GlcoinCore/googleapis
1
0
Fork 0
mirror of https://github.com/googleapis/googleapis.git synced 2026-08-17 13:06:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: added cloud provider field to list findings response

Browse source 
feat: added http configuration rule to ResourceValueConfig and ValuedResource API methods
feat: added toxic combination field to finding
docs: Updated comments for ResourceValueConfig

PiperOrigin-RevId: 647117058
This commit is contained in:
Google APIs 2024-06-26 16:31:35 -07:00 • committed by Copybara-Service
parent 4cba9f40b0
commit efae79d0ba
12 changed files with 548 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

16
google/cloud/securitycenter/v2/BUILD.bazel
View file

@ -30,6 +30,7 @@ proto_library(
"attack_path.proto",
"backup_disaster_recovery.proto",
"bigquery_export.proto",
"cloud_armor.proto",
"cloud_dlp_data_profile.proto",
"cloud_dlp_inspection.proto",
"compliance.proto",
@ -41,6 +42,7 @@ proto_library(
"external_system.proto",
"file.proto",
"finding.proto",
"folder.proto",
"group_membership.proto",
"iam_binding.proto",
"indicator.proto",
@ -51,6 +53,7 @@ proto_library(
"log_entry.proto",
"mitre_attack.proto",
"mute_config.proto",
"notebook.proto",
"notification_config.proto",
"notification_message.proto",
"org_policy.proto",
@ -75,6 +78,7 @@ proto_library(
"//google/iam/v1:iam_policy_proto",
"//google/iam/v1:policy_proto",
"//google/longrunning:operations_proto",
"@com_google_protobuf//:duration_proto",
"@com_google_protobuf//:empty_proto",
"@com_google_protobuf//:field_mask_proto",
"@com_google_protobuf//:struct_proto",
@ -122,8 +126,8 @@ java_gapic_library(
rest_numeric_enums = True,
service_yaml = "securitycenter_v2.yaml",
test_deps = [
"//google/iam/v1:iam_java_grpc",
":securitycenter_java_grpc",
"//google/iam/v1:iam_java_grpc",
],
transport = "grpc+rest",
deps = [
@ -145,6 +149,7 @@ java_gapic_test(
# Open Source Packages
java_gapic_assembly_gradle_pkg(
name = "google-cloud-securitycenter-v2-java",
include_samples = True,
transport = "grpc+rest",
deps = [
":securitycenter_java_gapic",
@ -152,7 +157,6 @@ java_gapic_assembly_gradle_pkg(
":securitycenter_java_proto",
":securitycenter_proto",
],
include_samples = True,
)
##############################################################################
@ -194,6 +198,7 @@ go_gapic_library(
"//google/longrunning:longrunning_go_proto",
"@com_google_cloud_go_longrunning//:go_default_library",
"@com_google_cloud_go_longrunning//autogen:go_default_library",
"@io_bazel_rules_go//proto/wkt:duration_go_proto",
"@io_bazel_rules_go//proto/wkt:struct_go_proto",
],
)
@ -203,9 +208,9 @@ go_gapic_assembly_pkg(
name = "gapi-cloud-securitycenter-v2-go",
deps = [
":securitycenter_go_gapic",
":securitycenter_go_gapic_srcjar-test.srcjar",
":securitycenter_go_gapic_srcjar-metadata.srcjar",
":securitycenter_go_gapic_srcjar-snippets.srcjar",
":securitycenter_go_gapic_srcjar-test.srcjar",
":securitycenter_go_proto",
],
)
@ -271,8 +276,8 @@ php_gapic_library(
name = "securitycenter_php_gapic",
srcs = [":securitycenter_proto_with_info"],
grpc_service_config = None,
rest_numeric_enums = True,
migration_mode = "NEW_SURFACE_ONLY",
rest_numeric_enums = True,
service_yaml = "securitycenter_v2.yaml",
transport = "grpc+rest",
deps = [
@ -326,8 +331,8 @@ nodejs_gapic_assembly_pkg(
# buildifier: disable=same-origin-load
load(
"@com_google_googleapis_imports//:imports.bzl",
"ruby_gapic_assembly_pkg",
"ruby_cloud_gapic_library",
"ruby_gapic_assembly_pkg",
"ruby_grpc_library",
"ruby_proto_library",
)
@ -387,7 +392,6 @@ load(
csharp_proto_library(
name = "securitycenter_csharp_proto",
extra_opts = [],
deps = [":securitycenter_proto"],
)

