%
#
#OQ
7( q !$
#
#OQ
7(r1 rV c < \ rS rSrSr\R " S5 rSrg)r2 iS% zContains information about the org policies associated with the finding.
Fields:
name: The resource name of the org policy. Example:
"organizations/{organization_id}/policies/{constraint_name}"
r r Nrs r r1 r2 r2 r2 S% r r1 r2 c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) Packagei^% r8 r r r r r Nr9 r r1 r2 r r ^% r> r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)r in% aG A finding that is associated with this node in the attack path.
Fields:
canonicalFinding: Canonical name of the associated findings. Example:
`organizations/123/sources/456/findings/789`
findingCategory: The additional taxonomy group within findings from a
given source.
name: Full resource name of the finding.
r r r r N) r r r r r! r" r# canonicalFindingfindingCategoryr9 r0 r r1 r2 r r n% s: **1- ))!,/ q !$r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)Pipelinei~% a Vertex AI training pipeline associated with the finding.
Fields:
displayName: The user defined display name of pipeline, e.g. plants-
classification
name: Resource name of the pipeline, e.g. projects/{project}/locations/{lo
cation}/trainingPipelines/5253428229225578496
r r r NrA r r1 r2 r r ~% rB r1 r c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S 5 r
\R " S
5 r S r g )
r? i% rD r r Tr r r r r r NrE r r1 r2 r? r? % sQ %%k1tD* ! !'1t <& q !$ Q "r1 r? c \ rS rSrSr\R " SSSS9r\R " SSSS9r\R " S 5 r
\R " S
\R R S 9rS rg
)Policyi% aw An Identity and Access Management (IAM) policy, which specifies access
controls for Google Cloud resources. A `Policy` is a collection of
`bindings`. A `binding` binds one or more `members`, or principals, to a
single `role`. Principals can be user accounts, service accounts, Google
groups, and domains (such as G Suite). A `role` is a named list of
permissions; each `role` can be an IAM predefined role or a user-created
custom role. For some types of Google Cloud resources, a `binding` can also
specify a `condition`, which is a logical expression that allows access to a
resource only if the expression evaluates to `true`. A condition can add
constraints based on attributes of the request, the resource, or both. To
learn which resources support conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies). **JSON example:** ``` { "bindings": [ { "role":
"roles/resourcemanager.organizationAdmin", "members": [
"user:mike@example.com", "group:admins@example.com", "domain:google.com",
"serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role":
"roles/resourcemanager.organizationViewer", "members": [
"user:eve@example.com" ], "condition": { "title": "expirable access",
"description": "Does not grant access after Sep 2020", "expression":
"request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag":
"BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: -
members: - user:mike@example.com - group:admins@example.com -
domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com
role: roles/resourcemanager.organizationAdmin - members: -
user:eve@example.com role: roles/resourcemanager.organizationViewer
condition: title: expirable access description: Does not grant access after
Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
etag: BwWWja0YfJA= version: 3 ``` For a description of IAM and its features,
see the [IAM documentation](https://cloud.google.com/iam/docs/).
Fields:
auditConfigs: Specifies cloud audit logging configuration for this policy.
bindings: Associates a list of `members`, or principals, with a `role`.
Optionally, may specify a `condition` that determines how and when the
`bindings` are applied. Each of the `bindings` must contain at least one
principal. The `bindings` in a `Policy` can refer to up to 1,500
principals; up to 250 of these principals can be Google groups. Each
occurrence of a principal counts towards these limits. For example, if
the `bindings` grant 50 different roles to `user:alice@example.com`, and
not to any other principal, then you can add another 1,450 principals to
the `bindings` in the `Policy`.
etag: `etag` is used for optimistic concurrency control as a way to help
prevent simultaneous updates of a policy from overwriting each other. It
is strongly suggested that systems make use of the `etag` in the read-
modify-write cycle to perform policy updates in order to avoid race
conditions: An `etag` is returned in the response to `getIamPolicy`, and
systems are expected to put that etag in the request to `setIamPolicy`
to ensure that their change will be applied to the same version of the
policy. **Important:** If you use IAM Conditions, you must include the
`etag` field whenever you call `setIamPolicy`. If you omit this field,
then IAM allows you to overwrite a version `3` policy with a version `1`
policy, and all of the conditions in the version `3` policy are lost.
version: Specifies the format of the policy. Valid values are `0`, `1`,
and `3`. Requests that specify an invalid value are rejected. Any
operation that affects conditional role bindings must specify version
`3`. This requirement applies to the following operations: * Getting a
policy that includes a conditional role binding * Adding a conditional
role binding to a policy * Changing a conditional role binding in a
policy * Removing any role binding, with or without a condition, from a
policy that includes conditions **Important:** If you use IAM
Conditions, you must include the `etag` field whenever you call
`setIamPolicy`. If you omit this field, then IAM allows you to overwrite
a version `3` policy with a version `1` policy, and all of the
conditions in the version `3` policy are lost. If a policy does not
include any conditions, operations on that policy may specify any valid
version or leave the field unset. To learn which resources support
conditions in their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
r r Tr r r r r r} r N)r r r r r! r" r% auditConfigsr
BytesFieldetagrM r r r> r0 r r1 r2 r r % sa EN ''
q4H,
#
#Iq4
@( a $ " "1i.?.?.E.E F'r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)PolicyDriftDetailsi% rH r r r r NrI r r1 r2 r r % rM r1 r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r3 i% rO r r r NrP r r1 r2 r3 r3 % rS r1 r3 c \ rS rSrSr\R " SSS9r\R " S5 r \R " SS5 r \R " S S
SS9r \R " S 5 r
\R " SS SS9r\R " S
5 r\R " S5 r\R " S5 r\R " SS5 r\R " S5 rSrg)r6 i & rU r Tr r r r r r r r r r r r r r NrV r r1 r2 r6 r6 & s *
q4 0$ --a0 ! !&! ,&''(=q4P,#003$$VQ>) q !$$$Q') q!# ! !&" -& ! !" %&r1 r6 c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r \R " SS 5 r S
r
g ) r/ i.& ra c $ \ rS rSrSrSrSrSrSrg)-ProcessSignature.SignatureTypeValueValuesEnumi=& rd r r r r Nre r r1 r2 ri r =& rj r1 ri rd r r YaraRuleSignaturer r Nrl r r1 r2 r/ r/ .& sT
Y^^
"../DaH%%&DaH- ,,-@!Dr1 r/ c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r iN& rq r r r Nrr r r1 r2 r r N& rs r1 r c \ rS rSrSr\R " S\R R S9r \R " S\R R S9r
\R " S5 r \R " S\R R S9r
Srg )
r8 i[& ru r r} r r r r Nrv r r1 r2 r8 r8 [& r{ r1 r8 c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r
\R " SS 5 r \R " S
5 r\R " S S 5 r\R " S
5 r\R " S5 r\R " SS5 r\R " S5 r\R " S5 r\R " S5 rSrg)rL in& a& Information related to the Google Cloud resource that is associated with
this finding.
Enums:
CloudProviderValueValuesEnum: Indicates which cloud provider the finding
is from.
Fields:
awsMetadata: The AWS metadata associated with the finding.
azureMetadata: The Azure metadata associated with the finding.
cloudProvider: Indicates which cloud provider the finding is from.
displayName: The human readable name of the resource.
gcpMetadata: The Google Cloud metadata associated with the finding.
location: The region or location of the service (if applicable).
name: The full resource name of the resource. See:
https://cloud.google.com/apis/design/resource_names#full_resource_name
resourcePath: Provides the path to the resource within the resource
hierarchy.
resourcePathString: A string representation of the resource path. For
Google Cloud, it has the format of `organizations/{organization_id}/fold
ers/{folder_id}/folders/{folder_id}/projects/{project_id}` where there
can be any number of folders. For AWS, it has the format of `org/{organi
zation_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/accou
nt/{account_id}` where there can be any number of organizational units.
For Azure, it has the format of `mg/{management_group_id}/mg/{management
_group_id}/subscription/{subscription_id}/rg/{resource_group_name}`
where there can be any number of management groups.
service: The service or resource provider associated with the resource.
type: The full resource type of the resource.
c ( \ rS rSrSrSrSrSrSrSr g) %Resource.CloudProviderValueValuesEnumi& r r r r r r Nr r r1 r2 r r & r r1 r r r r r r r r r r r r r r r r r Nr r r1 r2 rL rL n& s > Y^^ &&'OQRS+(()SUVW-%%&DaH-%%a(+&&}a8+
"
"1
%( q !$''(QSTU, ,,Q/ ! !" %' r "$r1 rL c < \ rS rSrSr\R " SSSS9rSrg) r i& r ResourcePathNoder Tr r Nr r r1 r2 r r & s
!3Q
F%r1 r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " SS5 r Sr
g )
r i& r c @ \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
S rS
rg)(ResourcePathNode.NodeTypeValueValuesEnumi& r r r r r r r r r r r r Nr r r1 r2 r r & r r1 r r r r r Nr r r1 r2 r r & r r1 r c < \ rS rSrSr\R " S5 rSrg)ResourceValueConfigMetadatai& zlMetadata about a ResourceValueConfig. For example, id and name.
Fields:
name: Resource value config name
r r Nrs r r1 r2 r r & r r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r Sr
g )
r i& r c $ \ rS rSrSrSrSrSrSrg)Role.KindValueValuesEnumi& r r r r r Nr r r1 r2 r r & r r1 r r r r r Nr r r1 r2 r r & r r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r Sr
g)SecurityBulletini' r r r r r Nr r r1 r2 r r ' r r1 r c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 r \R " SS5 r
\R " S5 rS rg
) r9 i' r^ r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
SecurityMarks.MarksValuei>' ra c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)+SecurityMarks.MarksValue.AdditionalPropertyiN' rd r r r Nr r r1 r2 r r N' r r1 r r Tr r Nr r r1 r2 re r >' r r1 re r r r r Nrf r r1 r2 r9 r9 ' rh r1 r9 c \ rS rSrSr\R " S5 r\R " S5 r \R " S5 r
Sr g)r9 i`' r r r r r Nr r r1 r2 r9 r9 `' r r1 r9 c 8 \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " SSSS 9r \R " S
5 r \R " S 5 r
\R " S 5 r\R " S
5 rSrg)r; is' a Represents a posture that is deployed on Google Cloud by the Security
Command Center Posture Management service. A posture contains one or more
policy sets. A policy set is a group of policies that enforce a set of
security rules on Google Cloud.
