diff --git a/google/cloud/securitycenter/v1/BUILD.bazel b/google/cloud/securitycenter/v1/BUILD.bazel
index 2e2ceb65f7..fcde3a3bdc 100644
--- a/google/cloud/securitycenter/v1/BUILD.bazel
+++ b/google/cloud/securitycenter/v1/BUILD.bazel
@@ -9,45 +9,14 @@
 #    * extra_protoc_file_parameters
 # The complete list of preserved parameters can be found in the source code.
 
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
 ##############################################################################
 # Common
 ##############################################################################
 load("@rules_proto//proto:defs.bzl", "proto_library")
-load(
-    "@com_google_googleapis_imports//:imports.bzl",
-    "cc_grpc_library",
-    "cc_proto_library",
-    "csharp_gapic_assembly_pkg",
-    "csharp_gapic_library",
-    "csharp_grpc_library",
-    "csharp_proto_library",
-    "go_gapic_assembly_pkg",
-    "go_gapic_library",
-    "go_proto_library",
-    "go_test",
-    "java_gapic_assembly_gradle_pkg",
-    "java_gapic_library",
-    "java_gapic_test",
-    "java_grpc_library",
-    "java_proto_library",
-    "nodejs_gapic_assembly_pkg",
-    "nodejs_gapic_library",
-    "php_gapic_assembly_pkg",
-    "php_gapic_library",
-    "php_grpc_library",
-    "php_proto_library",
-    "proto_library_with_info",
-    "py_gapic_assembly_pkg",
-    "py_gapic_library",
-    "py_test",
-    "ruby_cloud_gapic_library",
-    "ruby_gapic_assembly_pkg",
-    "ruby_grpc_library",
-    "ruby_proto_library",
-)
-
-# This is an API workspace, having public visibility by default makes perfect sense.
-package(default_visibility = ["//visibility:public"])
+load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
 
 proto_library(
     name = "securitycenter_proto",
@@ -60,6 +29,7 @@ proto_library(
         "contact_details.proto",
         "container.proto",
         "database.proto",
+        "effective_security_health_analytics_custom_module.proto",
         "exfiltration.proto",
         "external_system.proto",
         "file.proto",
@@ -78,6 +48,8 @@ proto_library(
         "process.proto",
         "resource.proto",
         "run_asset_discovery_response.proto",
+        "security_health_analytics_custom_config.proto",
+        "security_health_analytics_custom_module.proto",
         "security_marks.proto",
         "securitycenter_service.proto",
         "source.proto",
@@ -91,6 +63,7 @@ proto_library(
         "//google/iam/v1:iam_policy_proto",
         "//google/iam/v1:policy_proto",
         "//google/longrunning:operations_proto",
+        "//google/type:expr_proto",
         "@com_google_protobuf//:duration_proto",
         "@com_google_protobuf//:empty_proto",
         "@com_google_protobuf//:field_mask_proto",
@@ -107,6 +80,18 @@ proto_library_with_info(
     ],
 )
 
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_gapic_assembly_gradle_pkg",
+    "java_gapic_library",
+    "java_gapic_test",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
 java_proto_library(
     name = "securitycenter_java_proto",
     deps = [":securitycenter_proto"],
@@ -126,8 +111,8 @@ java_gapic_library(
     rest_numeric_enums = True,
     service_yaml = "securitycenter_v1.yaml",
     test_deps = [
-        ":securitycenter_java_grpc",
         "//google/iam/v1:iam_java_grpc",
+        ":securitycenter_java_grpc",
     ],
     transport = "grpc+rest",
     deps = [
@@ -159,6 +144,17 @@ java_gapic_assembly_gradle_pkg(
     ],
 )
 
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_gapic_assembly_pkg",
+    "go_gapic_library",
+    "go_proto_library",
+    "go_test",
+)
+
 go_proto_library(
     name = "securitycenter_go_proto",
     compilers = ["@io_bazel_rules_go//proto:go_grpc"],
@@ -168,6 +164,7 @@ go_proto_library(
         "//google/api:annotations_go_proto",
         "//google/iam/v1:iam_go_proto",
         "//google/longrunning:longrunning_go_proto",
+        "//google/type:expr_go_proto",
     ],
 )
 
@@ -210,6 +207,16 @@ go_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "py_gapic_assembly_pkg",
+    "py_gapic_library",
+    "py_test",
+)
+
 py_gapic_library(
     name = "securitycenter_py_gapic",
     srcs = [":securitycenter_proto"],
@@ -240,6 +247,17 @@ py_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_gapic_assembly_pkg",
+    "php_gapic_library",
+    "php_grpc_library",
+    "php_proto_library",
+)
+
 php_proto_library(
     name = "securitycenter_php_proto",
     deps = [":securitycenter_proto"],
@@ -274,6 +292,15 @@ php_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
 nodejs_gapic_library(
     name = "securitycenter_nodejs_gapic",
     package_name = "@google-cloud/security-center",
@@ -295,6 +322,17 @@ nodejs_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_cloud_gapic_library",
+    "ruby_gapic_assembly_pkg",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
 ruby_proto_library(
     name = "securitycenter_ruby_proto",
     deps = [":securitycenter_proto"],
@@ -338,6 +376,17 @@ ruby_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_gapic_assembly_pkg",
+    "csharp_gapic_library",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
 csharp_proto_library(
     name = "securitycenter_csharp_proto",
     deps = [":securitycenter_proto"],
@@ -373,6 +422,15 @@ csharp_gapic_assembly_pkg(
     ],
 )
 
+##############################################################################
+# C++
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "cc_grpc_library",
+    "cc_proto_library",
+)
+
 cc_proto_library(
     name = "securitycenter_cc_proto",
     deps = [":securitycenter_proto"],
diff --git a/google/cloud/securitycenter/v1/access.proto b/google/cloud/securitycenter/v1/access.proto
index b5d9d0d836..55ff088de8 100644
--- a/google/cloud/securitycenter/v1/access.proto
+++ b/google/cloud/securitycenter/v1/access.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -106,4 +106,4 @@ message ServiceAccountDelegationInfo {
 message Geolocation {
   // A CLDR.
   string region_code = 1;
-}
\ No newline at end of file
+}
diff --git a/google/cloud/securitycenter/v1/asset.proto b/google/cloud/securitycenter/v1/asset.proto
index 8bfdbe9fd3..01462175af 100644
--- a/google/cloud/securitycenter/v1/asset.proto
+++ b/google/cloud/securitycenter/v1/asset.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/bigquery_export.proto b/google/cloud/securitycenter/v1/bigquery_export.proto
index 6afd9b4f54..8299f05e49 100644
--- a/google/cloud/securitycenter/v1/bigquery_export.proto
+++ b/google/cloud/securitycenter/v1/bigquery_export.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -78,22 +78,24 @@ message BigQueryExport {
   // (0-9), or underscores (_).
   string dataset = 4;
 