1
google/cloud/securitycenter/v2/attack_path.proto
View file

@ -31,6 +31,7 @@ message AttackPath {
option (google.api.resource) = {
type: "securitycenter.googleapis.com/AttackPath"
pattern: "organizations/{organization}/simulations/{simulation}/valuedResources/{valued_resource}/attackPaths/{attack_path}"
pattern: "organizations/{organization}/locations/{location}/simulations/{simulation}/valuedResources/{valued_resource}/attackPaths/{attack_path}"
plural: "attackPaths"
singular: "attackPath"
};

114
google/cloud/securitycenter/v2/cloud_armor.proto Normal file
View file

@ -0,0 +1,114 @@
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securitycenter.v2;
import "google/protobuf/duration.proto";
option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
option java_multiple_files = true;
option java_outer_classname = "CloudArmorProto";
option java_package = "com.google.cloud.securitycenter.v2";
option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
option ruby_package = "Google::Cloud::SecurityCenter::V2";
// Fields related to Google Cloud Armor findings.
message CloudArmor {
// Information about the [Google Cloud Armor security
// policy](https://cloud.google.com/armor/docs/security-policy-overview)
// relevant to the finding.
SecurityPolicy security_policy = 1;
// Information about incoming requests evaluated by [Google Cloud Armor
// security
// policies](https://cloud.google.com/armor/docs/security-policy-overview).
Requests requests = 2;
// Information about potential Layer 7 DDoS attacks identified by [Google
// Cloud Armor Adaptive
// Protection](https://cloud.google.com/armor/docs/adaptive-protection-overview).
AdaptiveProtection adaptive_protection = 3;
// Information about DDoS attack volume and classification.
Attack attack = 4;
// Distinguish between volumetric & protocol DDoS attack and
// application layer attacks. For example, "L3_4" for Layer 3 and Layer 4 DDoS
// attacks, or "L_7" for Layer 7 DDoS attacks.
string threat_vector = 5;
// Duration of attack from the start until the current moment (updated every 5
// minutes).
google.protobuf.Duration duration = 6;
}
// Information about the [Google Cloud Armor security
// policy](https://cloud.google.com/armor/docs/security-policy-overview)
// relevant to the finding.
message SecurityPolicy {
// The name of the Google Cloud Armor security policy, for example,
// "my-security-policy".
string name = 1;
// The type of Google Cloud Armor security policy for example, 'backend
// security policy', 'edge security policy', 'network edge security policy',
// or 'always-on DDoS protection'.
string type = 2;
// Whether or not the associated rule or policy is in preview mode.
bool preview = 3;
}
// Information about the requests relevant to the finding.
message Requests {
// For 'Increasing deny ratio', the ratio is the denied traffic divided by the
// allowed traffic. For 'Allowed traffic spike', the ratio is the allowed
// traffic in the short term divided by allowed traffic in the long term.
double ratio = 1;
// Allowed RPS (requests per second) in the short term.
int32 short_term_allowed = 2;
// Allowed RPS (requests per second) over the long term.
int32 long_term_allowed = 3;
// Denied RPS (requests per second) over the long term.
int32 long_term_denied = 4;
}
// Information about [Google Cloud Armor Adaptive
// Protection](https://cloud.google.com/armor/docs/cloud-armor-overview#google-cloud-armor-adaptive-protection).
message AdaptiveProtection {
// A score of 0 means that there is low confidence that the detected event is
// an actual attack. A score of 1 means that there is high confidence that the
// detected event is an attack. See the [Adaptive Protection
// documentation](https://cloud.google.com/armor/docs/adaptive-protection-overview#configure-alert-tuning)
// for further explanation.
double confidence = 1;
}
// Information about DDoS attack volume and classification.
message Attack {
// Total PPS (packets per second) volume of attack.
int32 volume_pps = 1;
// Total BPS (bytes per second) volume of attack.
int32 volume_bps = 2;
// Type of attack, for example, 'SYN-flood', 'NTP-udp', or 'CHARGEN-udp'.
string classification = 3;
}