Fields:
changedPolicy: The name of the updated policy, for example,
`projects/{project_id}/policies/{constraint_name}`.
name: Name of the posture, for example, `CIS-Posture`.
policy: The ID of the updated policy, for example, `compute-policy-1`.
policyDriftDetails: The details about a change in an updated policy that
violates the deployed posture.
policySet: The name of the updated policyset, for example, `cis-
policyset`.
postureDeployment: The name of the posture deployment, for example,
`organizations/{org_id}/posturedeployments/{posture_deployment_id}`.
postureDeploymentResource: The project, folder, or organization on which
the posture is deployed, for example, `projects/{project_number}`.
revisionId: The version of the posture, for example, `c7cfa2a8`.
r r r r r Tr r r r r r Nr r r1 r2 r; r; s' s * ''*- q !$ #& --.BAPTU##A&) ++A. ' 3 3A 6$$Q'*r1 r; c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 5SecuritycenterFoldersAssetsUpdateSecurityMarksRequesti' a A SecuritycenterFoldersAssetsUpdateSecurityMarksRequest object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Trequiredr r N r r r r r! r" r% (googleCloudSecuritycenterV2SecurityMarksr# r9
updateMaskr0 r r1 r2 r r ' @ & .7-C-CDnpq-r* q4 0$$$Q'*r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
,SecuritycenterFoldersFindingsBulkMuteRequesti' a_ A SecuritycenterFoldersFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r N r r r r r! r" r% bulkMuteFindingsRequestr# r r0 r r1 r2 r r ' / & 2 23La P T 2&r1 r c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) :SecuritycenterFoldersLocationsBigQueryExportsCreateRequesti' a A SecuritycenterFoldersLocationsBigQueryExportsCreateRequest object.
Fields:
bigQueryExportId: Required. Unique identifier provided by the client
within the parent scope. It must consist of only lowercase letters,
numbers, and hyphens, must start with a letter, must end with either a
letter or a number, and must be 63 characters or less.
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
parent: Required. The name of the parent resource of the new BigQuery
export. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r N r r r r r! r" r# bigQueryExportIdr% )googleCloudSecuritycenterV2BigQueryExportr r0 r r1 r2 r r ' A " **1-.7.D.DEprs.t+ T 2&r1 r c : \ rS rSrSr\R " SSS9rSrg):SecuritycenterFoldersLocationsBigQueryExportsDeleteRequesti' a A SecuritycenterFoldersLocationsBigQueryExportsDeleteRequest object.
Fields:
name: Required. The name of the BigQuery export to delete. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}/locations/{location}/bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 r r '
q4 0$r1 r c : \ rS rSrSr\R " SSS9rSrg)7SecuritycenterFoldersLocationsBigQueryExportsGetRequesti' a A SecuritycenterFoldersLocationsBigQueryExportsGetRequest object.
Fields:
name: Required. Name of the BigQuery export to retrieve. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}locations/{location}//bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 r r ' r r1 r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) 8SecuritycenterFoldersLocationsBigQueryExportsListRequesti' aE A SecuritycenterFoldersLocationsBigQueryExportsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListBigQueryExports`
call. Provide this to retrieve the subsequent page. When paginating, all
other parameters provided to `ListBigQueryExports` must match the call
that provided the page token.
parent: Required. The parent, which owns the collection of BigQuery
exports. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r r r! r" rM r r r r# r r r0 r r1 r2 r r ' I $
#
#Ay/@/@/F/F
G(##A&) T 2&r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 9SecuritycenterFoldersLocationsBigQueryExportsPatchRequesti
( aZ A SecuritycenterFoldersLocationsBigQueryExportsPatchRequest object.
Fields:
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
name: Identifier. The relative resource name of this export. See: https://
cloud.google.com/apis/design/resource_names#relative_resource_name. The
following list shows some examples: + `organizations/{organization_id}/l
ocations/{location_id}/bigQueryExports/{export_id}` + `folders/{folder_i
d}/locations/{location_id}/bigQueryExports/{export_id}` + `projects/{pro
ject_id}/locations/{location_id}/bigQueryExports/{export_id}` This field
is provided in responses, and is ignored when provided in create
requests.
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r N r r r r r! r" r% r r# r9 r r0 r r1 r2 r r
( @ $ /8.D.DEprs.t+ q4 0$$$Q'*r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
5SecuritycenterFoldersLocationsFindingsBulkMuteRequesti"( ah A SecuritycenterFoldersLocationsFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r Nr r r1 r2 r r "( r r1 r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) 6SecuritycenterFoldersLocationsMuteConfigsCreateRequesti5( a A SecuritycenterFoldersLocationsMuteConfigsCreateRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
muteConfigId: Required. Unique identifier provided by the client within
the parent scope. It must consist of only lowercase letters, numbers,
and hyphens, must start with a letter, must end with either a letter or
a number, and must be 63 characters or less.
parent: Required. Resource name of the new mute configs's parent. Its
format is `organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r N r r r r r! r" r% %googleCloudSecuritycenterV2MuteConfigr# muteConfigIdr r0 r r1 r2 r r 5( @ +4*@*@Ahjk*l'&&q), T 2&r1 r c : \ rS rSrSr\R " SSS9rSrg)6SecuritycenterFoldersLocationsMuteConfigsDeleteRequestiK( a; A SecuritycenterFoldersLocationsMuteConfigsDeleteRequest object.
Fields:
name: Required. Name of the mute config to delete. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r r K(
q4 0$r1 r c : \ rS rSrSr\R " SSS9rSrg)3SecuritycenterFoldersLocationsMuteConfigsGetRequesti\( a: A SecuritycenterFoldersLocationsMuteConfigsGetRequest object.
Fields:
name: Required. Name of the mute config to retrieve. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r r \( r r1 r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) 4SecuritycenterFoldersLocationsMuteConfigsListRequestim( a A SecuritycenterFoldersLocationsMuteConfigsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListMuteConfigs` call.
Provide this to retrieve the subsequent page. When paginating, all other
parameters provided to `ListMuteConfigs` must match the call that
provided the page token.
parent: Required. The parent, which owns the collection of mute configs.
Its format is `organizations/[organization_id]", "folders/[folder_id]`,
`projects/[project_id]`,
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`,
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r1 r2 r r m( I &
#
#Ay/@/@/F/F
G(##A&) T 2&r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 5SecuritycenterFoldersLocationsMuteConfigsPatchRequesti( aE A SecuritycenterFoldersLocationsMuteConfigsPatchRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
name: Identifier. This field will be ignored if provided on config
creation. The following list shows some examples of the format: +
`organizations/{organization}/muteConfigs/{mute_config}` + `organization
s/{organization}locations/{location}//muteConfigs/{mute_config}` +
`folders/{folder}/muteConfigs/{mute_config}` +
`folders/{folder}/locations/{location}/muteConfigs/{mute_config}` +
`projects/{project}/muteConfigs/{mute_config}` +
`projects/{project}/locations/{location}/muteConfigs/{mute_config}`
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r N r r r r r! r" r% r r# r9 r r0 r r1 r2 r r ( @ $ +4*@*@Ahjk*l' q4 0$$$Q'*r1 r c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) >SecuritycenterFoldersLocationsNotificationConfigsCreateRequesti( az A SecuritycenterFoldersLocationsNotificationConfigsCreateRequest object.
Fields:
configId: Required. Unique identifier provided by the client within the
parent scope. It must be between 1 and 128 characters and contain
alphanumeric characters, underscores, or hyphens only.
notificationConfig: A NotificationConfig resource to be passed as the
request body.
parent: Required. Resource name of the new notification config's parent.
Its format is `organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r rR r r Tr r N r r r r r! r" r# configIdr% notificationConfigr r0 r r1 r2 r r ( s?
"
"1
%( --.BAF T 2&r1 r c : \ rS rSrSr\R " SSS9rSrg)>SecuritycenterFoldersLocationsNotificationConfigsDeleteRequesti( a A SecuritycenterFoldersLocationsNotificationConfigsDeleteRequest object.
Fields:
name: Required. Name of the notification config to delete. The following
list shows some examples of the format: + `organizations/[organization_i
d]/locations/[location_id]/notificationConfigs/[config_id]` + `folders/[
folder_id]/locations/[location_id]notificationConfigs/[config_id]` + `pr
ojects/[project_id]/locations/[location_id]notificationConfigs/[config_i
d]`
r Tr r Nrs r r1 r2 r r (
q4 0$r1 r c : \ rS rSrSr\R " SSS9rSrg);SecuritycenterFoldersLocationsNotificationConfigsGetRequesti( a A SecuritycenterFoldersLocationsNotificationConfigsGetRequest object.
Fields:
name: Required. Name of the notification config to get. The following list
shows some examples of the format: + `organizations/[organization_id]/lo
cations/[location_id]/notificationConfigs/[config_id]` + `folders/[folde
r_id]/locations/[location_id]/notificationConfigs/[config_id]` + `projec
ts/[project_id]/locations/[location_id]/notificationConfigs/[config_id]`
r Tr r Nrs r r1 r2 r r ( r r1 r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) `, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r r r! r" r# fieldMaskr* orderByrM r r r r r r0 r r1 r2 r r ) z 7r ##A&) #& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2&r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 0SecuritycenterFoldersSourcesFindingsPatchRequesti) a A SecuritycenterFoldersSourcesFindingsPatchRequest object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r N r r r r r! r" r% "googleCloudSecuritycenterV2Findingr# r9 r r0 r r1 r2 r r ) @ . (1'='=>bde'f$ q4 0$$$Q'*r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
2SecuritycenterFoldersSourcesFindingsSetMuteRequesti) a A SecuritycenterFoldersSourcesFindingsSetMuteRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setMuteRequest: A SetMuteRequest resource to be passed as the request
body.
r Tr SetMuteRequestr r N r r r r r! r" r# r9 r% setMuteRequestr0 r r1 r2 r r ) . &
q4 0$ ))*:A>.r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
3SecuritycenterFoldersSourcesFindingsSetStateRequesti* a A SecuritycenterFoldersSourcesFindingsSetStateRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setFindingStateRequest: A SetFindingStateRequest resource to be passed as
the request body.
r Tr SetFindingStateRequestr r N r r r r r! r" r# r9 r% setFindingStateRequestr0 r r1 r2 r# r# * / &
q4 0$$112JANr1 r# c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) >SecuritycenterFoldersSourcesFindingsUpdateSecurityMarksRequesti)* a A SecuritycenterFoldersSourcesFindingsUpdateSecurityMarksRequest object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r) r) )* r r1 r) c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) 'SecuritycenterFoldersSourcesListRequestiB* a7 A SecuritycenterFoldersSourcesListRequest object.
Fields:
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListSourcesResponse`; indicates
that this is a continuation of a prior `ListSources` call, and that the
system should return the next page of data.
parent: Required. Resource name of the parent of sources to list. Its
format should be `organizations/[organization_id]`,
`folders/[folder_id]`, or `projects/[project_id]`.
r r} r r Tr r Nr r r1 r2 r+ r+ B* I
#
#Ay/@/@/F/F
G(##A&) T 2&r1 r+ c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
:SecuritycenterFoldersSourcesLocationsFindingsExportRequestiU* a: A SecuritycenterFoldersSourcesLocationsFindingsExportRequest object.