-  // Output only. The time at which the big query export was created.
+  // Output only. The time at which the BigQuery export was created.
   // This field is set by the server and will be ignored if provided on export
   // on creation.
-  google.protobuf.Timestamp create_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp create_time = 5
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. The most recent time at which the big export was updated.
+  // Output only. The most recent time at which the BigQuery export was updated.
   // This field is set by the server and will be ignored if provided on export
   // creation or update.
-  google.protobuf.Timestamp update_time = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp update_time = 6
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Email address of the user who last edited the big query export.
+  // Output only. Email address of the user who last edited the BigQuery export.
   // This field is set by the server and will be ignored if provided on export
   // creation or update.
   string most_recent_editor = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. The service account that needs permission to create table, upload data to
-  // the big query dataset.
+  // Output only. The service account that needs permission to create table and
+  // upload data to the BigQuery dataset.
   string principal = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
diff --git a/google/cloud/securitycenter/v1/compliance.proto b/google/cloud/securitycenter/v1/compliance.proto
index 13edb396b9..bc183bb5e3 100644
--- a/google/cloud/securitycenter/v1/compliance.proto
+++ b/google/cloud/securitycenter/v1/compliance.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/connection.proto b/google/cloud/securitycenter/v1/connection.proto
index 6ac9c99e5e..43a2115674 100644
--- a/google/cloud/securitycenter/v1/connection.proto
+++ b/google/cloud/securitycenter/v1/connection.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/contact_details.proto b/google/cloud/securitycenter/v1/contact_details.proto
index c0e7c2f761..741ad8fae1 100644
--- a/google/cloud/securitycenter/v1/contact_details.proto
+++ b/google/cloud/securitycenter/v1/contact_details.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -30,8 +30,8 @@ message ContactDetails {
   repeated Contact contacts = 1;
 }
 
-// Representa a single contact's email address
+// The email address of a contact.
 message Contact {
-  // An email address e.g. "person123@company.com"
+  // An email address. For example, "`person123@company.com`".
   string email = 1;
 }
diff --git a/google/cloud/securitycenter/v1/container.proto b/google/cloud/securitycenter/v1/container.proto
index 420356368c..c90168991f 100644
--- a/google/cloud/securitycenter/v1/container.proto
+++ b/google/cloud/securitycenter/v1/container.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/database.proto b/google/cloud/securitycenter/v1/database.proto
index 39afb4e010..70bf351610 100644
--- a/google/cloud/securitycenter/v1/database.proto
+++ b/google/cloud/securitycenter/v1/database.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -29,7 +29,7 @@ option ruby_package = "Google::Cloud::SecurityCenter::V1";
 // instances or Cloud Spanner instances), or the database instance itself.
 // Some database resources may not have the full resource name populated
 // because these resource types are not yet supported by Cloud Asset Inventory
-// (e.g. CloudSQL databases).  In these cases only the display name will be
+// (e.g. CloudSQL databases). In these cases only the display name will be
 // provided.
 message Database {
   // The full resource name of the database the user connected to, if it is
diff --git a/google/cloud/securitycenter/v1/effective_security_health_analytics_custom_module.proto b/google/cloud/securitycenter/v1/effective_security_health_analytics_custom_module.proto
new file mode 100644
index 0000000000..3c5cc8af3b
--- /dev/null
+++ b/google/cloud/securitycenter/v1/effective_security_health_analytics_custom_module.proto
@@ -0,0 +1,81 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/securitycenter/v1/security_health_analytics_custom_config.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "EffectiveSecurityHealthAnalyticsCustomModuleProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+// An EffectiveSecurityHealthAnalyticsCustomModule is the representation of
+// a Security Health Analytics custom module at a specified level of the
+// resource hierarchy: organization, folder, or project. If a custom module is
+// inherited from a parent organization or folder, the value of the
+// `enablementState` property in EffectiveSecurityHealthAnalyticsCustomModule is
+// set to the value that is effective in the parent, instead of  `INHERITED`.
+// For example, if the module is enabled in a parent organization or folder, the
+// effective enablement_state for the module in all child folders or projects is
+// also `enabled`. EffectiveSecurityHealthAnalyticsCustomModule is read-only.
+message EffectiveSecurityHealthAnalyticsCustomModule {
+  option (google.api.resource) = {
+    type: "securitycenter.googleapis.com/EffectiveSecurityHealthAnalyticsCustomModule"
+    pattern: "organizations/{organization}/securityHealthAnalyticsSettings/effectiveCustomModules/{effective_custom_module}"
+    pattern: "folders/{folder}/securityHealthAnalyticsSettings/effectiveCustomModules/{effective_custom_module}"
+    pattern: "projects/{project}/securityHealthAnalyticsSettings/effectiveCustomModules/{effective_custom_module}"
+  };
+
+  // The enablement state of the module.
+  enum EnablementState {
+    // Unspecified enablement state.
+    ENABLEMENT_STATE_UNSPECIFIED = 0;
+
+    // The module is enabled at the given level.
+    ENABLED = 1;
+
+    // The module is disabled at the given level.
+    DISABLED = 2;
+  }
+
+  // Output only. The resource name of the custom module.
+  // Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}",
+  // or
+  // "folders/{folder}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}",
+  // or
+  // "projects/{project}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}"
+  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The user-specified configuration for the module.
+  CustomConfig custom_config = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The effective state of enablement for the module at the given
+  // level of the hierarchy.
+  EnablementState enablement_state = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The display name for the custom module. The name must be
+  // between 1 and 128 characters, start with a lowercase letter, and contain
+  // alphanumeric characters or underscores only.
+  string display_name = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
diff --git a/google/cloud/securitycenter/v1/exfiltration.proto b/google/cloud/securitycenter/v1/exfiltration.proto
index 02620be69c..4c3735dedf 100644
--- a/google/cloud/securitycenter/v1/exfiltration.proto
+++ b/google/cloud/securitycenter/v1/exfiltration.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -25,7 +25,7 @@ option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
 option ruby_package = "Google::Cloud::SecurityCenter::V1";
 