8
google/cloud/securitycenter/v2/finding.proto
View file

@ -22,6 +22,7 @@ import "google/cloud/securitycenter/v2/access.proto";
import "google/cloud/securitycenter/v2/application.proto";
import "google/cloud/securitycenter/v2/attack_exposure.proto";
import "google/cloud/securitycenter/v2/backup_disaster_recovery.proto";
import "google/cloud/securitycenter/v2/cloud_armor.proto";
import "google/cloud/securitycenter/v2/cloud_dlp_data_profile.proto";
import "google/cloud/securitycenter/v2/cloud_dlp_inspection.proto";
import "google/cloud/securitycenter/v2/compliance.proto";
@ -40,6 +41,7 @@ import "google/cloud/securitycenter/v2/kubernetes.proto";
import "google/cloud/securitycenter/v2/load_balancer.proto";
import "google/cloud/securitycenter/v2/log_entry.proto";
import "google/cloud/securitycenter/v2/mitre_attack.proto";
import "google/cloud/securitycenter/v2/notebook.proto";
import "google/cloud/securitycenter/v2/org_policy.proto";
import "google/cloud/securitycenter/v2/process.proto";
import "google/cloud/securitycenter/v2/security_marks.proto";
@ -431,6 +433,12 @@ message Finding {
// The load balancers associated with the finding.
repeated LoadBalancer load_balancers = 50;
// Fields related to Cloud Armor findings.
CloudArmor cloud_armor = 51;
// Notebook associated with the finding.
Notebook notebook = 55;
// Contains details about a group of security issues that, when the issues
// occur together, represent a greater risk than when the issues occur
// independently. A group of such issues is referred to as a toxic

36
google/cloud/securitycenter/v2/folder.proto Normal file
View file

@ -0,0 +1,36 @@
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securitycenter.v2;
option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
option java_multiple_files = true;
option java_outer_classname = "FolderProto";
option java_package = "com.google.cloud.securitycenter.v2";
option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
option ruby_package = "Google::Cloud::SecurityCenter::V2";
// Message that contains the resource name and display name of a folder
// resource.
message Folder {
// Full resource name of this folder. See:
// https://cloud.google.com/apis/design/resource_names#full_resource_name
string resource_folder = 1;
// The user defined display name for this folder.
string resource_folder_display_name = 2;
}

14
google/cloud/securitycenter/v2/mitre_attack.proto
View file

@ -78,7 +78,7 @@ message MitreAttack {
// MITRE ATT&CK techniques that can be referenced by SCC findings.
// See: https://attack.mitre.org/techniques/enterprise/
// Next ID: 59
// Next ID: 63
enum Technique {
// Unspecified value.
TECHNIQUE_UNSPECIFIED = 0;
@ -107,6 +107,9 @@ message MitreAttack {
// T1059.004
UNIX_SHELL = 7;
// T1059.006
PYTHON = 59;
// T1069
PERMISSION_GROUPS_DISCOVERY = 18;
@ -254,8 +257,17 @@ message MitreAttack {
// T1595.001
SCANNING_IP_BLOCKS = 2;
// T1613
CONTAINER_ADMINISTRATION_COMMAND = 60;
// T1611
ESCAPE_TO_HOST = 61;
// T1613
CONTAINER_AND_RESOURCE_DISCOVERY = 57;
// T1649
STEAL_OR_FORGE_AUTHENTICATION_CERTIFICATES = 62;
}
// The MITRE ATT&CK tactic most closely represented by this finding, if any.