Fields:
exportFindingsRequest: A ExportFindingsRequest resource to be passed as
the request body.
parent: Required. The relative name of the export scope. Example formats:
organizations/{organization}/sources/-/locations/{location}
r r r Tr r N r r r r r! r" r% exportFindingsRequestr# r r0 r r1 r2 r. r. U* / $001H!L T 2&r1 r. c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) HSecuritycenterFoldersSourcesLocationsFindingsExternalSystemsPatchRequestic* a A
SecuritycenterFoldersSourcesLocationsFindingsExternalSystemsPatchRequest
object.
Fields:
googleCloudSecuritycenterV2ExternalSystem: A
GoogleCloudSecuritycenterV2ExternalSystem resource to be passed as the
request body.
name: Full resource name of the external system. The following list shows
some examples: +
`organizations/1234/sources/5678/findings/123456/externalSystems/jira` +
`organizations/1234/sources/5678/locations/us/findings/123456/externalSy
stems/jira` +
`folders/1234/sources/5678/findings/123456/externalSystems/jira` + `fold
ers/1234/sources/5678/locations/us/findings/123456/externalSystems/jira`
+ `projects/1234/sources/5678/findings/123456/externalSystems/jira` + `p
rojects/1234/sources/5678/locations/us/findings/123456/externalSystems/j
ira`
updateMask: The FieldMask to use when updating the external system
resource. If empty all mutable fields will be updated.
r r r Tr r r Nr r r1 r2 r3 r3 c* @ , /8.D.DEprs.t+ q4 0$$$Q'*r1 r3 c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
9SecuritycenterFoldersSourcesLocationsFindingsGroupRequesti* a~ A SecuritycenterFoldersSourcesLocationsFindingsGroupRequest object.
Fields:
groupFindingsRequest: A GroupFindingsRequest resource to be passed as the
request body.
parent: Required. Name of the source to groupBy. If no location is
specified, finding is assumed to be in global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
groupBy across all sources provide a source_id of `-`. The following
list shows some examples: + `organizations/{organization_id}/sources/-`
+ `organizations/{organization_id}/sources/-/locations/[location_id]` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-/locations/[location_id]` +
`projects/{project_id}/sources/-` +
`projects/{project_id}/sources/-/locations/[location_id]`
r r r Tr r Nr r r1 r2 r6 r6 * r r1 r6 c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S\R R S9r
\R " S5 r\R " S S
S 9rS rg
)8SecuritycenterFoldersSourcesLocationsFindingsListRequesti* a A SecuritycenterFoldersSourcesLocationsFindingsListRequest object.
Fields:
fieldMask: A field mask to specify the Finding fields to be listed in the
response. An empty field mask will list all fields.
filter: Expression that defines the filter to apply across findings. The
expression is a list of one or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. Examples include: *
name * security_marks.marks.marka The supported operators are: * `=` for
all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r1 r2 r8 r8 * r r1 r8 c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 9SecuritycenterFoldersSourcesLocationsFindingsPatchRequesti* a A SecuritycenterFoldersSourcesLocationsFindingsPatchRequest object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r Nr r r1 r2 r: r: * r r1 r: c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
;SecuritycenterFoldersSourcesLocationsFindingsSetMuteRequesti* a A SecuritycenterFoldersSourcesLocationsFindingsSetMuteRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setMuteRequest: A SetMuteRequest resource to be passed as the request
body.
r Tr r r r Nr r r1 r2 r< r< * r! r1 r< c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
r> + r' r1 r> c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) GSecuritycenterFoldersSourcesLocationsFindingsUpdateSecurityMarksRequesti)+ a A
SecuritycenterFoldersSourcesLocationsFindingsUpdateSecurityMarksRequest
object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r@ r@ )+ @ * .7-C-CDnpq-r* q4 0$$$Q'*r1 r@ c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ;SecuritycenterOrganizationsAssetsUpdateSecurityMarksRequestiD+ a A SecuritycenterOrganizationsAssetsUpdateSecurityMarksRequest object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 rC rC D+ r r1 rC c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " S5 r \R " SSS 9r
S
rg ) 1SecuritycenterOrganizationsAttackPathsListRequesti]+ a A SecuritycenterOrganizationsAttackPathsListRequest object.
Fields:
filter: The filter expression that filters the attack path in the
response. Supported fields: * `valued_resources` supports =
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListAttackPathsResponse`;
indicates that this is a continuation of a prior `ListAttackPaths` call,
and that the system should return the next page of data.
parent: Required. Name of parent to list attack paths. Valid formats:
`organizations/{organization}`,
`organizations/{organization}/simulations/{simulation}` `organizations/{
organization}/simulations/{simulation}/attackExposureResults/{attack_exp
osure_result_v2}` `organizations/{organization}/simulations/{simulation}
/valuedResources/{valued_resource}`
r r r} r r Tr r Nr r r r r! r" r# r* rM r r r r r r0 r r1 r2 rE rE ]+ Y $ #&
#
#Ay/@/@/F/F
G(##A&) T 2&r1 rE c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
2SecuritycenterOrganizationsFindingsBulkMuteRequestiv+ ae A SecuritycenterOrganizationsFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r Nr r r1 r2 rI rI v+ r r1 rI c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) @SecuritycenterOrganizationsLocationsBigQueryExportsCreateRequesti+ a A SecuritycenterOrganizationsLocationsBigQueryExportsCreateRequest
object.
Fields:
bigQueryExportId: Required. Unique identifier provided by the client
within the parent scope. It must consist of only lowercase letters,
numbers, and hyphens, must start with a letter, must end with either a
letter or a number, and must be 63 characters or less.
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
parent: Required. The name of the parent resource of the new BigQuery
export. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r Nr r r1 r2 rK rK + sA $ **1-.7.D.DEprs.t+ T 2&r1 rK c : \ rS rSrSr\R " SSS9rSrg)@SecuritycenterOrganizationsLocationsBigQueryExportsDeleteRequesti+ a A SecuritycenterOrganizationsLocationsBigQueryExportsDeleteRequest
object.
Fields:
name: Required. The name of the BigQuery export to delete. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}/locations/{location}/bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 rM rM + r r1 rM c : \ rS rSrSr\R " SSS9rSrg)=SecuritycenterOrganizationsLocationsBigQueryExportsGetRequesti+ a A SecuritycenterOrganizationsLocationsBigQueryExportsGetRequest object.
Fields:
name: Required. Name of the BigQuery export to retrieve. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}locations/{location}//bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 rO rO + r r1 rO c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) >SecuritycenterOrganizationsLocationsBigQueryExportsListRequesti+ aK A SecuritycenterOrganizationsLocationsBigQueryExportsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListBigQueryExports`
call. Provide this to retrieve the subsequent page. When paginating, all
other parameters provided to `ListBigQueryExports` must match the call
that provided the page token.
parent: Required. The parent, which owns the collection of BigQuery
exports. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r1 r2 rQ rQ + r r1 rQ c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ?SecuritycenterOrganizationsLocationsBigQueryExportsPatchRequesti+ a` A SecuritycenterOrganizationsLocationsBigQueryExportsPatchRequest
object.
Fields:
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
name: Identifier. The relative resource name of this export. See: https://
cloud.google.com/apis/design/resource_names#relative_resource_name. The
following list shows some examples: + `organizations/{organization_id}/l
ocations/{location_id}/bigQueryExports/{export_id}` + `folders/{folder_i
d}/locations/{location_id}/bigQueryExports/{export_id}` + `projects/{pro
ject_id}/locations/{location_id}/bigQueryExports/{export_id}` This field
is provided in responses, and is ignored when provided in create
requests.
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r Nr r r1 r2 rS rS + s@ & /8.D.DEprs.t+ q4 0$$$Q'*r1 rS c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
;SecuritycenterOrganizationsLocationsFindingsBulkMuteRequesti+ an A SecuritycenterOrganizationsLocationsFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r Nr r r1 r2 rU rU + r r1 rU c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) `, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r1 r2 r r a/ r r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 6SecuritycenterOrganizationsSourcesFindingsPatchRequesti/ a A SecuritycenterOrganizationsSourcesFindingsPatchRequest object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r Nr r r1 r2 r r / r r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
8SecuritycenterOrganizationsSourcesFindingsSetMuteRequesti/ a A SecuritycenterOrganizationsSourcesFindingsSetMuteRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setMuteRequest: A SetMuteRequest resource to be passed as the request
body.
r Tr r r r Nr r r1 r2 r r / r! r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
9SecuritycenterOrganizationsSourcesFindingsSetStateRequesti/ a A SecuritycenterOrganizationsSourcesFindingsSetStateRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setFindingStateRequest: A SetFindingStateRequest resource to be passed as
the request body.
r Tr r$ r r Nr% r r1 r2 r r / r' r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) DSecuritycenterOrganizationsSourcesFindingsUpdateSecurityMarksRequesti/ a A SecuritycenterOrganizationsSourcesFindingsUpdateSecurityMarksRequest
object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r r / @ ( .7-C-CDnpq-r* q4 0$$$Q'*r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
5SecuritycenterOrganizationsSourcesGetIamPolicyRequesti
0 aq A SecuritycenterOrganizationsSourcesGetIamPolicyRequest object.
Fields:
getIamPolicyRequest: A GetIamPolicyRequest resource to be passed as the
request body.
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
r r r Tr r N) r r r r r! r" r% getIamPolicyRequestr# r; r0 r r1 r2 r r
0 s/ "../DaH
"
"1t
4(r1 r c : \ rS rSrSr\R " SSS9rSrg),SecuritycenterOrganizationsSourcesGetRequesti0 zA SecuritycenterOrganizationsSourcesGetRequest object.
Fields:
name: Required. Relative resource name of the source. Its format is
`organizations/[organization_id]/source/[source_id]`.
r Tr r Nrs r r1 r2 r r 0 rs r1 r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) -SecuritycenterOrganizationsSourcesListRequesti%0 a= A SecuritycenterOrganizationsSourcesListRequest object.
Fields:
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListSourcesResponse`; indicates
that this is a continuation of a prior `ListSources` call, and that the
system should return the next page of data.
parent: Required. Resource name of the parent of sources to list. Its
format should be `organizations/[organization_id]`,
`folders/[folder_id]`, or `projects/[project_id]`.
r r} r r Tr r Nr r r1 r2 r r %0 r, r1 r c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) @SecuritycenterOrganizationsSourcesLocationsFindingsCreateRequesti80 a A SecuritycenterOrganizationsSourcesLocationsFindingsCreateRequest
object.