 // Exfiltration represents a data exfiltration attempt of one or more
-// sources to one or more targets.  Sources represent the source
+// sources to one or more targets. Sources represent the source
 // of data that is exfiltrated, and Targets represents the destination the
 // data was copied to.
 message Exfiltration {
diff --git a/google/cloud/securitycenter/v1/external_system.proto b/google/cloud/securitycenter/v1/external_system.proto
index 5dd4572471..0e23d6a675 100644
--- a/google/cloud/securitycenter/v1/external_system.proto
+++ b/google/cloud/securitycenter/v1/external_system.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/file.proto b/google/cloud/securitycenter/v1/file.proto
index 99cfa07ad9..4d7a459590 100644
--- a/google/cloud/securitycenter/v1/file.proto
+++ b/google/cloud/securitycenter/v1/file.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/finding.proto b/google/cloud/securitycenter/v1/finding.proto
index ade6cca0a6..5e2653c5e5 100644
--- a/google/cloud/securitycenter/v1/finding.proto
+++ b/google/cloud/securitycenter/v1/finding.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -254,17 +254,19 @@ message Finding {
   // Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
   Indicator indicator = 18;
 
-  // Represents vulnerability-specific fields like CVE and CVS scores.
+  // Represents vulnerability-specific fields like CVE and CVSS scores.
   // CVE stands for Common Vulnerabilities and Exposures
   // (https://cve.mitre.org/about/)
   Vulnerability vulnerability = 20;
 
   // Output only. The most recent time this finding was muted or unmuted.
-  google.protobuf.Timestamp mute_update_time = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp mute_update_time = 21
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Third party SIEM/SOAR fields within SCC, contains external system
-  // information and external system finding fields.
-  map<string, ExternalSystem> external_systems = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
+  // Output only. Third party SIEM/SOAR fields within SCC, contains external
+  // system information and external system finding fields.
+  map<string, ExternalSystem> external_systems = 22
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // MITRE ATT&CK tactics and techniques related to this finding.
   // See: https://attack.mitre.org
@@ -286,9 +288,9 @@ message Finding {
   // Represents operating system processes associated with the Finding.
   repeated Process processes = 30;
 
-  // Output only. Map containing the points of contact for the given finding. The key
-  // represents the type of contact, while the value contains a list of all the
-  // contacts that pertain. Please refer to:
+  // Output only. Map containing the points of contact for the given finding.
+  // The key represents the type of contact, while the value contains a list of
+  // all the contacts that pertain. Please refer to:
   // https://cloud.google.com/resource-manager/docs/managing-notification-contacts#notification-categories
   //
   //     {
@@ -303,7 +305,8 @@ message Finding {
   //         ]
   //       }
   //     }
-  map<string, ContactDetails> contacts = 33 [(google.api.field_behavior) = OUTPUT_ONLY];
+  map<string, ContactDetails> contacts = 33
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Contains compliance information for security standards associated to the
   // finding.
@@ -325,6 +328,11 @@ message Finding {
   // Next steps associate to the finding.
   string next_steps = 40;
 
+  // Unique identifier of the module which generated the finding.
+  // Example:
+  // folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885
+  string module_name = 41;
+
   // Containers associated with the finding. containers provides information
   // for both Kubernetes and non-Kubernetes containers.
   repeated Container containers = 42;
diff --git a/google/cloud/securitycenter/v1/folder.proto b/google/cloud/securitycenter/v1/folder.proto
index 2a1291daa7..e809154231 100644
--- a/google/cloud/securitycenter/v1/folder.proto
+++ b/google/cloud/securitycenter/v1/folder.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/iam_binding.proto b/google/cloud/securitycenter/v1/iam_binding.proto
index 9d68642df0..533ac4bdad 100644
--- a/google/cloud/securitycenter/v1/iam_binding.proto
+++ b/google/cloud/securitycenter/v1/iam_binding.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/indicator.proto b/google/cloud/securitycenter/v1/indicator.proto
index 567bc384d5..f36e8b4872 100644
--- a/google/cloud/securitycenter/v1/indicator.proto
+++ b/google/cloud/securitycenter/v1/indicator.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -24,10 +24,11 @@ option java_package = "com.google.cloud.securitycenter.v1";
 option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
 option ruby_package = "Google::Cloud::SecurityCenter::V1";
 
-// Represents what's commonly known as an Indicator of compromise (IoC) in
+// Represents what's commonly known as an _indicator of compromise_ (IoC) in
 // computer forensics. This is an artifact observed on a network or in an
 // operating system that, with high confidence, indicates a computer intrusion.
-// Reference: https://en.wikipedia.org/wiki/Indicator_of_compromise
+// For more information, see [Indicator of
+// compromise](https://en.wikipedia.org/wiki/Indicator_of_compromise).
 message Indicator {
   // Indicates what signature matched this process.
   message ProcessSignature {
@@ -67,7 +68,7 @@ message Indicator {
     }
   }
 
-  // List of ip addresses associated to the Finding.
+  // The list of IP addresses that are associated with the finding.
   repeated string ip_addresses = 1;
 
   // List of domains associated to the Finding.
diff --git a/google/cloud/securitycenter/v1/kernel_rootkit.proto b/google/cloud/securitycenter/v1/kernel_rootkit.proto
index f2178ad55f..6af2840bf0 100644
--- a/google/cloud/securitycenter/v1/kernel_rootkit.proto
+++ b/google/cloud/securitycenter/v1/kernel_rootkit.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -29,34 +29,34 @@ message KernelRootkit {
   // Rootkit name when available.
   string name = 1;
 
-  // True if unexpected modifications of kernel code memory are present.
+  // True when unexpected modifications of kernel code memory are present.
   bool unexpected_code_modification = 2;
 
-  // True if unexpected modifications of kernel read-only data memory are
+  // True when unexpected modifications of kernel read-only data memory are
   // present.
   bool unexpected_read_only_data_modification = 3;
 
-  // True if `ftrace` points are present with callbacks pointing to regions
+  // True when `ftrace` points are present with callbacks pointing to regions
   // that are not in the expected kernel or module code range.
   bool unexpected_ftrace_handler = 4;
 
-  // True if `kprobe` points are present with callbacks pointing to regions
+  // True when `kprobe` points are present with callbacks pointing to regions
   // that are not in the expected kernel or module code range.
   bool unexpected_kprobe_handler = 5;
 
-  // True if kernel code pages that are not in the expected kernel or module
+  // True when kernel code pages that are not in the expected kernel or module
   // code regions are present.
   bool unexpected_kernel_code_pages = 6;
 
-  // True if system call handlers that are are not in the expected kernel or
+  // True when system call handlers that are are not in the expected kernel or
   // module code regions are present.
   bool unexpected_system_call_handler = 7;
 
-  // True if interrupt handlers that are are not in the expected kernel or
+  // True when interrupt handlers that are are not in the expected kernel or
   // module code regions are present.
   bool unexpected_interrupt_handler = 8;
 