44
google/cloud/securitycenter/v2/notebook.proto Normal file
View file

@ -0,0 +1,44 @@
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securitycenter.v2;
import "google/protobuf/timestamp.proto";
option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
option java_multiple_files = true;
option java_outer_classname = "NotebookProto";
option java_package = "com.google.cloud.securitycenter.v2";
option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
option ruby_package = "Google::Cloud::SecurityCenter::V2";
// Represents a Jupyter notebook IPYNB file, such as a [Colab Enterprise
// notebook](https://cloud.google.com/colab/docs/introduction) file, that is
// associated with a finding.
message Notebook {
// The name of the notebook.
string name = 1;
// The source notebook service, for example, "Colab Enterprise".
string service = 2;
// The user ID of the latest author to modify the notebook.
string last_author = 3;
// The most recent time the notebook was updated.
google.protobuf.Timestamp notebook_update_time = 4;
}

217
google/cloud/securitycenter/v2/resource.proto
View file

@ -17,6 +17,7 @@ syntax = "proto3";
package google.cloud.securitycenter.v2;
import "google/api/field_behavior.proto";
import "google/cloud/securitycenter/v2/folder.proto";
option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
option go_package = "cloud.google.com/go/securitycenter/apiv2/securitycenterpb;securitycenterpb";
@ -37,4 +38,220 @@ message Resource {
// The full resource type of the resource.
string type = 3;
// Indicates which cloud provider the finding is from.
CloudProvider cloud_provider = 4;
// The service or resource provider associated with the resource.
string service = 5;
// The region or location of the service (if applicable).
string location = 6;
oneof cloud_provider_metadata {
// The GCP metadata associated with the finding.
GcpMetadata gcp_metadata = 7;
// The AWS metadata associated with the finding.
AwsMetadata aws_metadata = 8;
// The Azure metadata associated with the finding.
AzureMetadata azure_metadata = 9;
}
// Provides the path to the resource within the resource hierarchy.
ResourcePath resource_path = 10;
// A string representation of the resource path.
// For Google Cloud, it has the format of
// organizations/{organization_id}/folders/{folder_id}/folders/{folder_id}/projects/{project_id}
// where there can be any number of folders.
// For AWS, it has the format of
// org/{organization_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/account/{account_id}
// where there can be any number of organizational units.
// For Azure, it has the format of
// mg/{management_group_id}/mg/{management_group_id}/subscription/{subscription_id}/rg/{resource_group_name}
// where there can be any number of management groups.
string resource_path_string = 11;
}
// The cloud provider the finding pertains to.
enum CloudProvider {
// The cloud provider is unspecified.
CLOUD_PROVIDER_UNSPECIFIED = 0;
// The cloud provider is Google Cloud Platform.
GOOGLE_CLOUD_PLATFORM = 1;
// The cloud provider is Amazon Web Services.
AMAZON_WEB_SERVICES = 2;
// The cloud provider is Microsoft Azure.
MICROSOFT_AZURE = 3;
}
// GCP metadata associated with the resource, only applicable if the finding's
// cloud provider is Google Cloud Platform.
message GcpMetadata {
// The full resource name of project that the resource belongs to.
string project = 1;
// The project ID that the resource belongs to.
string project_display_name = 2;
// The full resource name of resource's parent.
string parent = 3;
// The human readable name of resource's parent.
string parent_display_name = 4;
// Output only. Contains a Folder message for each folder in the assets
// ancestry. The first folder is the deepest nested folder, and the last
// folder is the folder directly under the Organization.
repeated Folder folders = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
// The name of the organization that the resource belongs to.
string organization = 6;
}
// AWS metadata associated with the resource, only applicable if the finding's
// cloud provider is Amazon Web Services.
message AwsMetadata {
// An organization is a collection of accounts that are centrally managed