Fields:
findingId: Required. Unique identifier provided by the client within the
parent scope. It must be alphanumeric and less than or equal to 32
characters and greater than 0 characters in length.
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
parent: Required. Resource name of the new finding's parent. The following
list shows some examples of the format: +
`organizations/[organization_id]/sources/[source_id]` + `organizations/[
organization_id]/sources/[source_id]/locations/[location_id]`
r r
r r Tr r Nr r r1 r2 r r 80 s@
##A&)'0'='=>bde'f$ T 2&r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
@SecuritycenterOrganizationsSourcesLocationsFindingsExportRequestiM0 a@ A SecuritycenterOrganizationsSourcesLocationsFindingsExportRequest
object.
Fields:
exportFindingsRequest: A ExportFindingsRequest resource to be passed as
the request body.
parent: Required. The relative name of the export scope. Example formats:
organizations/{organization}/sources/-/locations/{location}
r r r Tr r Nr/ r r1 r2 r r M0 s/ $001H!L T 2&r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) NSecuritycenterOrganizationsSourcesLocationsFindingsExternalSystemsPatchRequesti\0 a A SecuritycenterOrganizationsSourcesLocationsFindingsExternalSystemsPatc
hRequest object.
Fields:
googleCloudSecuritycenterV2ExternalSystem: A
GoogleCloudSecuritycenterV2ExternalSystem resource to be passed as the
request body.
name: Full resource name of the external system. The following list shows
some examples: +
`organizations/1234/sources/5678/findings/123456/externalSystems/jira` +
`organizations/1234/sources/5678/locations/us/findings/123456/externalSy
stems/jira` +
`folders/1234/sources/5678/findings/123456/externalSystems/jira` + `fold
ers/1234/sources/5678/locations/us/findings/123456/externalSystems/jira`
+ `projects/1234/sources/5678/findings/123456/externalSystems/jira` + `p
rojects/1234/sources/5678/locations/us/findings/123456/externalSystems/j
ira`
updateMask: The FieldMask to use when updating the external system
resource. If empty all mutable fields will be updated.
r r r Tr r r Nr r r1 r2 r r \0 r r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
?SecuritycenterOrganizationsSourcesLocationsFindingsGroupRequestiw0 a A SecuritycenterOrganizationsSourcesLocationsFindingsGroupRequest
object.
Fields:
groupFindingsRequest: A GroupFindingsRequest resource to be passed as the
request body.
parent: Required. Name of the source to groupBy. If no location is
specified, finding is assumed to be in global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
groupBy across all sources provide a source_id of `-`. The following
list shows some examples: + `organizations/{organization_id}/sources/-`
+ `organizations/{organization_id}/sources/-/locations/[location_id]` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-/locations/[location_id]` +
`projects/{project_id}/sources/-` +
`projects/{project_id}/sources/-/locations/[location_id]`
r r r Tr r Nr r r1 r2 r r w0 s/ . #//0FJ T 2&r1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S\R R S9r
\R " S5 r\R " S S
S 9rS rg
)>SecuritycenterOrganizationsSourcesLocationsFindingsListRequesti0 a# A SecuritycenterOrganizationsSourcesLocationsFindingsListRequest object.
Fields:
fieldMask: A field mask to specify the Finding fields to be listed in the
response. An empty field mask will list all fields.
filter: Expression that defines the filter to apply across findings. The
expression is a list of one or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. Examples include: *
name * security_marks.marks.marka The supported operators are: * `=` for
all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r1 r2 r r 0 r r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ?SecuritycenterOrganizationsSourcesLocationsFindingsPatchRequesti0 a A SecuritycenterOrganizationsSourcesLocationsFindingsPatchRequest
object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r Nr r r1 r2 r r 0 s@ 0 (1'='=>bde'f$ q4 0$$$Q'*r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
ASecuritycenterOrganizationsSourcesLocationsFindingsSetMuteRequesti0 a A SecuritycenterOrganizationsSourcesLocationsFindingsSetMuteRequest
object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setMuteRequest: A SetMuteRequest resource to be passed as the request
body.
r Tr r r r Nr r r1 r2 r r 0 s. (
q4 0$ ))*:A>.r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
BSecuritycenterOrganizationsSourcesLocationsFindingsSetStateRequesti 1 a A SecuritycenterOrganizationsSourcesLocationsFindingsSetStateRequest
object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setFindingStateRequest: A SetFindingStateRequest resource to be passed as
the request body.
r Tr r$ r r Nr% r r1 r2 r r 1 s/ (
q4 0$$112JANr1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) MSecuritycenterOrganizationsSourcesLocationsFindingsUpdateSecurityMarksRequesti%1 a A SecuritycenterOrganizationsSourcesLocationsFindingsUpdateSecurityMarks
Request object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r r %1 r r1 r c \ rS rSrSr\R " SSS9r\R " SS5 r \R " S5 r
S r g
) .SecuritycenterOrganizationsSourcesPatchRequesti?1 a A SecuritycenterOrganizationsSourcesPatchRequest object.
Fields:
name: The relative resource name of this source. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me Example: "organizations/{organization_id}/sources/{source_id}"
source: A Source resource to be passed as the request body.
updateMask: The FieldMask to use when updating the source resource. If
empty all mutable fields will be updated.
r Tr r\ r r r N) r r r r r! r" r# r9 r% r r r0 r r1 r2 r r ?1 s=
q4 0$ ! !(A .&$$Q'*r1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
5SecuritycenterOrganizationsSourcesSetIamPolicyRequestiP1 aq A SecuritycenterOrganizationsSourcesSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r Tr SetIamPolicyRequestr r N) r r r r r! r" r# r; r% setIamPolicyRequestr0 r r1 r2 r r P1 s/
"
"1t
4(!../DaHr1 r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
;SecuritycenterOrganizationsSourcesTestIamPermissionsRequesti`1 a A SecuritycenterOrganizationsSourcesTestIamPermissionsRequest object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r Tr TestIamPermissionsRequestr r N) r r r r r! r" r# r; r% testIamPermissionsRequestr0 r r1 r2 r r `1 s0
"
"1t
4( ' 4 45PRS Tr1 r c \ rS rSrSr\R " S5 r\R " S5 r\R " S\R R S9r \R " S5 r
\R " SS S
9rS rg )
5SecuritycenterOrganizationsValuedResourcesListRequestip1 a. A SecuritycenterOrganizationsValuedResourcesListRequest object.
Fields:
filter: The filter expression that filters the valued resources in the
response. Supported fields: * `resource_value` supports = *
`resource_type` supports =
orderBy: Optional. The fields by which to order the valued resources
response. Supported fields: * `exposed_score` * `resource_value` *
`resource_type` Values should be a comma separated list of fields. For
example: `exposed_score,resource_value`. The default sorting order is
descending. To specify ascending or descending order for a field, append
a " ASC" or a " DESC" suffix, respectively; for example: `exposed_score
DESC`.
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListValuedResourcesResponse`;
indicates that this is a continuation of a prior `ListValuedResources`
call, and that the system should return the next page of data.
parent: Required. Name of parent to list exposed resources. Valid formats:
`organizations/{organization}`,
`organizations/{organization}/simulations/{simulation}` `organizations/{
organization}/simulations/{simulation}/attackExposureResults/{attack_exp
osure_result_v2}`
r r r r} r r Tr r Nr r r1 r2 r r p1 si 2 #& ! !! $'
#
#Ay/@/@/F/F
G(##A&) T 2&r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 6SecuritycenterProjectsAssetsUpdateSecurityMarksRequesti1 a A SecuritycenterProjectsAssetsUpdateSecurityMarksRequest object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r r 1 r r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
-SecuritycenterProjectsFindingsBulkMuteRequesti1 a` A SecuritycenterProjectsFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r Nr r r1 r2 r r 1 r r1 r c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) ;SecuritycenterProjectsLocationsBigQueryExportsCreateRequesti1 a A SecuritycenterProjectsLocationsBigQueryExportsCreateRequest object.
Fields:
bigQueryExportId: Required. Unique identifier provided by the client
within the parent scope. It must consist of only lowercase letters,
numbers, and hyphens, must start with a letter, must end with either a
letter or a number, and must be 63 characters or less.
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
parent: Required. The name of the parent resource of the new BigQuery
export. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r Nr r r1 r2 r r 1 r r1 r c : \ rS rSrSr\R " SSS9rSrg);SecuritycenterProjectsLocationsBigQueryExportsDeleteRequesti1 a A SecuritycenterProjectsLocationsBigQueryExportsDeleteRequest object.
Fields:
name: Required. The name of the BigQuery export to delete. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}/locations/{location}/bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 r r 1 r r1 r c : \ rS rSrSr\R " SSS9rSrg)8SecuritycenterProjectsLocationsBigQueryExportsGetRequesti1 a A SecuritycenterProjectsLocationsBigQueryExportsGetRequest object.
Fields:
name: Required. Name of the BigQuery export to retrieve. The following
list shows some examples of the format: + `organizations/{organization}/
locations/{location}/bigQueryExports/{export_id}` +
`folders/{folder}/locations/{location}/bigQueryExports/{export_id}` +
`projects/{project}locations/{location}//bigQueryExports/{export_id}`
r Tr r Nrs r r1 r2 r r 1 r r1 r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) 9SecuritycenterProjectsLocationsBigQueryExportsListRequesti1 aF A SecuritycenterProjectsLocationsBigQueryExportsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListBigQueryExports`
call. Provide this to retrieve the subsequent page. When paginating, all
other parameters provided to `ListBigQueryExports` must match the call
that provided the page token.
parent: Required. The parent, which owns the collection of BigQuery
exports. Its format is
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r1 r2 r r 1 r r1 r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) :SecuritycenterProjectsLocationsBigQueryExportsPatchRequesti2 a[ A SecuritycenterProjectsLocationsBigQueryExportsPatchRequest object.
Fields:
googleCloudSecuritycenterV2BigQueryExport: A
GoogleCloudSecuritycenterV2BigQueryExport resource to be passed as the
request body.
name: Identifier. The relative resource name of this export. See: https://
cloud.google.com/apis/design/resource_names#relative_resource_name. The
following list shows some examples: + `organizations/{organization_id}/l
ocations/{location_id}/bigQueryExports/{export_id}` + `folders/{folder_i
d}/locations/{location_id}/bigQueryExports/{export_id}` + `projects/{pro
ject_id}/locations/{location_id}/bigQueryExports/{export_id}` This field
is provided in responses, and is ignored when provided in create
requests.
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r Nr r r1 r2 r r 2 r r1 r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
6SecuritycenterProjectsLocationsFindingsBulkMuteRequesti 2 ai A SecuritycenterProjectsLocationsFindingsBulkMuteRequest object.