-  // True if unexpected processes in the scheduler run queue are present. Such
+  // True when unexpected processes in the scheduler run queue are present. Such
   // processes are in the run queue, but not in the process task list.
   bool unexpected_processes_in_runqueue = 9;
 }
diff --git a/google/cloud/securitycenter/v1/kubernetes.proto b/google/cloud/securitycenter/v1/kubernetes.proto
index dfe24c04fa..ac1df83511 100644
--- a/google/cloud/securitycenter/v1/kubernetes.proto
+++ b/google/cloud/securitycenter/v1/kubernetes.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,7 +27,7 @@ option java_package = "com.google.cloud.securitycenter.v1";
 option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
 option ruby_package = "Google::Cloud::SecurityCenter::V1";
 
-// Kubernetes related attributes.
+// Kubernetes-related attributes.
 message Kubernetes {
   // Kubernetes Pod.
   message Pod {
@@ -96,8 +96,8 @@ message Kubernetes {
     // The Role or ClusterRole referenced by the binding.
     Role role = 3;
 
-    // Represents the subjects(s) bound to the role. Not always available
-    // for PATCH requests.
+    // Represents one or more subjects that are bound to the role. Not always
+    // available for PATCH requests.
     repeated Subject subjects = 4;
   }
 
diff --git a/google/cloud/securitycenter/v1/label.proto b/google/cloud/securitycenter/v1/label.proto
index cc554342e6..0760c82d84 100644
--- a/google/cloud/securitycenter/v1/label.proto
+++ b/google/cloud/securitycenter/v1/label.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/mitre_attack.proto b/google/cloud/securitycenter/v1/mitre_attack.proto
index 708b10390c..79425d2c60 100644
--- a/google/cloud/securitycenter/v1/mitre_attack.proto
+++ b/google/cloud/securitycenter/v1/mitre_attack.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/mute_config.proto b/google/cloud/securitycenter/v1/mute_config.proto
index 20d2cb059e..d2a8db6849 100644
--- a/google/cloud/securitycenter/v1/mute_config.proto
+++ b/google/cloud/securitycenter/v1/mute_config.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -50,11 +50,11 @@ message MuteConfig {
   // A description of the mute config.
   string description = 3;
 
-  // Required. An expression that defines the filter to apply across create/update events
-  // of findings. While creating a filter string, be mindful of the
-  // scope in which the mute configuration is being created. E.g., If a filter
-  // contains project = X but is created under the project = Y scope, it might
-  // not match any findings.
+  // Required. An expression that defines the filter to apply across
+  // create/update events of findings. While creating a filter string, be
+  // mindful of the scope in which the mute configuration is being created.
+  // E.g., If a filter contains project = X but is created under the project = Y
+  // scope, it might not match any findings.
   //
   // The following field and operator combinations are supported:
   //
@@ -75,12 +75,14 @@ message MuteConfig {
   // Output only. The time at which the mute config was created.
   // This field is set by the server and will be ignored if provided on config
   // creation.
-  google.protobuf.Timestamp create_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp create_time = 5
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. The most recent time at which the mute config was updated.
   // This field is set by the server and will be ignored if provided on config
   // creation or update.
-  google.protobuf.Timestamp update_time = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp update_time = 6
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Email address of the user who last edited the mute config.
   // This field is set by the server and will be ignored if provided on config
diff --git a/google/cloud/securitycenter/v1/notification_config.proto b/google/cloud/securitycenter/v1/notification_config.proto
index 1bce1cfe77..de2a88b6bb 100644
--- a/google/cloud/securitycenter/v1/notification_config.proto
+++ b/google/cloud/securitycenter/v1/notification_config.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -83,9 +83,9 @@ message NotificationConfig {
 
   // The Pub/Sub topic to send notifications to. Its format is
   // "projects/[project_id]/topics/[topic]".
-  string pubsub_topic = 3 [(google.api.resource_reference) = {
-                             type: "pubsub.googleapis.com/Topic"
-                           }];
+  string pubsub_topic = 3 [
+    (google.api.resource_reference) = { type: "pubsub.googleapis.com/Topic" }
+  ];
 
   // Output only. The service account that needs "pubsub.topics.publish"
   // permission to publish to the Pub/Sub topic.
diff --git a/google/cloud/securitycenter/v1/notification_message.proto b/google/cloud/securitycenter/v1/notification_message.proto
index 80f98ea2da..59841d92ed 100644
--- a/google/cloud/securitycenter/v1/notification_message.proto
+++ b/google/cloud/securitycenter/v1/notification_message.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/organization_settings.proto b/google/cloud/securitycenter/v1/organization_settings.proto
index 460ee701fb..66880a17c6 100644
--- a/google/cloud/securitycenter/v1/organization_settings.proto
+++ b/google/cloud/securitycenter/v1/organization_settings.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/process.proto b/google/cloud/securitycenter/v1/process.proto
index c885f48ec9..3ec0a5c29f 100644
--- a/google/cloud/securitycenter/v1/process.proto
+++ b/google/cloud/securitycenter/v1/process.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/resource.proto b/google/cloud/securitycenter/v1/resource.proto
index 3adcda1fce..626974ea96 100644
--- a/google/cloud/securitycenter/v1/resource.proto
+++ b/google/cloud/securitycenter/v1/resource.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -51,8 +51,8 @@ message Resource {
   // The human readable name of resource's parent.
   string parent_display_name = 5;
 