// together using consolidated billing, organized hierarchically with
// organizational units (OUs), and controlled with policies.
message AwsOrganization {
// The unique identifier (ID) for the organization. The regex pattern for an
// organization ID string requires "o-" followed by from 10 to 32 lowercase
// letters or digits.
string id = 1;
}
// An Organizational Unit (OU) is a container of AWS accounts within a root of
// an organization. Policies that are attached to an OU apply to all accounts
// contained in that OU and in any child OUs.
message AwsOrganizationalUnit {
// The unique identifier (ID) associated with this OU. The regex pattern for
// an organizational unit ID string requires "ou-" followed by from 4 to 32
// lowercase letters or digits (the ID of the root that contains the OU).
// This string is followed by a second "-" dash and from 8 to 32 additional
// lowercase letters or digits. For example, "ou-ab12-cd34ef56".
string id = 1;
// The friendly name of the OU.
string name = 2;
}
// An AWS account that is a member of an organization.
message AwsAccount {
// The unique identifier (ID) of the account, containing exactly 12 digits.
string id = 1;
// The friendly name of this account.
string name = 2;
}
// The AWS organization associated with the resource.
AwsOrganization organization = 1;
// A list of AWS organizational units associated with the resource, ordered
// from lowest level (closest to the account) to highest level.
repeated AwsOrganizationalUnit organizational_units = 2;
// The AWS account associated with the resource.
AwsAccount account = 3;
}
// Azure metadata associated with the resource, only applicable if the finding's
// cloud provider is Microsoft Azure.
message AzureMetadata {
// Represents an Azure management group.
message AzureManagementGroup {
// The UUID of the Azure management group, for example,
// "20000000-0001-0000-0000-000000000000".
string id = 1;
// The display name of the Azure management group.
string display_name = 2;
}
// Represents an Azure subscription.
message AzureSubscription {
// The UUID of the Azure subscription, for example,
// "291bba3f-e0a5-47bc-a099-3bdcb2a50a05".
string id = 1;
// The display name of the Azure subscription.
string display_name = 2;
}
// Represents an Azure resource group.
message AzureResourceGroup {
// The name of the Azure resource group. This is not a UUID.
string name = 1;
}
// A list of Azure management groups associated with the resource, ordered
// from lowest level (closest to the subscription) to highest level.
repeated AzureManagementGroup management_groups = 1;
// The Azure subscription associated with the resource.
AzureSubscription subscription = 2;
// The Azure resource group associated with the resource.
AzureResourceGroup resource_group = 3;
}
// Represents the path of resources leading up to the resource this finding is
// about.
message ResourcePath {
// The type of resource the node represents.
enum ResourcePathNodeType {
// Node type is unspecified.
RESOURCE_PATH_NODE_TYPE_UNSPECIFIED = 0;
// The node represents a Google Cloud organization.
GCP_ORGANIZATION = 1;
// The node represents a Google Cloud folder.
GCP_FOLDER = 2;
// The node represents a Google Cloud project.
GCP_PROJECT = 3;
// The node represents an AWS organization.
AWS_ORGANIZATION = 4;
// The node represents an AWS organizational unit.
AWS_ORGANIZATIONAL_UNIT = 5;
// The node represents an AWS account.
AWS_ACCOUNT = 6;
// The node represents an Azure management group.
AZURE_MANAGEMENT_GROUP = 7;
// The node represents an Azure subscription.
AZURE_SUBSCRIPTION = 8;
// The node represents an Azure resource group.
AZURE_RESOURCE_GROUP = 9;
}
// A node within the resource path. Each node represents a resource within the
// resource hierarchy.
message ResourcePathNode {
// The type of resource this node represents.
ResourcePathNodeType node_type = 1;
// The ID of the resource this node represents.
string id = 2;
// The display name of the resource this node represents.
string display_name = 3;
}
// The list of nodes that make the up resource path, ordered from lowest
// level to highest level.
repeated ResourcePathNode nodes = 1;
}