Fields:
bulkMuteFindingsRequest: A BulkMuteFindingsRequest resource to be passed
as the request body.
parent: Required. The parent, at which bulk action needs to be applied. If
no location is specified, findings are updated in global. The following
list shows some examples: + `organizations/[organization_id]` +
`organizations/[organization_id]/locations/[location_id]` +
`folders/[folder_id]` + `folders/[folder_id]/locations/[location_id]` +
`projects/[project_id]` +
`projects/[project_id]/locations/[location_id]`
r# r r Tr r Nr r r1 r2 r r 2 r r1 r c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) 7SecuritycenterProjectsLocationsMuteConfigsCreateRequesti32 a A SecuritycenterProjectsLocationsMuteConfigsCreateRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
muteConfigId: Required. Unique identifier provided by the client within
the parent scope. It must consist of only lowercase letters, numbers,
and hyphens, must start with a letter, must end with either a letter or
a number, and must be 63 characters or less.
parent: Required. Resource name of the new mute configs's parent. Its
format is `organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r Nr r r1 r2 r r 32 r r1 r c : \ rS rSrSr\R " SSS9rSrg)7SecuritycenterProjectsLocationsMuteConfigsDeleteRequestiI2 a< A SecuritycenterProjectsLocationsMuteConfigsDeleteRequest object.
Fields:
name: Required. Name of the mute config to delete. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r
r
I2 r r1 r
c : \ rS rSrSr\R " SSS9rSrg)4SecuritycenterProjectsLocationsMuteConfigsGetRequestiZ2 a; A SecuritycenterProjectsLocationsMuteConfigsGetRequest object.
Fields:
name: Required. Name of the mute config to retrieve. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r
r
Z2 r r1 r
c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) 5SecuritycenterProjectsLocationsMuteConfigsListRequestik2 a A SecuritycenterProjectsLocationsMuteConfigsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListMuteConfigs` call.
Provide this to retrieve the subsequent page. When paginating, all other
parameters provided to `ListMuteConfigs` must match the call that
provided the page token.
parent: Required. The parent, which owns the collection of mute configs.
Its format is `organizations/[organization_id]", "folders/[folder_id]`,
`projects/[project_id]`,
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`,
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r1 r2 r
r
k2 r r1 r
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 6SecuritycenterProjectsLocationsMuteConfigsPatchRequesti2 aF A SecuritycenterProjectsLocationsMuteConfigsPatchRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
name: Identifier. This field will be ignored if provided on config
creation. The following list shows some examples of the format: +
`organizations/{organization}/muteConfigs/{mute_config}` + `organization
s/{organization}locations/{location}//muteConfigs/{mute_config}` +
`folders/{folder}/muteConfigs/{mute_config}` +
`folders/{folder}/locations/{location}/muteConfigs/{mute_config}` +
`projects/{project}/muteConfigs/{mute_config}` +
`projects/{project}/locations/{location}/muteConfigs/{mute_config}`
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r Nr r r1 r2 r
r
2 r r1 r
c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r
S r g
) ?SecuritycenterProjectsLocationsNotificationConfigsCreateRequesti2 a{ A SecuritycenterProjectsLocationsNotificationConfigsCreateRequest
object.
Fields:
configId: Required. Unique identifier provided by the client within the
parent scope. It must be between 1 and 128 characters and contain
alphanumeric characters, underscores, or hyphens only.
notificationConfig: A NotificationConfig resource to be passed as the
request body.
parent: Required. Resource name of the new notification config's parent.
Its format is `organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r rR r r Tr r Nr r r1 r2 r
r
2 rb r1 r
c : \ rS rSrSr\R " SSS9rSrg)?SecuritycenterProjectsLocationsNotificationConfigsDeleteRequesti2 a A SecuritycenterProjectsLocationsNotificationConfigsDeleteRequest
object.
Fields:
name: Required. Name of the notification config to delete. The following
list shows some examples of the format: + `organizations/[organization_i
d]/locations/[location_id]/notificationConfigs/[config_id]` + `folders/[
folder_id]/locations/[location_id]notificationConfigs/[config_id]` + `pr
ojects/[project_id]/locations/[location_id]notificationConfigs/[config_i
d]`
r Tr r Nrs r r1 r2 r
r
2 re r1 r
c : \ rS rSrSr\R " SSS9rSrg)SecuritycenterProjectsLocationsNotificationConfigsPatchRequesti2 a! A SecuritycenterProjectsLocationsNotificationConfigsPatchRequest object.
Fields:
name: Identifier. The relative resource name of this notification config.
See: https://cloud.google.com/apis/design/resource_names#relative_resour
ce_name The following list shows some examples: + `organizations/{organi
zation_id}/locations/{location_id}/notificationConfigs/notify_public_buc
ket` + `folders/{folder_id}/locations/{location_id}/notificationConfigs/
notify_public_bucket` + `projects/{project_id}/locations/{location_id}/n
otificationConfigs/notify_public_bucket`
notificationConfig: A NotificationConfig resource to be passed as the
request body.
updateMask: The FieldMask to use when updating the notification config. If
empty all mutable fields will be updated.
r Tr rR r r r Nr r r1 r2 r
r
2 r r1 r
c \ rS rSrSr\R " SS5 r\R " S5 r \R " SSS9r
S r g
) .SecuritycenterProjectsMuteConfigsCreateRequesti2 a A SecuritycenterProjectsMuteConfigsCreateRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
muteConfigId: Required. Unique identifier provided by the client within
the parent scope. It must consist of only lowercase letters, numbers,
and hyphens, must start with a letter, must end with either a letter or
a number, and must be 63 characters or less.
parent: Required. Resource name of the new mute configs's parent. Its
format is `organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`, or
`projects/[project_id]/locations/[location_id]`.
r r r r Tr r Nr r r1 r2 r
r
2 r r1 r
c : \ rS rSrSr\R " SSS9rSrg).SecuritycenterProjectsMuteConfigsDeleteRequesti3 a3 A SecuritycenterProjectsMuteConfigsDeleteRequest object.
Fields:
name: Required. Name of the mute config to delete. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r
r
3 r r1 r
c : \ rS rSrSr\R " SSS9rSrg)+SecuritycenterProjectsMuteConfigsGetRequesti"3 a2 A SecuritycenterProjectsMuteConfigsGetRequest object.
Fields:
name: Required. Name of the mute config to retrieve. The following list
shows some examples of the format: +
`organizations/{organization}/muteConfigs/{config_id}` + `organizations/
{organization}/locations/{location}/muteConfigs/{config_id}` +
`folders/{folder}/muteConfigs/{config_id}` +
`folders/{folder}/locations/{location}/muteConfigs/{config_id}` +
`projects/{project}/muteConfigs/{config_id}` +
`projects/{project}/locations/{location}/muteConfigs/{config_id}`
r Tr r Nrs r r1 r2 r
r
"3 r r1 r
c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) ,SecuritycenterProjectsMuteConfigsListRequesti33 a A SecuritycenterProjectsMuteConfigsListRequest object.
Fields:
pageSize: The maximum number of configs to return. The service may return
fewer than this value. If unspecified, at most 10 configs will be
returned. The maximum value is 1000; values above 1000 will be coerced
to 1000.
pageToken: A page token, received from a previous `ListMuteConfigs` call.
Provide this to retrieve the subsequent page. When paginating, all other
parameters provided to `ListMuteConfigs` must match the call that
provided the page token.
parent: Required. The parent, which owns the collection of mute configs.
Its format is `organizations/[organization_id]", "folders/[folder_id]`,
`projects/[project_id]`,
`organizations/[organization_id]/locations/[location_id]`,
`folders/[folder_id]/locations/[location_id]`,
`projects/[project_id]/locations/[location_id]`.
r r} r r Tr r Nr r r1 r2 r
r
33 r r1 r
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) -SecuritycenterProjectsMuteConfigsPatchRequestiL3 a= A SecuritycenterProjectsMuteConfigsPatchRequest object.
Fields:
googleCloudSecuritycenterV2MuteConfig: A
GoogleCloudSecuritycenterV2MuteConfig resource to be passed as the
request body.
name: Identifier. This field will be ignored if provided on config
creation. The following list shows some examples of the format: +
`organizations/{organization}/muteConfigs/{mute_config}` + `organization
s/{organization}locations/{location}//muteConfigs/{mute_config}` +
`folders/{folder}/muteConfigs/{mute_config}` +
`folders/{folder}/locations/{location}/muteConfigs/{mute_config}` +
`projects/{project}/muteConfigs/{mute_config}` +
`projects/{project}/locations/{location}/muteConfigs/{mute_config}`
updateMask: The list of fields to be updated. If empty all mutable fields
will be updated.
r r r Tr r r Nr r r1 r2 r
r
L3 r r1 r
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) @SecuritycenterProjectsSourcesFindingsExternalSystemsPatchRequestid3 a A SecuritycenterProjectsSourcesFindingsExternalSystemsPatchRequest
object.
Fields:
googleCloudSecuritycenterV2ExternalSystem: A
GoogleCloudSecuritycenterV2ExternalSystem resource to be passed as the
request body.
name: Full resource name of the external system. The following list shows
some examples: +
`organizations/1234/sources/5678/findings/123456/externalSystems/jira` +
`organizations/1234/sources/5678/locations/us/findings/123456/externalSy
stems/jira` +
`folders/1234/sources/5678/findings/123456/externalSystems/jira` + `fold
ers/1234/sources/5678/locations/us/findings/123456/externalSystems/jira`
+ `projects/1234/sources/5678/findings/123456/externalSystems/jira` + `p
rojects/1234/sources/5678/locations/us/findings/123456/externalSystems/j
ira`
updateMask: The FieldMask to use when updating the external system
resource. If empty all mutable fields will be updated.
r r r Tr r r Nr r r1 r2 r
r
d3 r r1 r
c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
1SecuritycenterProjectsSourcesFindingsGroupRequesti3 av A SecuritycenterProjectsSourcesFindingsGroupRequest object.
Fields:
groupFindingsRequest: A GroupFindingsRequest resource to be passed as the
request body.
parent: Required. Name of the source to groupBy. If no location is
specified, finding is assumed to be in global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
groupBy across all sources provide a source_id of `-`. The following
list shows some examples: + `organizations/{organization_id}/sources/-`
+ `organizations/{organization_id}/sources/-/locations/[location_id]` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-/locations/[location_id]` +
`projects/{project_id}/sources/-` +
`projects/{project_id}/sources/-/locations/[location_id]`
r r r Tr r Nr r r1 r2 r
r
3 r r1 r
c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S\R R S9r
\R " S5 r\R " S S
S 9rS rg
)0SecuritycenterProjectsSourcesFindingsListRequesti3 a A SecuritycenterProjectsSourcesFindingsListRequest object.