-  // Output only. Contains a Folder message for each folder in the assets ancestry.
-  // The first folder is the deepest nested folder, and the last folder is the
-  // folder directly under the Organization.
+  // Output only. Contains a Folder message for each folder in the assets
+  // ancestry. The first folder is the deepest nested folder, and the last
+  // folder is the folder directly under the Organization.
   repeated Folder folders = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
diff --git a/google/cloud/securitycenter/v1/run_asset_discovery_response.proto b/google/cloud/securitycenter/v1/run_asset_discovery_response.proto
index c2861883f5..f331fb9ec7 100644
--- a/google/cloud/securitycenter/v1/run_asset_discovery_response.proto
+++ b/google/cloud/securitycenter/v1/run_asset_discovery_response.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/security_health_analytics_custom_config.proto b/google/cloud/securitycenter/v1/security_health_analytics_custom_config.proto
new file mode 100644
index 0000000000..337f0a3bb3
--- /dev/null
+++ b/google/cloud/securitycenter/v1/security_health_analytics_custom_config.proto
@@ -0,0 +1,101 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/type/expr.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "SecurityHealthAnalyticsCustomConfigProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+
+// Defines the properties in a custom module configuration for Security
+// Health Analytics. Use the custom module configuration to create custom
+// detectors that generate custom findings for resources that you specify.
+message CustomConfig {
+  // A set of optional name-value pairs that define custom source properties to
+  // return with each finding that is generated by the custom module. The custom
+  // source properties that are defined here are included in the finding JSON
+  // under `sourceProperties`.
+  message CustomOutputSpec {
+    // An individual name-value pair that defines a custom source property.
+    message Property {
+      // Name of the property for the custom output.
+      string name = 1;
+
+      // The CEL expression for the custom output. A resource property can be
+      // specified to return the value of the property or a text string enclosed
+      // in quotation marks.
+      google.type.Expr value_expression = 2;
+    }
+
+    // A list of custom output properties to add to the finding.
+    repeated Property properties = 1;
+  }
+
+  // Resource for selecting resource type.
+  message ResourceSelector {
+    // The resource types to run the detector on.
+    repeated string resource_types = 1;
+  }
+
+  // Defines the valid value options for the severity of a finding.
+  enum Severity {
+    // Unspecified severity.
+    SEVERITY_UNSPECIFIED = 0;
+
+    // Critical severity.
+    CRITICAL = 1;
+
+    // High severity.
+    HIGH = 2;
+
+    // Medium severity.
+    MEDIUM = 3;
+
+    // Low severity.
+    LOW = 4;
+  }
+
+  // The CEL expression to evaluate to produce findings. When the expression
+  // evaluates to true against a resource, a finding is generated.
+  google.type.Expr predicate = 1;
+
+  // Custom output properties.
+  CustomOutputSpec custom_output = 2;
+
+  // The resource types that the custom module operates on. Each custom module
+  // can specify up to 5 resource types.
+  ResourceSelector resource_selector = 3;
+
+  // The severity to assign to findings generated by the module.
+  Severity severity = 4;
+
+  // Text that describes the vulnerability or misconfiguration that the custom
+  // module detects. This explanation is returned with each finding instance to
+  // help investigators understand the detected issue. The text must be enclosed
+  // in quotation marks.
+  string description = 5;
+
+  // An explanation of the recommended steps that security teams can take to
+  // resolve the detected issue. This explanation is returned with each finding
+  // generated by this module in the `nextSteps` property of the finding JSON.
+  string recommendation = 6;
+}
diff --git a/google/cloud/securitycenter/v1/security_health_analytics_custom_module.proto b/google/cloud/securitycenter/v1/security_health_analytics_custom_module.proto
new file mode 100644
index 0000000000..7e7343d064
--- /dev/null
+++ b/google/cloud/securitycenter/v1/security_health_analytics_custom_module.proto
@@ -0,0 +1,110 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.securitycenter.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/securitycenter/v1/security_health_analytics_custom_config.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.SecurityCenter.V1";
+option go_package = "cloud.google.com/go/securitycenter/apiv1/securitycenterpb;securitycenterpb";
+option java_multiple_files = true;
+option java_outer_classname = "SecurityHealthAnalyticsCustomModuleProto";
+option java_package = "com.google.cloud.securitycenter.v1";
+option php_namespace = "Google\\Cloud\\SecurityCenter\\V1";
+option ruby_package = "Google::Cloud::SecurityCenter::V1";
+option (google.api.resource_definition) = {
+  type: "securitycenter.googleapis.com/SecurityHealthAnalyticsSettings"
+  pattern: "organizations/{organization}/securityHealthAnalyticsSettings"
+  pattern: "folders/{folder}/securityHealthAnalyticsSettings"
+  pattern: "projects/{project}/securityHealthAnalyticsSettings"
+};
+
+// Represents an instance of a Security Health Analytics custom module,
+// including its full module name, display name, enablement state, and last
+// updated time. You can create a custom module at the organization, folder, or
+// project level. Custom modules that you create at the organization or folder
+// level are inherited by the child folders and projects.
+message SecurityHealthAnalyticsCustomModule {
+  option (google.api.resource) = {
+    type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    pattern: "organizations/{organization}/securityHealthAnalyticsSettings/customModules/{custom_module}"
+    pattern: "folders/{folder}/securityHealthAnalyticsSettings/customModules/{custom_module}"
+    pattern: "projects/{project}/securityHealthAnalyticsSettings/customModules/{custom_module}"
+  };
+
+  // Possible enablement states of a custom module.
+  enum EnablementState {
+    // Unspecified enablement state.
+    ENABLEMENT_STATE_UNSPECIFIED = 0;
+
+    // The module is enabled at the given CRM resource.
+    ENABLED = 1;
+
+    // The module is disabled at the given CRM resource.
+    DISABLED = 2;
+
+    // State is inherited from an ancestor module. The module will either
+    // be effectively ENABLED or DISABLED based on its closest non-inherited
+    // ancestor module in the CRM hierarchy.
+    INHERITED = 3;
+  }
+
+  // Immutable. The resource name of the custom module.
+  // Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // or
+  // "folders/{folder}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // or
+  // "projects/{project}/securityHealthAnalyticsSettings/customModules/{customModule}"
+  //
+  // The id {customModule} is server-generated and is not user settable.
+  // It will be a numeric id containing 1-20 digits.
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // The display name of the Security Health Analytics custom module. This
+  // display name becomes the finding category for all findings that are
+  // returned by this custom module. The display name must be between 1 and
+  // 128 characters, start with a lowercase letter, and contain alphanumeric
+  // characters or underscores only.
+  string display_name = 2;
+
+  // The enablement state of the custom module.
+  EnablementState enablement_state = 4;
+
+  // Output only. The time at which the custom module was last updated.
+  google.protobuf.Timestamp update_time = 5
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The editor that last updated the custom module.
+  string last_editor = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. If empty, indicates that the custom module was created in the
+  // organization, folder, or project in which you are viewing the custom
+  // module. Otherwise, `ancestor_module` specifies the organization or folder
+  // from which the custom module is inherited.
+  string ancestor_module = 7 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.resource_reference) = {
+      type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+
+  // The user specified custom configuration for the module.
+  CustomConfig custom_config = 8;
+}
diff --git a/google/cloud/securitycenter/v1/security_marks.proto b/google/cloud/securitycenter/v1/security_marks.proto
index c0118899b1..74c641dea8 100644
--- a/google/cloud/securitycenter/v1/security_marks.proto
+++ b/google/cloud/securitycenter/v1/security_marks.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/securitycenter_grpc_service_config.json b/google/cloud/securitycenter/v1/securitycenter_grpc_service_config.json
index 10775c3877..a50f47a4a7 100755
--- a/google/cloud/securitycenter/v1/securitycenter_grpc_service_config.json
+++ b/google/cloud/securitycenter/v1/securitycenter_grpc_service_config.json
@@ -14,10 +14,18 @@
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "CreateNotificationConfig"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "CreateSecurityHealthAnalyticsCustomModule"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "DeleteNotificationConfig"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "DeleteSecurityHealthAnalyticsCustomModule"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "RunAssetDiscovery"
@@ -42,6 +50,10 @@
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "UpdateOrganizationSettings"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "UpdateSecurityHealthAnalyticsCustomModule"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "UpdateSource"
@@ -51,6 +63,10 @@
     },
     {
       "name": [
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "GetEffectiveSecurityHealthAnalyticsCustomModule"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "GetIamPolicy"
@@ -63,14 +79,30 @@
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "GetOrganizationSettings"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "GetSecurityHealthAnalyticsCustomModule"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "GetSource"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "ListDescendantSecurityHealthAnalyticsCustomModules"
+        },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "ListEffectiveSecurityHealthAnalyticsCustomModules"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "ListNotificationConfigs"
         },
+        {
+          "service": "google.cloud.securitycenter.v1.SecurityCenter",
+          "method": "ListSecurityHealthAnalyticsCustomModules"
+        },
         {
           "service": "google.cloud.securitycenter.v1.SecurityCenter",
           "method": "ListSources"
diff --git a/google/cloud/securitycenter/v1/securitycenter_service.proto b/google/cloud/securitycenter/v1/securitycenter_service.proto
index 94aef2df24..42db34f29a 100644
--- a/google/cloud/securitycenter/v1/securitycenter_service.proto
+++ b/google/cloud/securitycenter/v1/securitycenter_service.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,20 +16,21 @@ syntax = "proto3";
 