44
google/cloud/securitycenter/v2/resource_value_config.proto
View file

@ -18,6 +18,7 @@ package google.cloud.securitycenter.v2;
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/securitycenter/v2/resource.proto";
import "google/protobuf/timestamp.proto";
option csharp_namespace = "Google.Cloud.SecurityCenter.V2";
@ -28,12 +29,15 @@ option java_package = "com.google.cloud.securitycenter.v2";
option php_namespace = "Google\\Cloud\\SecurityCenter\\V2";
option ruby_package = "Google::Cloud::SecurityCenter::V2";
// A resource value config (RVC) is a mapping configuration of user's resources
// to resource values. Used in Attack path simulations.
// A resource value configuration (RVC) is a mapping configuration of user's
// resources to resource values. Used in Attack path simulations.
message ResourceValueConfig {
option (google.api.resource) = {
type: "securitycenter.googleapis.com/ResourceValueConfig"
pattern: "organizations/{organization}/resourceValueConfigs/{resource_value_config}"
pattern: "organizations/{organization}/locations/{location}/resourceValueConfigs/{resource_value_config}"
plural: "resourceValueConfigs"
singular: "resourceValueConfig"
};
// Resource value mapping for Sensitive Data Protection findings
@ -49,48 +53,52 @@ message ResourceValueConfig {
ResourceValue medium_sensitivity_mapping = 2;
}
// Name for the resource value config
// Name for the resource value configuration
string name = 1;
// Resource value level this expression represents
// Only required when there is no SDP mapping in the request
ResourceValue resource_value = 2;
// Required. Tag values combined with AND to check against.
// Required. Tag values combined with <code>AND</code> to check against.
// Values in the form "tagValues/123"
// E.g. [ "tagValues/123", "tagValues/456", "tagValues/789" ]
// Example: [ "tagValues/123", "tagValues/456", "tagValues/789" ]
// https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing
repeated string tag_values = 3 [(google.api.field_behavior) = REQUIRED];
// Apply resource_value only to resources that match resource_type.
// resource_type will be checked with "AND" of other resources.
// E.g. "storage.googleapis.com/Bucket" with resource_value "HIGH" will
// apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
// resource_type will be checked with <code>AND</code> of other resources.
// For example, "storage.googleapis.com/Bucket" with resource_value "HIGH"
// will apply "HIGH" value only to "storage.googleapis.com/Bucket" resources.
string resource_type = 4;
// Project or folder to scope this config to.
// For example, "project/456" would apply this config only to resources in
// "project/456"
// scope will be checked with "AND" of other resources.
// Project or folder to scope this configuration to.
// For example, "project/456" would apply this configuration only to resources
// in "project/456" scope will be checked with <code>AND</code> of other
// resources.
string scope = 5;
// List of resource labels to search for, evaluated with AND.
// E.g. "resource_labels_selector": {"key": "value", "env": "prod"}
// will match resources with labels "key": "value" AND "env": "prod"
// List of resource labels to search for, evaluated with <code>AND</code>.
// For example, "resource_labels_selector": {"key": "value", "env": "prod"}
// will match resources with labels "key": "value" <code>AND</code> "env":
// "prod"
// https://cloud.google.com/resource-manager/docs/creating-managing-labels
map<string, string> resource_labels_selector = 6;
// Description of the resource value config.
// Description of the resource value configuration.
string description = 7;
// Output only. Timestamp this resource value config was created.
// Output only. Timestamp this resource value configuration was created.
google.protobuf.Timestamp create_time = 8
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Timestamp this resource value config was last updated.
// Output only. Timestamp this resource value configuration was last updated.
google.protobuf.Timestamp update_time = 9
[(google.api.field_behavior) = OUTPUT_ONLY];
// Cloud provider this configuration applies to
CloudProvider cloud_provider = 10;
// A mapping of the sensitivity on Sensitive Data Protection finding to
// resource values. This mapping can only be used in combination with a
// resource_type that is related to BigQuery, e.g.