Fields:
fieldMask: A field mask to specify the Finding fields to be listed in the
response. An empty field mask will list all fields.
filter: Expression that defines the filter to apply across findings. The
expression is a list of one or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. Examples include: *
name * security_marks.marks.marka The supported operators are: * `=` for
all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r1 r2 r!
r!
3 r r1 r!
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) 1SecuritycenterProjectsSourcesFindingsPatchRequesti3 a A SecuritycenterProjectsSourcesFindingsPatchRequest object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r Nr r r1 r2 r#
r#
3 r r1 r#
c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
3SecuritycenterProjectsSourcesFindingsSetMuteRequesti3 a A SecuritycenterProjectsSourcesFindingsSetMuteRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setMuteRequest: A SetMuteRequest resource to be passed as the request
body.
r Tr r r r Nr r r1 r2 r%
r%
3 r! r1 r%
c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
4SecuritycenterProjectsSourcesFindingsSetStateRequesti4 a A SecuritycenterProjectsSourcesFindingsSetStateRequest object.
Fields:
name: Required. The [relative resource name](https://cloud.google.com/apis
/design/resource_names#relative_resource_name) of the finding. If no
location is specified, finding is assumed to be in global. The following
list shows some examples: + `organizations/{organization_id}/sources/{so
urce_id}/findings/{finding_id}` + `organizations/{organization_id}/sourc
es/{source_id}/locations/{location_id}/findings/{finding_id}` +
`folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `folde
rs/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{fin
ding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
setFindingStateRequest: A SetFindingStateRequest resource to be passed as
the request body.
r Tr r$ r r Nr% r r1 r2 r'
r'
4 r' r1 r'
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ?SecuritycenterProjectsSourcesFindingsUpdateSecurityMarksRequesti)4 a A SecuritycenterProjectsSourcesFindingsUpdateSecurityMarksRequest
object.
Fields:
googleCloudSecuritycenterV2SecurityMarks: A
GoogleCloudSecuritycenterV2SecurityMarks resource to be passed as the
request body.
name: The relative resource name of the SecurityMarks. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me The following list shows some examples: +
`organizations/{organization_id}/assets/{asset_id}/securityMarks` + `org
anizations/{organization_id}/sources/{source_id}/findings/{finding_id}/s
ecurityMarks` + `organizations/{organization_id}/sources/{source_id}/loc
ations/{location}/findings/{finding_id}/securityMarks`
updateMask: The FieldMask to use when updating the security marks
resource. The field mask must not contain duplicate fields. If empty or
set to "marks", all marks will be replaced. Individual marks can be
updated using "marks.".
r. r r Tr r r Nr r r1 r2 r)
r)
)4 r r1 r)
c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) (SecuritycenterProjectsSourcesListRequestiC4 a8 A SecuritycenterProjectsSourcesListRequest object.
Fields:
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListSourcesResponse`; indicates
that this is a continuation of a prior `ListSources` call, and that the
system should return the next page of data.
parent: Required. Resource name of the parent of sources to list. Its
format should be `organizations/[organization_id]`,
`folders/[folder_id]`, or `projects/[project_id]`.
r r} r r Tr r Nr r r1 r2 r+
r+
C4 r, r1 r+
c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
;SecuritycenterProjectsSourcesLocationsFindingsExportRequestiV4 a; A SecuritycenterProjectsSourcesLocationsFindingsExportRequest object.
Fields:
exportFindingsRequest: A ExportFindingsRequest resource to be passed as
the request body.
parent: Required. The relative name of the export scope. Example formats:
organizations/{organization}/sources/-/locations/{location}
r r r Tr r Nr/ r r1 r2 r-
r-
V4 r1 r1 r-
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) ISecuritycenterProjectsSourcesLocationsFindingsExternalSystemsPatchRequestid4 a A
SecuritycenterProjectsSourcesLocationsFindingsExternalSystemsPatchRequest
object.
Fields:
googleCloudSecuritycenterV2ExternalSystem: A
GoogleCloudSecuritycenterV2ExternalSystem resource to be passed as the
request body.
name: Full resource name of the external system. The following list shows
some examples: +
`organizations/1234/sources/5678/findings/123456/externalSystems/jira` +
`organizations/1234/sources/5678/locations/us/findings/123456/externalSy
stems/jira` +
`folders/1234/sources/5678/findings/123456/externalSystems/jira` + `fold
ers/1234/sources/5678/locations/us/findings/123456/externalSystems/jira`
+ `projects/1234/sources/5678/findings/123456/externalSystems/jira` + `p
rojects/1234/sources/5678/locations/us/findings/123456/externalSystems/j
ira`
updateMask: The FieldMask to use when updating the external system
resource. If empty all mutable fields will be updated.
r r r Tr r r Nr r r1 r2 r/
r/
d4 r4 r1 r/
c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
:SecuritycenterProjectsSourcesLocationsFindingsGroupRequesti4 a A SecuritycenterProjectsSourcesLocationsFindingsGroupRequest object.
Fields:
groupFindingsRequest: A GroupFindingsRequest resource to be passed as the
request body.
parent: Required. Name of the source to groupBy. If no location is
specified, finding is assumed to be in global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
groupBy across all sources provide a source_id of `-`. The following
list shows some examples: + `organizations/{organization_id}/sources/-`
+ `organizations/{organization_id}/sources/-/locations/[location_id]` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-/locations/[location_id]` +
`projects/{project_id}/sources/-` +
`projects/{project_id}/sources/-/locations/[location_id]`
r r r Tr r Nr r r1 r2 r1
r1
4 r r1 r1
c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S\R R S9r
\R " S5 r\R " S S
S 9rS rg
)9SecuritycenterProjectsSourcesLocationsFindingsListRequesti4 a A SecuritycenterProjectsSourcesLocationsFindingsListRequest object.
Fields:
fieldMask: A field mask to specify the Finding fields to be listed in the
response. An empty field mask will list all fields.
filter: Expression that defines the filter to apply across findings. The
expression is a list of one or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. Examples include: *
name * security_marks.marks.marka The supported operators are: * `=` for
all value types. * `>`, `<`, `>=`, `<=` for integer values. * `:`,
meaning substring matching, for strings. The supported value types are:
* string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes. The following field
and operator combinations are supported: * name: `=` * parent: `=`, `:`
* resource_name: `=`, `:` * state: `=`, `:` * category: `=`, `:` *
external_uri: `=`, `:` * event_time: `=`, `>`, `<`, `>=`, `<=` Usage:
This should be milliseconds since epoch or an RFC3339 string. Examples:
`event_time = "2019-06-10T16:07:18-07:00"` `event_time = 1560208038000`
* severity: `=`, `:` * security_marks.marks: `=`, `:` * resource: *
resource.name: `=`, `:` * resource.parent_name: `=`, `:` *
resource.parent_display_name: `=`, `:` * resource.project_name: `=`, `:`
* resource.project_display_name: `=`, `:` * resource.type: `=`, `:` *
resource.folders.resource_folder: `=`, `:` * resource.display_name: `=`,
`:`
orderBy: Expression that defines what fields and order to use for sorting.
The string value should follow SQL syntax: comma separated list of
fields. For example: "name,parent". The default sorting order is
ascending. To specify descending order for a field, a suffix " desc"
should be appended to the field name. For example: "name desc,parent".
Redundant space characters in the syntax are insignificant. "name
desc,parent" and " name desc , parent " are equivalent. The following
fields are supported: name parent state category resource_name
event_time security_marks.marks
pageSize: The maximum number of results to return in a single response.
Default is 10, minimum is 1, maximum is 1000.
pageToken: The value returned by the last `ListFindingsResponse`;
indicates that this is a continuation of a prior `ListFindings` call,
and that the system should return the next page of data.
parent: Required. Name of the source the findings belong to. If no
location is specified, the default is global. The following list shows
some examples: + `organizations/[organization_id]/sources/[source_id]` +
`organizations/[organization_id]/sources/[source_id]/locations/[location
_id]` + `folders/[folder_id]/sources/[source_id]` +
`folders/[folder_id]/sources/[source_id]/locations/[location_id]` +
`projects/[project_id]/sources/[source_id]` +
`projects/[project_id]/sources/[source_id]/locations/[location_id]` To
list across all sources provide a source_id of `-`. The following list
shows some examples: + `organizations/{organization_id}/sources/-` +
`organizations/{organization_id}/sources/-/locations/{location_id}` +
`folders/{folder_id}/sources/-` +
`folders/{folder_id}/sources/-locations/{location_id}` +
`projects/{projects_id}/sources/-` +
`projects/{projects_id}/sources/-/locations/{location_id}`
r r r r r} r r Tr r Nr r r1 r2 r3
r3
4 r r1 r3
c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) :SecuritycenterProjectsSourcesLocationsFindingsPatchRequesti4 a A SecuritycenterProjectsSourcesLocationsFindingsPatchRequest object.
Fields:
googleCloudSecuritycenterV2Finding: A GoogleCloudSecuritycenterV2Finding
resource to be passed as the request body.
name: Identifier. The [relative resource name](https://cloud.google.com/ap
is/design/resource_names#relative_resource_name) of the finding. The
following list shows some examples: + `organizations/{organization_id}/s
ources/{source_id}/findings/{finding_id}` + `organizations/{organization
_id}/sources/{source_id}/locations/{location_id}/findings/{finding_id}`
+ `folders/{folder_id}/sources/{source_id}/findings/{finding_id}` + `fol
ders/{folder_id}/sources/{source_id}/locations/{location_id}/findings/{f
inding_id}` +
`projects/{project_id}/sources/{source_id}/findings/{finding_id}` + `pro
jects/{project_id}/sources/{source_id}/locations/{location_id}/findings/
{finding_id}`
updateMask: The FieldMask to use when updating the finding resource. This
field should not be specified when creating a finding. When updating a
finding, an empty mask is treated as updating all mutable fields and
replacing source_properties. Individual source_properties can be
added/updated by using "source_properties." in the field mask.
r
r r Tr r r Nr r r1 r2 r5
r5
4 r r1 r5
c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
P5 r r1 r r r Nr r r1 r2 r1 r1 E5 r r1 r1 c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r ij5 r r r r Nr r r1 r2 r r j5 r r1 r c h \ rS rSrSr " S S\R 5 r\R " SS5 r Sr
g)r$ i}5 zRequest message for updating a finding's state.
Enums:
StateValueValuesEnum: Required. The desired State of the finding.
Fields:
state: Required. The desired State of the finding.
c $ \ rS rSrSrSrSrSrSrg)+SetFindingStateRequest.StateValueValuesEnumi5 a Required. The desired State of the finding.
Values:
STATE_UNSPECIFIED: Unspecified state.
ACTIVE: The finding requires attention and has not been addressed yet.