 package google.cloud.securitycenter.v1;
 
-import public "google/cloud/securitycenter/v1/run_asset_discovery_response.proto";
-
 import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
 import "google/cloud/securitycenter/v1/asset.proto";
 import "google/cloud/securitycenter/v1/bigquery_export.proto";
+import "google/cloud/securitycenter/v1/effective_security_health_analytics_custom_module.proto";
 import "google/cloud/securitycenter/v1/external_system.proto";
 import "google/cloud/securitycenter/v1/finding.proto";
 import "google/cloud/securitycenter/v1/folder.proto";
 import "google/cloud/securitycenter/v1/mute_config.proto";
 import "google/cloud/securitycenter/v1/notification_config.proto";
 import "google/cloud/securitycenter/v1/organization_settings.proto";
+import "google/cloud/securitycenter/v1/run_asset_discovery_response.proto";
+import "google/cloud/securitycenter/v1/security_health_analytics_custom_module.proto";
 import "google/cloud/securitycenter/v1/security_marks.proto";
 import "google/cloud/securitycenter/v1/source.proto";
 import "google/iam/v1/iam_policy.proto";
@@ -78,6 +79,29 @@ service SecurityCenter {
     };
   }
 
+  // Creates a resident SecurityHealthAnalyticsCustomModule at the scope of the
+  // given CRM parent, and also creates inherited
+  // SecurityHealthAnalyticsCustomModules for all CRM descendants of the given
+  // parent. These modules are enabled by default.
+  rpc CreateSecurityHealthAnalyticsCustomModule(
+      CreateSecurityHealthAnalyticsCustomModuleRequest)
+      returns (SecurityHealthAnalyticsCustomModule) {
+    option (google.api.http) = {
+      post: "/v1/{parent=organizations/*/securityHealthAnalyticsSettings}/customModules"
+      body: "security_health_analytics_custom_module"
+      additional_bindings {
+        post: "/v1/{parent=folders/*/securityHealthAnalyticsSettings}/customModules"
+        body: "security_health_analytics_custom_module"
+      }
+      additional_bindings {
+        post: "/v1/{parent=projects/*/securityHealthAnalyticsSettings}/customModules"
+        body: "security_health_analytics_custom_module"
+      }
+    };
+    option (google.api.method_signature) =
+        "parent,security_health_analytics_custom_module";
+  }
+
   // Creates a source.
   rpc CreateSource(CreateSourceRequest) returns (Source) {
     option (google.api.http) = {
@@ -161,6 +185,24 @@ service SecurityCenter {
     option (google.api.method_signature) = "name";
   }
 
+  // Deletes the specified SecurityHealthAnalyticsCustomModule and all of its
+  // descendants in the CRM hierarchy. This method is only supported for
+  // resident custom modules.
+  rpc DeleteSecurityHealthAnalyticsCustomModule(
+      DeleteSecurityHealthAnalyticsCustomModuleRequest)
+      returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      delete: "/v1/{name=organizations/*/securityHealthAnalyticsSettings/customModules/*}"
+      additional_bindings {
+        delete: "/v1/{name=folders/*/securityHealthAnalyticsSettings/customModules/*}"
+      }
+      additional_bindings {
+        delete: "/v1/{name=projects/*/securityHealthAnalyticsSettings/customModules/*}"
+      }
+    };
+    option (google.api.method_signature) = "name";
+  }
+
   // Gets a BigQuery export.
   rpc GetBigQueryExport(GetBigQueryExportRequest) returns (BigQueryExport) {
     option (google.api.http) = {
@@ -211,6 +253,38 @@ service SecurityCenter {
     option (google.api.method_signature) = "name";
   }
 
+  // Retrieves an EffectiveSecurityHealthAnalyticsCustomModule.
+  rpc GetEffectiveSecurityHealthAnalyticsCustomModule(
+      GetEffectiveSecurityHealthAnalyticsCustomModuleRequest)
+      returns (EffectiveSecurityHealthAnalyticsCustomModule) {
+    option (google.api.http) = {
+      get: "/v1/{name=organizations/*/securityHealthAnalyticsSettings/effectiveCustomModules/*}"
+      additional_bindings {
+        get: "/v1/{name=folders/*/securityHealthAnalyticsSettings/effectiveCustomModules/*}"
+      }
+      additional_bindings {
+        get: "/v1/{name=projects/*/securityHealthAnalyticsSettings/effectiveCustomModules/*}"
+      }
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Retrieves a SecurityHealthAnalyticsCustomModule.
+  rpc GetSecurityHealthAnalyticsCustomModule(
+      GetSecurityHealthAnalyticsCustomModuleRequest)
+      returns (SecurityHealthAnalyticsCustomModule) {
+    option (google.api.http) = {
+      get: "/v1/{name=organizations/*/securityHealthAnalyticsSettings/customModules/*}"
+      additional_bindings {
+        get: "/v1/{name=folders/*/securityHealthAnalyticsSettings/customModules/*}"
+      }
+      additional_bindings {
+        get: "/v1/{name=projects/*/securityHealthAnalyticsSettings/customModules/*}"
+      }
+    };
+    option (google.api.method_signature) = "name";
+  }
+
   // Gets a source.
   rpc GetSource(GetSourceRequest) returns (Source) {
     option (google.api.http) = {
@@ -268,6 +342,23 @@ service SecurityCenter {
     };
   }
 