81
google/cloud/securitycenter/v2/securitycenter_service.proto
View file

@ -27,6 +27,7 @@ import "google/cloud/securitycenter/v2/external_system.proto";
import "google/cloud/securitycenter/v2/finding.proto";
import "google/cloud/securitycenter/v2/mute_config.proto";
import "google/cloud/securitycenter/v2/notification_config.proto";
import "google/cloud/securitycenter/v2/resource.proto";
import "google/cloud/securitycenter/v2/resource_value_config.proto";
import "google/cloud/securitycenter/v2/security_marks.proto";
import "google/cloud/securitycenter/v2/simulation.proto";
@ -54,6 +55,10 @@ option (google.api.resource_definition) = {
type: "securitycenter.googleapis.com/FolderLocation"
pattern: "folders/{folder}/locations/{location}"
};
option (google.api.resource_definition) = {
type: "securitycenter.googleapis.com/OrganizationValuedResource"
pattern: "organizations/{organization}/locations/{location}/simulations/{simulation}/valuedResources/{valued_resource}"
};
// V2 APIs for Security Center service.
service SecurityCenter {
@ -68,6 +73,10 @@ service SecurityCenter {
option (google.api.http) = {
post: "/v2/{parent=organizations/*}/resourceValueConfigs:batchCreate"
body: "*"
additional_bindings {
post: "/v2/{parent=organizations/*/locations/*}/resourceValueConfigs:batchCreate"
body: "*"
}
};
option (google.api.method_signature) = "parent,requests";
}
@ -283,6 +292,9 @@ service SecurityCenter {
returns (google.protobuf.Empty) {
option (google.api.http) = {
delete: "/v2/{name=organizations/*/resourceValueConfigs/*}"
additional_bindings {
delete: "/v2/{name=organizations/*/locations/*/resourceValueConfigs/*}"
}
};
option (google.api.method_signature) = "name";
}
@ -306,6 +318,9 @@ service SecurityCenter {
rpc GetSimulation(GetSimulationRequest) returns (Simulation) {
option (google.api.http) = {
get: "/v2/{name=organizations/*/simulations/*}"
additional_bindings {
get: "/v2/{name=organizations/*/locations/*/simulations/*}"
}
};
option (google.api.method_signature) = "name";
}
@ -314,6 +329,9 @@ service SecurityCenter {
rpc GetValuedResource(GetValuedResourceRequest) returns (ValuedResource) {
option (google.api.http) = {
get: "/v2/{name=organizations/*/simulations/*/valuedResources/*}"
additional_bindings {
get: "/v2/{name=organizations/*/locations/*/simulations/*/valuedResources/*}"
}
};
option (google.api.method_signature) = "name";
}
@ -382,6 +400,9 @@ service SecurityCenter {
returns (ResourceValueConfig) {
option (google.api.http) = {
get: "/v2/{name=organizations/*/resourceValueConfigs/*}"
additional_bindings {
get: "/v2/{name=organizations/*/locations/*/resourceValueConfigs/*}"
}
};
option (google.api.method_signature) = "name";
}
@ -445,9 +466,15 @@ service SecurityCenter {
additional_bindings {
get: "/v2/{parent=organizations/*/simulations/*/valuedResources/*}/attackPaths"
}
additional_bindings {
get: "/v2/{parent=organizations/*/locations/*/simulations/*/valuedResources/*}/attackPaths"
}
additional_bindings {
get: "/v2/{parent=organizations/*/simulations/*/attackExposureResults/*}/attackPaths"
}
additional_bindings {
get: "/v2/{parent=organizations/*/locations/*/simulations/*/attackExposureResults/*}/attackPaths"
}
};
option (google.api.method_signature) = "parent";
}
@ -553,6 +580,9 @@ service SecurityCenter {
returns (ListResourceValueConfigsResponse) {
option (google.api.http) = {
get: "/v2/{parent=organizations/*}/resourceValueConfigs"
additional_bindings {
get: "/v2/{parent=organizations/*/locations/*}/resourceValueConfigs"
}
};
option (google.api.method_signature) = "parent";
}
@ -808,6 +838,10 @@ service SecurityCenter {
option (google.api.http) = {
patch: "/v2/{resource_value_config.name=organizations/*/resourceValueConfigs/*}"
body: "resource_value_config"
additional_bindings {
patch: "/v2/{resource_value_config.name=organizations/*/locations/*/resourceValueConfigs/*}"
body: "resource_value_config"
}
};
option (google.api.method_signature) = "resource_value_config,update_mask";
}
@ -1295,14 +1329,6 @@ message GroupFindingsRequest {
// Required. Expression that defines what assets fields to use for grouping.
// The string value should follow SQL syntax: comma separated list of fields.
// For example: "parent,resource_name".
//
// The following fields are supported:
//
// * resource_name
// * category
// * state
// * parent
// * severity
string group_by = 3 [(google.api.field_behavior) = REQUIRED];
// The value returned by the last `GroupFindingsResponse`; indicates
@ -1580,6 +1606,41 @@ message ListFindingsResponse {
// The full resource type of the resource.
string type = 3;
// Indicates which cloud provider the finding is from.
CloudProvider cloud_provider = 4;
// The service or resource provider associated with the resource.
string service = 5;
// The region or location of the service (if applicable).
string location = 6;
oneof cloud_provider_metadata {
// The GCP metadata associated with the finding.
GcpMetadata gcp_metadata = 7;
// The AWS metadata associated with the finding.
AwsMetadata aws_metadata = 8;
// The Azure metadata associated with the finding.
AzureMetadata azure_metadata = 9;
}
// Provides the path to the resource within the resource hierarchy.
ResourcePath resource_path = 10;
// A string representation of the resource path.
// For Google Cloud, it has the format of
// organizations/{organization_id}/folders/{folder_id}/folders/{folder_id}/projects/{project_id}
// where there can be any number of folders.
// For AWS, it has the format of
// org/{organization_id}/ou/{organizational_unit_id}/ou/{organizational_unit_id}/account/{account_id}
// where there can be any number of organizational units.
// For Azure, it has the format of
// mg/{management_group_id}/mg/{management_group_id}/subscription/{subscription_id}/rg/{resource_group_name}
// where there can be any number of management groups.
string resource_path_string = 11;
}
// Finding matching the search request.
@ -1936,6 +1997,10 @@ message UpdateResourceValueConfigRequest {
// The list of fields to be updated.
// If empty all mutable fields will be updated.
//
// To update nested fields, include the top level field in the mask
// For example, to update gcp_metadata.resource_type, include the
// "gcp_metadata" field mask
google.protobuf.FieldMask update_mask = 2;
}