INACTIVE: The finding has been fixed, triaged as a non-issue or
otherwise addressed and is no longer active.
r r r r Nr r r1 r2 r rB
5 r r1 r r r N) r r r r r! r" ra r rb r r0 r r1 r2 r$ r$ }5 s, Y^^
4a
8%r1 r$ c b \ rS rSrSr\R " SS5 r\R " S5 r Sr
g)r i5 a
Request message for `SetIamPolicy` method.
Fields:
policy: REQUIRED: The complete policy to be applied to the `resource`. The
size of the policy is limited to a few 10s of KB. An empty policy is a
valid policy but certain Google Cloud services (such as Projects) might
reject them.
updateMask: OPTIONAL: A FieldMask specifying which fields of the policy to
modify. Only the fields in the mask will be modified. If no mask is
provided, the following default mask is used: `paths: "bindings, etag"`
r r r r N) r r r r r! r" r% r r# r r0 r r1 r2 r r 5 s+
! !(A .&$$Q'*r1 r c h \ rS rSrSr " S S\R 5 r\R " SS5 r Sr
g)r i5 zRequest message for updating a finding's mute status.
Enums:
MuteValueValuesEnum: Required. The desired state of the Mute.
Fields:
mute: Required. The desired state of the Mute.
c ( \ rS rSrSrSrSrSrSrSr g) "SetMuteRequest.MuteValueValuesEnumi5 zRequired. The desired state of the Mute.
Values:
MUTE_UNSPECIFIED: Unspecified.
MUTED: Finding has been muted.
UNMUTED: Finding has been unmuted.
UNDEFINED: Finding has never been muted/unmuted.
r r r r r Nr r r1 r2 r rF
5 s
EGIr1 r r r N) r r r r r! r" ra r rb rj r0 r r1 r2 r r 5 s, INN
2A 6$r1 r c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r \R " SS S
S 9rS rg
)
Simulationi5 a Attack path simulation
Enums:
CloudProviderValueValuesEnum: Indicates which cloud provider was used in
this simulation.
Fields:
cloudProvider: Indicates which cloud provider was used in this simulation.
createTime: Output only. Time simulation was created
name: Full resource name of the Simulation:
`organizations/123/simulations/456`
resourceValueConfigsMetadata: Resource value configurations' metadata used
in this simulation. Maximum of 100.
c ( \ rS rSrSrSrSrSrSrSr g) 'Simulation.CloudProviderValueValuesEnumi5 a? Indicates which cloud provider was used in this simulation.
Values:
CLOUD_PROVIDER_UNSPECIFIED: The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM: The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES: The cloud provider is Amazon Web Services.
MICROSOFT_AZURE: The cloud provider is Microsoft Azure.
r r r r r Nr r r1 r2 r rJ
5 r r1 r r r r r r Tr r N)r r r r r! r" ra r rb r r# r r9 r% resourceValueConfigsMetadatar0 r r1 r2 rH
rH
5 sd
Y^^ %%&DaH-$$Q'* q !$!*!7!78UWXcg!h r1 rH
c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) r\ i5 a Security Command Center finding source. A finding source is an entity or
a mechanism that can produce a finding. A source is like a container of
findings that come from the same scanner, logger, monitor, and other tools.
Fields:
canonicalName: The canonical name of the finding source. It's either
"organizations/{organization_id}/sources/{source_id}",
"folders/{folder_id}/sources/{source_id}", or
"projects/{project_number}/sources/{source_id}", depending on the
closest CRM ancestor of the resource associated with the finding.
description: The description of the source (max of 1024 characters).
Example: "Web Security Scanner is a web security scanner for common
vulnerabilities in App Engine applications. It can automatically scan
and detect four common vulnerabilities, including cross-site-scripting
(XSS), Flash injection, mixed content (HTTP in HTTPS), and outdated or
insecure libraries."
displayName: The source's display name. A source's display name must be
unique amongst its siblings, for example, two sources with the same
parent can't share the same display name. The display name must have a
length between 1 and 64 characters (inclusive).
name: The relative resource name of this source. See:
https://cloud.google.com/apis/design/resource_names#relative_resource_na
me Example: "organizations/{organization_id}/sources/{source_id}"
r r r r r N) r r r r r! r" r# rL r rd r9 r0 r r1 r2 r\ r\ 5 sI 2 ''*-%%a(+%%a(+ q !$r1 r\ c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " S5 r \R " SS S
S 9r
\R " S 5 r\R " S
5 r\R " S5 r\R " S5 r\R$ " SSS 9r\R " S5 r\R " S5 r\R " S5 r\R " S5 rSrg)StandardQueryParametersi6 a Query parameters accepted by all methods.
Enums:
FXgafvValueValuesEnum: V1 error format.
AltValueValuesEnum: Data format for response.
Fields:
f__xgafv: V1 error format.
access_token: OAuth access token.
alt: Data format for response.
callback: JSONP
fields: Selector specifying which fields to include in a partial response.
key: API key. Your API key identifies your project and provides you with
API access, quota, and reports. Required unless you provide an OAuth 2.0
token.
oauth_token: OAuth 2.0 token for the current user.
prettyPrint: Returns response with indentations and line breaks.
quotaUser: Available to use for quota purposes for server-side
applications. Can be any arbitrary string assigned to a user, but should
not exceed 40 characters.
trace: A tracing token of the form "token:" to include in api
requests.
uploadType: Legacy upload protocol for media (e.g. "media", "multipart").
upload_protocol: Upload protocol for media (e.g. "raw", "multipart").
c $ \ rS rSrSrSrSrSrSrg)*StandardQueryParameters.AltValueValuesEnumi"6 zData format for response.
Values:
json: Responses with Content-Type of application/json
media: Media download with context-dependent Content-Type
proto: Responses with Content-Type of application/x-protobuf
r r r r N) r r r r r! jsonmediaprotor0 r r1 r2 AltValueValuesEnumrP
"6 s
D
E
Er1 rT
c \ rS rSrSrSrSrSrg)-StandardQueryParameters.FXgafvValueValuesEnumi.6 zFV1 error format.
Values:
_1: v1 error format
_2: v2 error format
r r r N)r r r r r! _1_2r0 r r1 r2 FXgafvValueValuesEnumrV
.6 s
B
Br1 rY
r r r rQ
)defaultr r r r r Tr r r r r N)r r r r r! r" ra rT
rY
rb f__xgafvr# access_tokenaltcallbackfieldsr oauth_tokenrd prettyPrint quotaUsertrace
uploadTypeupload_protocolr0 r r1 r2 rN
rN
6 s 4
9>>
inn
!8!
<(&&q), 0!VD#
"
"1
%( #& a #%%a(+&&q$7+##A&)
#%$$R(* ))"-/r1 rN
c \ rS rSrSr " S S\R 5 r\R " S5 r \R " SS5 r Sr g) ro iF6 r c ( \ rS rSrSrSrSrSrSrSr g) StaticMute.StateValueValuesEnumiV6 r r r r r r Nr r r1 r2 r rh
V6 r r1 r r r r Nr r r1 r2 ro ro F6 r r1 ro c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S\R R S9r
\R " SSS S
9r\R " S 5 rS rg
)r ii6 a The `Status` type defines a logical error model that is suitable for
different programming environments, including REST APIs and RPC APIs. It is
used by [gRPC](https://github.com/grpc). Each `Status` message contains
three pieces of data: error code, error message, and error details. You can
find out more about this error model and how to work with it in the [API
Design Guide](https://cloud.google.com/apis/design/errors).
Messages:
DetailsValueListEntry: A DetailsValueListEntry object.
Fields:
code: The status code, which should be an enum value of google.rpc.Code.
details: A list of messages that carry the error details. There is a
common set of message types for APIs to use.
message: A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
google.rpc.Status.details field, or localized by the client.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Status.DetailsValueListEntryi}6 zA DetailsValueListEntry object.
Messages:
AdditionalProperty: An additional property for a DetailsValueListEntry
object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)/Status.DetailsValueListEntry.AdditionalPropertyi6 zAn additional property for a DetailsValueListEntry object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r Nr r r1 r2 r rm
6 r r1 r r Tr r Nr r r1 r2 DetailsValueListEntryrk
}6 s4 AY . . A %112FTXYr1 rn
r r} r Tr r r N)r r r r r! r r r" r rn
rM r r coder% detailsr# messager0 r r1 r2 r r i6 s| & !!"89Zi / / Z :Z2
9+<+<+B+B C$ " "#:A M' ! !! $'r1 r c < \ rS rSrSr\R " S5 rSrg)ru i6 a The config for streaming-based notifications, which send each event as
soon as it is detected.
Fields:
filter: Expression that defines the filter to apply across create/update
events of assets or findings as specified by the event type. The
expression is a list of zero or more restrictions combined via logical
operators `AND` and `OR`. Parentheses are supported, and `OR` has higher
precedence than `AND`. Restrictions have the form ` ` and may have a `-`
character in front of them to indicate negation. The fields map to those
defined in the corresponding resource. The supported operators are: *
`=` for all value types. * `>`, `<`, `>=`, `<=` for integer values. *
`:`, meaning substring matching, for strings. The supported value types
are: * string literals in quotes. * integer literals without quotes. *
boolean literals `true` and `false` without quotes.
r r N) r r r r r! r" r# r* r0 r r1 r2 ru ru 6 s " #&r1 ru c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " S5 r \R " S5 r Sr
g )
r i6 r c ( \ rS rSrSrSrSrSrSrSr g) Subject.KindValueValuesEnumi6 r r r r r r Nr r r1 r2 r ru
6 r r1 r r r r r Nr r r1 r2 r r 6 r r1 r c : \ rS rSrSr\R " SSS9rSrg)r i6 a3 Request message for `TestIamPermissions` method.
Fields:
permissions: The set of permissions to check for the `resource`.
Permissions with wildcards (such as `*` or `storage.*`) are not allowed.
For more information see [IAM
Overview](https://cloud.google.com/iam/docs/overview#permissions).
r Tr r N r r r r r! r" r# permissionsr0 r r1 r2 r r 6 s %%a$7+r1 r c : \ rS rSrSr\R " SSS9rSrg)TestIamPermissionsResponsei6 zResponse message for `TestIamPermissions` method.
Fields:
permissions: A subset of `TestPermissionsRequest.permissions` that the
caller is allowed.
r Tr r Nrw
r r1 r2 rz
rz
6 s %%a$7+r1 rz
c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
\R " S5 r \R " S5 r S r
g
) r i6 r r r r r r r r Nr r r1 r2 r r 6 r r1 r c ^ \ rS rSrSr\R " S5 r\R " SSS9r Sr
g) r@ i6 r r r Tr r Nr r r1 r2 r@ r@ 6 r r1 r@ c @ \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r \R " S5 r \R " S5 r
\R " S 5 r\R " SS
5 r\R" " S S S
S9rSrg)r_ i7 aw A resource that is determined to have value to a user's system
Enums:
ResourceValueValueValuesEnum: How valuable this resource is.