+  // Returns a list of all resident SecurityHealthAnalyticsCustomModules under
+  // the given CRM parent and all of the parent’s CRM descendants.
+  rpc ListDescendantSecurityHealthAnalyticsCustomModules(
+      ListDescendantSecurityHealthAnalyticsCustomModulesRequest)
+      returns (ListDescendantSecurityHealthAnalyticsCustomModulesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=organizations/*/securityHealthAnalyticsSettings}/customModules:listDescendant"
+      additional_bindings {
+        get: "/v1/{parent=folders/*/securityHealthAnalyticsSettings}/customModules:listDescendant"
+      }
+      additional_bindings {
+        get: "/v1/{parent=projects/*/securityHealthAnalyticsSettings}/customModules:listDescendant"
+      }
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
   // Lists an organization or source's findings.
   //
   // To list across all sources provide a `-` as the source id.
@@ -302,6 +393,42 @@ service SecurityCenter {
     option (google.api.method_signature) = "parent";
   }
 
+  // Returns a list of all EffectiveSecurityHealthAnalyticsCustomModules for the
+  // given parent. This includes resident modules defined at the scope of the
+  // parent, and inherited modules, inherited from CRM ancestors.
+  rpc ListEffectiveSecurityHealthAnalyticsCustomModules(
+      ListEffectiveSecurityHealthAnalyticsCustomModulesRequest)
+      returns (ListEffectiveSecurityHealthAnalyticsCustomModulesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=organizations/*/securityHealthAnalyticsSettings}/effectiveCustomModules"
+      additional_bindings {
+        get: "/v1/{parent=folders/*/securityHealthAnalyticsSettings}/effectiveCustomModules"
+      }
+      additional_bindings {
+        get: "/v1/{parent=projects/*/securityHealthAnalyticsSettings}/effectiveCustomModules"
+      }
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Returns a list of all SecurityHealthAnalyticsCustomModules for the given
+  // parent. This includes resident modules defined at the scope of the parent,
+  // and inherited modules, inherited from CRM ancestors.
+  rpc ListSecurityHealthAnalyticsCustomModules(
+      ListSecurityHealthAnalyticsCustomModulesRequest)
+      returns (ListSecurityHealthAnalyticsCustomModulesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=organizations/*/securityHealthAnalyticsSettings}/customModules"
+      additional_bindings {
+        get: "/v1/{parent=folders/*/securityHealthAnalyticsSettings}/customModules"
+      }
+      additional_bindings {
+        get: "/v1/{parent=projects/*/securityHealthAnalyticsSettings}/customModules"
+      }
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
   // Lists all sources belonging to an organization.
   rpc ListSources(ListSourcesRequest) returns (ListSourcesResponse) {
     option (google.api.http) = {
@@ -469,6 +596,30 @@ service SecurityCenter {
     option (google.api.method_signature) = "organization_settings";
   }
 
+  // Updates the SecurityHealthAnalyticsCustomModule under the given name based
+  // on the given update mask. Updating the enablement state is supported on
+  // both resident and inherited modules (though resident modules cannot have an
+  // enablement state of “inherited”). Updating the display name and custom
+  // config of a module is supported on resident modules only.
+  rpc UpdateSecurityHealthAnalyticsCustomModule(
+      UpdateSecurityHealthAnalyticsCustomModuleRequest)
+      returns (SecurityHealthAnalyticsCustomModule) {
+    option (google.api.http) = {
+      patch: "/v1/{security_health_analytics_custom_module.name=organizations/*/securityHealthAnalyticsSettings/customModules/*}"
+      body: "security_health_analytics_custom_module"
+      additional_bindings {
+        patch: "/v1/{security_health_analytics_custom_module.name=folders/*/securityHealthAnalyticsSettings/customModules/*}"
+        body: "security_health_analytics_custom_module"
+      }
+      additional_bindings {
+        patch: "/v1/{security_health_analytics_custom_module.name=projects/*/securityHealthAnalyticsSettings/customModules/*}"
+        body: "security_health_analytics_custom_module"
+      }
+    };
+    option (google.api.method_signature) =
+        "security_health_analytics_custom_module,update_mask";
+  }
+
   // Updates a source.
   rpc UpdateSource(UpdateSourceRequest) returns (Source) {
     option (google.api.http) = {
@@ -684,6 +835,26 @@ message CreateNotificationConfigRequest {
       [(google.api.field_behavior) = REQUIRED];
 }
 
+// Request message for creating security health analytics custom modules.
+message CreateSecurityHealthAnalyticsCustomModuleRequest {
+  // Required. Resource name of the new custom module's parent. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings",
+  // "folders/{folder}/securityHealthAnalyticsSettings", or
+  // "projects/{project}/securityHealthAnalyticsSettings"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+
+  // Required. SecurityHealthAnalytics custom module to create. The provided
+  // name is ignored and reset with provided parent information and
+  // server-generated ID.
+  SecurityHealthAnalyticsCustomModule security_health_analytics_custom_module =
+      2 [(google.api.field_behavior) = REQUIRED];
+}
+
 // Request message for creating a source.
 message CreateSourceRequest {
   // Required. Resource name of the new source's parent. Its format should be
@@ -728,6 +899,21 @@ message DeleteNotificationConfigRequest {
   ];
 }
 
+// Request message for deleting security health analytics custom modules.
+message DeleteSecurityHealthAnalyticsCustomModuleRequest {
+  // Required. Name of the custom module to delete. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // "folders/{folder}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // or
+  // "projects/{project}/securityHealthAnalyticsSettings/customModules/{customModule}"
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+}
+
 // Request message for retrieving a BigQuery export.
 message GetBigQueryExportRequest {
   // Required. Name of the BigQuery export to retrieve. Its format is
@@ -782,6 +968,37 @@ message GetOrganizationSettingsRequest {
   ];
 }
 
+// Request message for getting effective security health analytics custom
+// modules.
+message GetEffectiveSecurityHealthAnalyticsCustomModuleRequest {
+  // Required. Name of the effective custom module to get. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}",
+  // "folders/{folder}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}",
+  // or
+  // "projects/{project}/securityHealthAnalyticsSettings/effectiveCustomModules/{customModule}"
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "securitycenter.googleapis.com/EffectiveSecurityHealthAnalyticsCustomModule"
+    }
+  ];
+}
+
+// Request message for getting security health analytics custom modules.
+message GetSecurityHealthAnalyticsCustomModuleRequest {
+  // Required. Name of the custom module to get. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // "folders/{folder}/securityHealthAnalyticsSettings/customModules/{customModule}",
+  // or
+  // "projects/{project}/securityHealthAnalyticsSettings/customModules/{customModule}"
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+}
+
 // Request message for getting a source.
 message GetSourceRequest {
   // Required. Relative resource name of the source. Its format is
@@ -1124,6 +1341,40 @@ message GroupResult {
   int64 count = 2;
 }
 