5
google/cloud/securitycenter/v2/simulation.proto
View file

@ -18,6 +18,7 @@ package google.cloud.securitycenter.v2;
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/securitycenter/v2/resource.proto";
import "google/cloud/securitycenter/v2/valued_resource.proto";
import "google/protobuf/timestamp.proto";
@ -34,6 +35,7 @@ message Simulation {
option (google.api.resource) = {
type: "securitycenter.googleapis.com/Simulation"
pattern: "organizations/{organization}/simulations/{simulation}"
pattern: "organizations/{organization}/locations/{location}/simulations/{simluation}"
plural: "simulations"
singular: "simulation"
};
@ -49,4 +51,7 @@ message Simulation {
// Resource value configurations' metadata used in this simulation. Maximum of
// 100.
repeated ResourceValueConfigMetadata resource_value_configs_metadata = 3;
// Indicates which cloud provider was used in this simulation.
CloudProvider cloud_provider = 4;
}

1
google/cloud/securitycenter/v2/valued_resource.proto
View file

@ -31,6 +31,7 @@ message ValuedResource {
option (google.api.resource) = {
type: "securitycenter.googleapis.com/ValuedResource"
pattern: "organizations/{organization}/simulations/{simulation}/valuedResources/{valued_resource}"
pattern: "organizations/{organization}/locations/{location}/simulations/{simluation}/valuedResources/{valued_resource}"
plural: "valuedResources"
singular: "valuedResource"
};