Fields:
displayName: Human-readable name of the valued resource.
exposedScore: Exposed score for this valued resource. A value of 0 means
no exposure was detected exposure.
name: Valued resource name, for example, e.g.:
`organizations/123/simulations/456/valuedResources/789`
resource: The [full resource name](https://cloud.google.com/apis/design/re
source_names#full_resource_name) of the valued resource.
resourceType: The [resource type](https://cloud.google.com/asset-
inventory/docs/supported-asset-types) of the valued resource.
resourceValue: How valuable this resource is.
resourceValueConfigsUsed: List of resource value configurations' metadata
used to determine the value of this resource. Maximum of 100.
c ( \ rS rSrSrSrSrSrSrSr g) +ValuedResource.ResourceValueValueValuesEnumi(7 a How valuable this resource is.
Values:
RESOURCE_VALUE_UNSPECIFIED: The resource value isn't specified.
RESOURCE_VALUE_LOW: This is a low-value resource.
RESOURCE_VALUE_MEDIUM: This is a medium-value resource.
RESOURCE_VALUE_HIGH: This is a high-value resource.
r r r r r N)
r r r r r! r RESOURCE_VALUE_LOWRESOURCE_VALUE_MEDIUMRESOURCE_VALUE_HIGHr0 r r1 r2 r r
(7 s! "# r1 r r r r r r r r r Tr r N)r r r r r! r" ra r r# rd rE exposedScorer9 r; r rb r r% resourceValueConfigsUsedr0 r r1 r2 r_ r_ 7 s ( Y^^ %%a(+%%a(, q !$
"
"1
%(&&q),%%&DaH- & 3 34QST_c dr1 r_ c ` \ rS rSrSr\R " SSSS9r\R " SSSS9rS r g
) rB i?7 r rc r Tr r r r Nr r r1 r2 rB rB ?7 s1
#
#Iq4
@($$ZTB)r1 rB c \ rS rSrSr\R " SS5 r\R " SSSS9r\R " S S
5 r \R " S S 5 r
\R " S 5 r \R " S
5 r\R " SS5 rSrg)rD iK7 r r r r* r Tr r r r r r r r r Nr r r1 r2 rD rD K7 s ua(# q4 8$'' 15, ++Iq9 ,,Q/$$Q') ++,>Br1 rD c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " SS5 r Sr g) VulnerabilityCountBySeverityie7 zVulnerability count by severity.
Messages:
SeverityToFindingCountValue: Key is the Severity enum.
Fields:
severityToFindingCount: Key is the Severity enum.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
8VulnerabilityCountBySeverity.SeverityToFindingCountValueio7 zKey is the Severity enum.
Messages:
AdditionalProperty: An additional property for a
SeverityToFindingCountValue object.
Fields:
additionalProperties: Additional properties of type
SeverityToFindingCountValue
c ` \ rS rSrSr\R " S5 r\R " S5 r Sr
g)KVulnerabilityCountBySeverity.SeverityToFindingCountValue.AdditionalPropertyi|7 zAn additional property for a SeverityToFindingCountValue object.
Fields:
key: Name of the additional property.
value: A string attribute.
r r r N) r r r r r! r" r# r rM r r0 r r1 r2 r r
|7 s)
! !! $c$$Q'er1 r r Tr r Nr r r1 r2 SeverityToFindingCountValuer
o7 s2 (Y . . ( %112FTXYr1 r
r r N)
r r r r r! r r r" r r
r% severityToFindingCountr0 r r1 r2 r
r
e7 sN !!"89ZI$5$5 Z :Z2 %112OQRSr1 r
c \ rS rSrSr " S S\R 5 r\R " SS5 r \R " SS5 r \R " S5 r
\R " S 5 rS
rg ) VulnerabilitySnapshoti7 a Result containing the properties and count of a VulnerabilitySnapshot
request.
Enums:
CloudProviderValueValuesEnum: The cloud provider for the vulnerability
snapshot.
Fields:
cloudProvider: The cloud provider for the vulnerability snapshot.
findingCount: The vulnerability count by severity.
name: Identifier. The vulnerability snapshot name. Format:
//locations//vulnerabilitySnapshots/
snapshotTime: The time that the snapshot was taken.
c ( \ rS rSrSrSrSrSrSrSr g) 2VulnerabilitySnapshot.CloudProviderValueValuesEnumi7 a6 The cloud provider for the vulnerability snapshot.
Values:
CLOUD_PROVIDER_UNSPECIFIED: The cloud provider is unspecified.
GOOGLE_CLOUD_PLATFORM: The cloud provider is Google Cloud.
AMAZON_WEB_SERVICES: The cloud provider is Amazon Web Services.
MICROSOFT_AZURE: The cloud provider is Microsoft Azure.
r r r r r Nr r r1 r2 r r
7 r r1 r r r
r r r r N)r r r r r! r" ra r rb r r% findingCountr# r9 snapshotTimer0 r r1 r2 r
r
7 s_
Y^^ %%&DaH-''(FJ, q !$&&q),r1 r
c < \ rS rSrSr\R " S5 rSrg)r i7 r r r Nr r r1 r2 r r 7 r r1 r r[
z$.xgafvrW
1rX
2N( r!
__future__r apitools.base.protorpcliter r" apitools.base.pyr r packager r r4 rA rI rQ rk rs rz r r r r r r r r r r r r r r r r r r r r r r# r- r0 r6 rA rP ra rk rs rz r r r r r r r r r* r. r@ rI r\ rc rg rj rq rv r} r r r r r r r r r r r r~ r| r r
r r r r r r r r r r r r r r r r! r. r rE rI rT rV rW rZ rR rj rn rp rr rt rx r| r~ r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r
r r rk r r r! r ry r" r} r r r r r r r r r r r r r r r r r r r r# r$ r% r r& r' r r( r r) r* r r r+ r/ r r, r7 r@ r rG rg r- rZ r r r0 r r r r r r. r r/ r rb rl r r r r0 r1 r2 rk r r r r r r r[ rn r r r r r rB rE rH rI rN rQ rU rY r[ r^ r r! rd r# r( r- r= r< r0 rR r> rV r2 r r r r? r r r3 r6 r/ r r8 rL r r r r r r9 r9 r; r r r r r r r r r r r r r r r r r r r r r r r r r
r r r r# r) r+ r. r3 r6 r8 r: r< r> r@ rC rE rI rK rM rO rQ rS rU rW rY r[ r] r_ ra rd rg ri rl rn rr ru rw ry r} r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r
r!
r#
r%
r'
r)
r+
r-
r/
r1
r3
r5
r7
r9
r;
r1 r r$ r r rH
r\ rN
ro r ru r r rz
r r@ r_ rB rD r
r
r AddCustomJsonFieldMappingAddCustomJsonEnumMappingrY
r r1 r2 r
s! ' < % ( :'Y
:'z%9$$ %:
'**
' $ )) $)'i )'X?i ? %)## % ,Y
,*.9Y&& .9b I"" I
$Y&&
$"Y&& "8="Y&& ="@%)## %: =Y&& =D
"""
"Z)## Z" i'' "I - - "$
9,,
4I%% 4& "** "
))
)##
:*Y . . :*zZY->-> Zti.?.? t%)++ %T"i T"n,Ai / / ,A^"I%% "4 <"" < *"" *< G9$$ G> C)++ CD(** (.' )) '*
%""
%
E ))
E (J"" (JV#i #AY&& A! !! !* )i ) dy'8'8 dP')
P'fQMY
QMh E)
E ",i'' ",J'.I%% '.T21!2!2 21j"%y "%J
$i
$ ?Y
? 0 !! 0 "9 " *y * ( )) ( I
!)++
!"I%% ""49$$ 4*
-Y . .
-II - - IY . . !#9 !#H#9 #: 7I%% 7>{>i {>|
7Y
7 <7 !! <7~0)## 0.()## (:)++ :Vy(( V*/( 0A0A /(dA):): A"K):K:K K1?i.?.? 1?h
_)2C2C
_@"iN_N_ @"F(8 0A0A (8VP(I,=,= P(f
NY5F5F
N 6)*;*; 6 E#)*;*; E#P:)2C2C :v)Y5F5F v)r 99;L;L 9>I(YEVEV I(X5_ @Q@Q 5_p 9 @Q@Q 9>K: 0A0A K:\ 7y/@/@ 7
UID"i6G6G D"N:' (9(9 :'z%i.?.? %:
'I4E4E
' $93D3D $)'):): )'XZ):): Z %Y->-> % , (9(9 ,*/9 0A0A /9d
"I,=,=
"uY->-> u" 1B1B "y7H7H "$
i6G6G
Oy/@/@ O& "I4E4E "
93D3D
Y->->
:* 8I8I :*z4( 0A0A 4(n\):): \"K):K:K K CY5F5F CD(I4E4E (.'93D3D '*
%I,=,=
%
`93D3D
` (JI,=,= (JV#):): #\ 0A0A \!9+<+< !* )):): )P'Y%6%6 P'fQM (9(9 QMh `Y%6%6 ` ",1B1B ",J'.y/@/@ '.T21IBY):): BYJ 7 (9(9 7 <79+<+< <7~(Y->-> (A1B1B A8 "I,=,= "@19+<+< 1,%)*;*; %(& (9(9 &"+;):): +;\W)y'8'8 W)t KY->-> KF ji.?.? j "1B1B ""i>O>O " ,9+<+< ,@-"y/@/@ -"`
"):K:K
"HIDUDU H&#yO`O` #7yO`O` 7:7yO`O` 7:g):K:K g "IDUDU "uI-> b
%JN(I,=,= N(b R)*;*; R "):): ""i&7&7 " V)*;*; V%)*;*; %$
NY5F5F
N (9(9 0"9+<+< "
,):):
, ")*;*; " Y%6%6 "#I4E4E #$ "9+<+< " &):): &F `)2C2C `@
!9+<+<
!P)*;*; P&7#)*;*; 7#t bi.?.? b)?)2C2C )?Xz)Y5F5F z)z i&7&7 :5)2C2C 5"K"y/@/@ K"\" 0A0A "& (1B1B (@5_ @Q@Q 5_p"9)2C2C "9J.i>O>O .& 9I,=,= 9F ):): @!I,=,= !,<)2C2C <( ^)*;*; ^^y/@/@ ^4&93D3D &$'9,, $'NII - - I"Ai'' A8$<)## $O>O 1 3y?P?P 30( @Q@Q (03IO>O 3((IL]L] (63Y=N=N 36?3IO>O 3,1i>O>O 1"19;L;L 1"3I ! !114>r1