+// Request message for listing descendant security health analytics custom
+// modules.
+message ListDescendantSecurityHealthAnalyticsCustomModulesRequest {
+  // Required. Name of parent to list descendant custom modules. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings",
+  // "folders/{folder}/securityHealthAnalyticsSettings", or
+  // "projects/{project}/securityHealthAnalyticsSettings"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+
+  // The maximum number of results to return in a single response. Default is
+  // 10, minimum is 1, maximum is 1000.
+  int32 page_size = 2;
+
+  // The value returned by the last call indicating a continuation
+  string page_token = 3;
+}
+
+// Response message for listing descendant security health analytics custom
+// modules.
+message ListDescendantSecurityHealthAnalyticsCustomModulesResponse {
+  // Custom modules belonging to the requested parent and its descendants.
+  repeated SecurityHealthAnalyticsCustomModule
+      security_health_analytics_custom_modules = 1;
+
+  // If not empty, indicates that there may be more custom modules to be
+  // returned.
+  string next_page_token = 2;
+}
+
 // Request message for listing  mute configs at a given scope e.g. organization,
 // folder or project.
 message ListMuteConfigsRequest {
@@ -1193,6 +1444,72 @@ message ListNotificationConfigsResponse {
   string next_page_token = 2;
 }
 
+// Request message for listing effective security health analytics custom
+// modules.
+message ListEffectiveSecurityHealthAnalyticsCustomModulesRequest {
+  // Required. Name of parent to list effective custom modules. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings",
+  // "folders/{folder}/securityHealthAnalyticsSettings", or
+  // "projects/{project}/securityHealthAnalyticsSettings"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+
+  // The maximum number of results to return in a single response. Default is
+  // 10, minimum is 1, maximum is 1000.
+  int32 page_size = 2;
+
+  // The value returned by the last call indicating a continuation
+  string page_token = 3;
+}
+
+// Response message for listing effective security health analytics custom
+// modules.
+message ListEffectiveSecurityHealthAnalyticsCustomModulesResponse {
+  // Effective custom modules belonging to the requested parent.
+  repeated EffectiveSecurityHealthAnalyticsCustomModule
+      effective_security_health_analytics_custom_modules = 1;
+
+  // If not empty, indicates that there may be more effective custom modules to
+  // be returned.
+  string next_page_token = 2;
+}
+
+// Request message for listing security health analytics custom modules.
+message ListSecurityHealthAnalyticsCustomModulesRequest {
+  // Required. Name of parent to list custom modules. Its format is
+  // "organizations/{organization}/securityHealthAnalyticsSettings",
+  // "folders/{folder}/securityHealthAnalyticsSettings", or
+  // "projects/{project}/securityHealthAnalyticsSettings"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "securitycenter.googleapis.com/SecurityHealthAnalyticsCustomModule"
+    }
+  ];
+
+  // The maximum number of results to return in a single response. Default is
+  // 10, minimum is 1, maximum is 1000.
+  int32 page_size = 2;
+
+  // The value returned by the last call indicating a continuation
+  string page_token = 3;
+}
+
+// Response message for listing security health analytics custom modules.
+message ListSecurityHealthAnalyticsCustomModulesResponse {
+  // Custom modules belonging to the requested parent.
+  repeated SecurityHealthAnalyticsCustomModule
+      security_health_analytics_custom_modules = 1;
+
+  // If not empty, indicates that there may be more custom modules to be
+  // returned.
+  string next_page_token = 2;
+}
+
 // Request message for listing sources.
 message ListSourcesRequest {
   // Required. Resource name of the parent of sources to list. Its format should
@@ -1775,6 +2092,16 @@ message UpdateOrganizationSettingsRequest {
   google.protobuf.FieldMask update_mask = 2;
 }
 
+// Request message for updating security health analytics custom modules.
+message UpdateSecurityHealthAnalyticsCustomModuleRequest {
+  // Required. The SecurityHealthAnalytics custom module to update.
+  SecurityHealthAnalyticsCustomModule security_health_analytics_custom_module =
+      1 [(google.api.field_behavior) = REQUIRED];
+
+  // The list of fields to update.
+  google.protobuf.FieldMask update_mask = 2;
+}
+
 // Request message for updating a source.
 message UpdateSourceRequest {
   // Required. The source resource to update.
diff --git a/google/cloud/securitycenter/v1/securitycenter_v1.yaml b/google/cloud/securitycenter/v1/securitycenter_v1.yaml
index 662a65ed0c..a580233661 100644
--- a/google/cloud/securitycenter/v1/securitycenter_v1.yaml
+++ b/google/cloud/securitycenter/v1/securitycenter_v1.yaml
@@ -10,11 +10,13 @@ apis:
 types:
 - name: google.cloud.securitycenter.v1.BigQueryExport
 - name: google.cloud.securitycenter.v1.BulkMuteFindingsResponse
+- name: google.cloud.securitycenter.v1.EffectiveSecurityHealthAnalyticsCustomModule
 - name: google.cloud.securitycenter.v1.ExternalSystem
 - name: google.cloud.securitycenter.v1.MuteConfig
 - name: google.cloud.securitycenter.v1.NotificationMessage
 - name: google.cloud.securitycenter.v1.Resource
 - name: google.cloud.securitycenter.v1.RunAssetDiscoveryResponse
+- name: google.cloud.securitycenter.v1.SecurityHealthAnalyticsCustomModule
 
 documentation:
   summary: |-
diff --git a/google/cloud/securitycenter/v1/source.proto b/google/cloud/securitycenter/v1/source.proto
index daf7c3c601..0aed028622 100644
--- a/google/cloud/securitycenter/v1/source.proto
+++ b/google/cloud/securitycenter/v1/source.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/google/cloud/securitycenter/v1/vulnerability.proto b/google/cloud/securitycenter/v1/vulnerability.proto
index eeff956336..457e88c731 100644
--- a/google/cloud/securitycenter/v1/vulnerability.proto
+++ b/google/cloud/securitycenter/v1/vulnerability.proto
@@ -1,4 +1,4 @@
-// Copyright 2022 Google LLC
+// Copyright 2023 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.